Analysis
-
max time kernel
154s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 21:50
Static task
static1
Behavioral task
behavioral1
Sample
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe
-
Size
410KB
-
MD5
56815047f7f330dcb598899915d6606e
-
SHA1
8f20faecf7448606c2601bc03f94a6ed4d7c960b
-
SHA256
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
-
SHA512
fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-1809750270-3141839489-3074374771-1000\RECOVERgmtxs.txt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What's the matter with your files?
Your data was secured using a strong encryption with RSA4096.
Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem)
What exactly that means?
It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore.
In other words they are useless, however, there is a possibility to restore them with our help.
What exactly happened to your files?
*** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private.
*** All your data and files were encrypted by the means of the public key, which you received over the web.
*** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers.
What should you do next?
There are several options for you to consider:
1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or
2. You can start getting BitCoins right now and get access to your data quite fast.
In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data.
In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below:
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/C438AF99CDA8E12A
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/C438AF99CDA8E12A
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/C438AF99CDA8E12A
If you can't access your personal homepage or the addresses are not working, complete the following steps:
1. Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en
2. Install TOR Browser
3. Open TOR Browser
4. Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/C438AF99CDA8E12A
5. Follow the steps on your screen
IMPORTANT INFORMATION
Your personal homepages:
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/C438AF99CDA8E12A
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/C438AF99CDA8E12A
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/C438AF99CDA8E12A
Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/C438AF99CDA8E12A
Your personal identification ID: C438AF99CDA8E12A
URLs
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/C438AF99CDA8E12A
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/C438AF99CDA8E12A
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/C438AF99CDA8E12A
http://k7tlx3ghr3m4n2tu.onion/C438AF99CDA8E12A
Signatures
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
pid Process 3880 esbsqx.exe 940 esbsqx.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation esbsqx.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 988 set thread context of 812 988 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 88 PID 3880 set thread context of 940 3880 esbsqx.exe 92 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-16_contrast-black.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-125_contrast-black.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\iheart-radio.scale-125.png esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\Windows Media Player\fr-FR\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\SmallTile.scale-125.png esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tl\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_SplashScreen.scale-200.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\Common Files\System\en-US\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\AppxMetadata\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt esbsqx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-400.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-200.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-256_altform-unplated_contrast-white.png esbsqx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreSmallTile.scale-100.png esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ta\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp4.scale-125.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\RECOVERgmtxs.png esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\hrtfs\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\VALoading.png esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\RECOVERgmtxs.txt esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\RECOVERgmtxs.html esbsqx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\91.jpg esbsqx.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt esbsqx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\RECOVERgmtxs.txt esbsqx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2548 vssadmin.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\trueimg esbsqx.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe 940 esbsqx.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 940 esbsqx.exe Token: SeBackupPrivilege 3700 vssvc.exe Token: SeRestorePrivilege 3700 vssvc.exe Token: SeAuditPrivilege 3700 vssvc.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 988 wrote to memory of 812 988 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 88 PID 988 wrote to memory of 812 988 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 88 PID 988 wrote to memory of 812 988 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 88 PID 988 wrote to memory of 812 988 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 88 PID 988 wrote to memory of 812 988 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 88 PID 988 wrote to memory of 812 988 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 88 PID 988 wrote to memory of 812 988 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 88 PID 988 wrote to memory of 812 988 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 88 PID 988 wrote to memory of 812 988 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 88 PID 988 wrote to memory of 812 988 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 88 PID 812 wrote to memory of 3880 812 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 89 PID 812 wrote to memory of 3880 812 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 89 PID 812 wrote to memory of 3880 812 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 89 PID 812 wrote to memory of 3696 812 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 90 PID 812 wrote to memory of 3696 812 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 90 PID 812 wrote to memory of 3696 812 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 90 PID 3880 wrote to memory of 940 3880 esbsqx.exe 92 PID 3880 wrote to memory of 940 3880 esbsqx.exe 92 PID 3880 wrote to memory of 940 3880 esbsqx.exe 92 PID 3880 wrote to memory of 940 3880 esbsqx.exe 92 PID 3880 wrote to memory of 940 3880 esbsqx.exe 92 PID 3880 wrote to memory of 940 3880 esbsqx.exe 92 PID 3880 wrote to memory of 940 3880 esbsqx.exe 92 PID 3880 wrote to memory of 940 3880 esbsqx.exe 92 PID 3880 wrote to memory of 940 3880 esbsqx.exe 92 PID 3880 wrote to memory of 940 3880 esbsqx.exe 92 PID 940 wrote to memory of 2548 940 esbsqx.exe 93 PID 940 wrote to memory of 2548 940 esbsqx.exe 93 PID 940 wrote to memory of 1720 940 esbsqx.exe 97 PID 940 wrote to memory of 1720 940 esbsqx.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe"C:\Users\Admin\AppData\Local\Temp\43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe"C:\Users\Admin\AppData\Local\Temp\43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\Documents\esbsqx.exeC:\Users\Admin\Documents\esbsqx.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\Documents\esbsqx.exeC:\Users\Admin\Documents\esbsqx.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:2548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sgmxb.bat5⤵PID:1720
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\43C4D8~1.EXE >> NUL3⤵PID:3696
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3700
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
410KB
MD556815047f7f330dcb598899915d6606e
SHA18f20faecf7448606c2601bc03f94a6ed4d7c960b
SHA25643c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
SHA512fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03
-
Filesize
410KB
MD556815047f7f330dcb598899915d6606e
SHA18f20faecf7448606c2601bc03f94a6ed4d7c960b
SHA25643c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
SHA512fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03
-
Filesize
410KB
MD556815047f7f330dcb598899915d6606e
SHA18f20faecf7448606c2601bc03f94a6ed4d7c960b
SHA25643c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
SHA512fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03