Analysis
-
max time kernel
53s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 08:05
Static task
static1
Behavioral task
behavioral1
Sample
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe
Resource
win10v2004-20220414-en
General
-
Target
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe
-
Size
228KB
-
MD5
707c69692402945982492eede5c829ca
-
SHA1
1e2da40c770722385982f6f0a49a4920f69870ba
-
SHA256
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8
-
SHA512
5373029d7fad0c36c0f7dfeaafddaf869c7f5f53d07b4b81e0af7a32764a7fd24299bdb05ea000efdc6c840b6e5f19613315fa1185d19161d7342a4b065e8164
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\#HOW_TO_DECRYPT#.txt
https://icq.com/windows/
https://icq.im/RicardoMilosGachimuchi
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RepairRestart.tiff b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1684 cmd.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe\" e" b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exedescription ioc process File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-1819626980-2277161760-1023733287-1000\desktop.ini b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exeb236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exevssadmin.exevssadmin.exevssadmin.exedescription ioc process File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\D: b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe File opened (read-only) \??\E: b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1132 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1840 timeout.exe -
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exepid process 1696 vssadmin.exe 1980 vssadmin.exe 484 vssadmin.exe 1984 vssadmin.exe 1504 vssadmin.exe 1980 vssadmin.exe 896 vssadmin.exe 1892 vssadmin.exe 472 vssadmin.exe 964 vssadmin.exe 672 vssadmin.exe 1564 vssadmin.exe 1132 vssadmin.exe 1204 vssadmin.exe -
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 1132 NOTEPAD.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exeb236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exepid process 1212 powershell.exe 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 1888 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
Processes:
vssvc.exewmic.exepowershell.exedescription pid process Token: SeBackupPrivilege 2028 vssvc.exe Token: SeRestorePrivilege 2028 vssvc.exe Token: SeAuditPrivilege 2028 vssvc.exe Token: SeIncreaseQuotaPrivilege 688 wmic.exe Token: SeSecurityPrivilege 688 wmic.exe Token: SeTakeOwnershipPrivilege 688 wmic.exe Token: SeLoadDriverPrivilege 688 wmic.exe Token: SeSystemProfilePrivilege 688 wmic.exe Token: SeSystemtimePrivilege 688 wmic.exe Token: SeProfSingleProcessPrivilege 688 wmic.exe Token: SeIncBasePriorityPrivilege 688 wmic.exe Token: SeCreatePagefilePrivilege 688 wmic.exe Token: SeBackupPrivilege 688 wmic.exe Token: SeRestorePrivilege 688 wmic.exe Token: SeShutdownPrivilege 688 wmic.exe Token: SeDebugPrivilege 688 wmic.exe Token: SeSystemEnvironmentPrivilege 688 wmic.exe Token: SeRemoteShutdownPrivilege 688 wmic.exe Token: SeUndockPrivilege 688 wmic.exe Token: SeManageVolumePrivilege 688 wmic.exe Token: 33 688 wmic.exe Token: 34 688 wmic.exe Token: 35 688 wmic.exe Token: SeIncreaseQuotaPrivilege 688 wmic.exe Token: SeSecurityPrivilege 688 wmic.exe Token: SeTakeOwnershipPrivilege 688 wmic.exe Token: SeLoadDriverPrivilege 688 wmic.exe Token: SeSystemProfilePrivilege 688 wmic.exe Token: SeSystemtimePrivilege 688 wmic.exe Token: SeProfSingleProcessPrivilege 688 wmic.exe Token: SeIncBasePriorityPrivilege 688 wmic.exe Token: SeCreatePagefilePrivilege 688 wmic.exe Token: SeBackupPrivilege 688 wmic.exe Token: SeRestorePrivilege 688 wmic.exe Token: SeShutdownPrivilege 688 wmic.exe Token: SeDebugPrivilege 688 wmic.exe Token: SeSystemEnvironmentPrivilege 688 wmic.exe Token: SeRemoteShutdownPrivilege 688 wmic.exe Token: SeUndockPrivilege 688 wmic.exe Token: SeManageVolumePrivilege 688 wmic.exe Token: 33 688 wmic.exe Token: 34 688 wmic.exe Token: 35 688 wmic.exe Token: SeDebugPrivilege 1212 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exenet.exedescription pid process target process PID 1836 wrote to memory of 1980 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1980 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1980 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1980 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 2012 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe net.exe PID 1836 wrote to memory of 2012 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe net.exe PID 1836 wrote to memory of 2012 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe net.exe PID 1836 wrote to memory of 2012 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe net.exe PID 2012 wrote to memory of 1696 2012 net.exe net1.exe PID 2012 wrote to memory of 1696 2012 net.exe net1.exe PID 2012 wrote to memory of 1696 2012 net.exe net1.exe PID 2012 wrote to memory of 1696 2012 net.exe net1.exe PID 1836 wrote to memory of 1132 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe sc.exe PID 1836 wrote to memory of 1132 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe sc.exe PID 1836 wrote to memory of 1132 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe sc.exe PID 1836 wrote to memory of 1132 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe sc.exe PID 1836 wrote to memory of 688 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe wmic.exe PID 1836 wrote to memory of 688 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe wmic.exe PID 1836 wrote to memory of 688 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe wmic.exe PID 1836 wrote to memory of 688 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe wmic.exe PID 1836 wrote to memory of 896 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 896 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 896 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 896 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 672 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 672 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 672 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 672 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1984 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1984 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1984 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1984 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1892 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1892 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1892 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1892 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 472 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 472 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 472 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 472 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1564 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1564 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1564 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1564 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 964 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 964 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 964 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 964 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1696 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1696 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1696 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1696 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1132 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1132 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1132 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1132 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1980 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1980 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1980 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1980 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1204 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1204 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1204 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe PID 1836 wrote to memory of 1204 1836 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe vssadmin.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe"C:\Users\Admin\AppData\Local\Temp\b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\net.exenet stop VSS & sc config VSS start= disabled2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VSS & sc config VSS start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config VSS start= Demand & net start VSS2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY delete /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\icacls.exeicacls.exe "{A-Z}:" /grant {Username}:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe" >> NUL2⤵
- Deletes itself
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\StartReset.ps1.[b82bfa9e87].[Ricardo Milos].Washedback1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\StartReset.ps1.[b82bfa9e87].[Ricardo Milos].Washedback2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\#HOW_TO_DECRYPT#.txt1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\StartReset.ps1.[b82bfa9e87].[Ricardo Milos].WashedbackFilesize
281KB
MD5edddcf7f8224d92a9e56b35bf97996c7
SHA19f3e6d81d11dc69eb70d5c12e17cf89200075004
SHA2566dac78c74e3aa8d05438f5abfdefd7b663d794ed6267eb93256c2c1c33be12bd
SHA51235c2847fa909d222431e9f6c29ce9def218496742967177182715c086ae39b2281e8f9c6044ccdc9490445393943e8182d4aadf2a37b6e56ef3f8c1cc32c12a7
-
C:\Users\Public\Desktop\#HOW_TO_DECRYPT#.txtFilesize
2KB
MD544381b240eadf03ac821aa6c25dc1248
SHA13778a9bcb3404abcc5e9fd0f0241e370f96f5762
SHA256a07ca2576f621736a53df65787ea668b6e27ad7258fb19a82de6f419a6d068be
SHA5120a1a7dcd69f8d897310b5d41ad02946eec4c78cc0aac8ef68fd296501f62bbddf347b3d13bb056dd3e0459e8901e4c17742f1b30e37755c8b8d3a2b891794fc3
-
memory/472-69-0x0000000000000000-mapping.dmp
-
memory/484-77-0x0000000000000000-mapping.dmp
-
memory/672-65-0x0000000000000000-mapping.dmp
-
memory/688-63-0x0000000000000000-mapping.dmp
-
memory/896-64-0x0000000000000000-mapping.dmp
-
memory/964-71-0x0000000000000000-mapping.dmp
-
memory/1092-78-0x0000000000000000-mapping.dmp
-
memory/1132-62-0x0000000000000000-mapping.dmp
-
memory/1132-73-0x0000000000000000-mapping.dmp
-
memory/1132-87-0x0000000000000000-mapping.dmp
-
memory/1204-75-0x0000000000000000-mapping.dmp
-
memory/1212-82-0x0000000073B60000-0x000000007410B000-memory.dmpFilesize
5.7MB
-
memory/1212-81-0x0000000073B60000-0x000000007410B000-memory.dmpFilesize
5.7MB
-
memory/1212-79-0x0000000000000000-mapping.dmp
-
memory/1504-76-0x0000000000000000-mapping.dmp
-
memory/1564-70-0x0000000000000000-mapping.dmp
-
memory/1684-83-0x0000000000000000-mapping.dmp
-
memory/1696-61-0x0000000000000000-mapping.dmp
-
memory/1696-72-0x0000000000000000-mapping.dmp
-
memory/1836-55-0x0000000000B30000-0x0000000000BBD000-memory.dmpFilesize
564KB
-
memory/1836-57-0x0000000000B30000-0x0000000000BBD000-memory.dmpFilesize
564KB
-
memory/1836-54-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB
-
memory/1836-68-0x0000000000B30000-0x0000000000BBD000-memory.dmpFilesize
564KB
-
memory/1836-58-0x0000000000B30000-0x0000000000BBD000-memory.dmpFilesize
564KB
-
memory/1836-56-0x0000000000B30000-0x0000000000BBD000-memory.dmpFilesize
564KB
-
memory/1836-84-0x0000000000B30000-0x0000000000BBD000-memory.dmpFilesize
564KB
-
memory/1840-85-0x0000000000000000-mapping.dmp
-
memory/1888-86-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmpFilesize
8KB
-
memory/1892-67-0x0000000000000000-mapping.dmp
-
memory/1980-59-0x0000000000000000-mapping.dmp
-
memory/1980-74-0x0000000000000000-mapping.dmp
-
memory/1984-66-0x0000000000000000-mapping.dmp
-
memory/2012-60-0x0000000000000000-mapping.dmp