badrabbit | a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\[email protected]"	[email protected]

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	[email protected]

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x0006000000018b26-211.dat	mimikatz

Executes dropped EXE 25 IoCs

pid	Process
1344	[email protected]
1116	[email protected]
964	[email protected]
1824	[email protected]
1488	[email protected]
1752	[email protected]
2000	[email protected]
1352	[email protected]
592	[email protected]
548	[email protected]
1068	[email protected]
2028	[email protected]
1360	[email protected]
1268	[email protected]
1868	302746537.exe
1692	reg.exe
584	6AdwCleaner.exe
1632	[email protected]
1624	[email protected]
1588	[email protected]
1496	[email protected]
1012	[email protected]
1600	[email protected]
1688	avpc2009.exe
320	[email protected]

Modifies Windows Firewall 1 TTPs 2 IoCs

Modify Existing Service

T1031

pid	Process
2168	netsh.exe
3592	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1752-80-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/files/0x0007000000015622-75.dat	upx
behavioral1/files/0x0006000000016cec-114.dat	upx
behavioral1/memory/1752-113-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/1624-136-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1868-151-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/1624-153-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/files/0x0006000000016c38-231.dat	upx
behavioral1/files/0x0006000000016c38-233.dat	upx
behavioral1/memory/2252-241-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1752-298-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/1868-300-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/1624-301-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Loads dropped DLL 7 IoCs

pid	Process
592	[email protected]
1824	[email protected]
1824	[email protected]
1688	avpc2009.exe
1688	avpc2009.exe
1688	avpc2009.exe
1012	[email protected]

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2736	icacls.exe
2704	icacls.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/320-242-0x0000000000400000-0x0000000000CFB000-memory.dmp	themida
behavioral1/memory/320-286-0x0000000000400000-0x0000000000CFB000-memory.dmp	themida
behavioral1/memory/320-294-0x0000000000400000-0x0000000000CFB000-memory.dmp	themida
behavioral1/memory/320-304-0x0000000000400000-0x0000000000CFB000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\[email protected]"	[email protected]

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\F:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\Z:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\antiviruspc2009\libltdl3.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\libltdl3.dll	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\__tmp_rar_sfx_access_check_7109121	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\bzip2.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\bzip2.dll	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\avpc2009.exe	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\avpc2009.exe	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll	[email protected]

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_7108169	[email protected]
File created	C:\Windows\antivirus-platinum.exe	[email protected]
File opened for modification	C:\Windows\antivirus-platinum.exe	[email protected]
File created	C:\Windows\MSCOMCTL.OCX	[email protected]
File created	C:\Windows\302746537.exe	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File created	C:\Windows\COMCTL32.OCX	[email protected]
File opened for modification	C:\Windows\COMCTL32.OCX	[email protected]
File opened for modification	C:\Windows\MSCOMCTL.OCX	[email protected]
File opened for modification	C:\Windows\302746537.exe	[email protected]

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3600	sc.exe
3624	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2380	2036	WerFault.exe	66
3820	3740	WerFault.exe	193

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000015e3d-87.dat	nsis_installer_1
behavioral1/files/0x0006000000015e3d-87.dat	nsis_installer_2
behavioral1/files/0x0006000000015e3d-99.dat	nsis_installer_1
behavioral1/files/0x0006000000015e3d-99.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2852	schtasks.exe
2376	schtasks.exe

Kills process with taskkill 2 IoCs

pid	Process
1956	taskkill.exe
3424	taskkill.exe

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

pid	Process
3336	reg.exe
1692	reg.exe
2076	reg.exe
1700	reg.exe
1908	reg.exe
3944	reg.exe
2108	reg.exe
2260	reg.exe
1932	reg.exe
4024	reg.exe
2176	reg.exe
2288	reg.exe
3328	reg.exe
2224	reg.exe
2876	reg.exe
3064	reg.exe
4076	reg.exe
3320	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	23	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1624	[email protected]
1484	rundll32.exe
2028	[email protected]
1484	rundll32.exe
1624	[email protected]
1012	[email protected]

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
Token: SeShutdownPrivilege	1484	rundll32.exe
Token: SeDebugPrivilege	1484	rundll32.exe
Token: SeTcbPrivilege	1484	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1344	[email protected]

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1624	[email protected]
2000	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1344	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	28
PID 564 wrote to memory of 1344	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	28
PID 564 wrote to memory of 1344	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	28
PID 564 wrote to memory of 1344	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	28
PID 564 wrote to memory of 1116	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	27
PID 564 wrote to memory of 1116	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	27
PID 564 wrote to memory of 1116	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	27
PID 564 wrote to memory of 1116	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	27
PID 564 wrote to memory of 1116	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	27
PID 564 wrote to memory of 1116	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	27
PID 564 wrote to memory of 1116	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	27
PID 564 wrote to memory of 964	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	29
PID 564 wrote to memory of 964	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	29
PID 564 wrote to memory of 964	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	29
PID 564 wrote to memory of 964	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	29
PID 564 wrote to memory of 1824	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	30
PID 564 wrote to memory of 1824	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	30
PID 564 wrote to memory of 1824	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	30
PID 564 wrote to memory of 1824	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	30
PID 564 wrote to memory of 1824	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	30
PID 564 wrote to memory of 1824	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	30
PID 564 wrote to memory of 1824	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	30
PID 564 wrote to memory of 1488	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	31
PID 564 wrote to memory of 1488	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	31
PID 564 wrote to memory of 1488	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	31
PID 564 wrote to memory of 1488	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	31
PID 564 wrote to memory of 1488	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	31
PID 564 wrote to memory of 1488	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	31
PID 564 wrote to memory of 1488	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	31
PID 564 wrote to memory of 1752	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	32
PID 564 wrote to memory of 1752	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	32
PID 564 wrote to memory of 1752	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	32
PID 564 wrote to memory of 1752	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	32
PID 564 wrote to memory of 2000	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	40
PID 564 wrote to memory of 2000	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	40
PID 564 wrote to memory of 2000	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	40
PID 564 wrote to memory of 2000	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	40
PID 564 wrote to memory of 1352	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	34
PID 564 wrote to memory of 1352	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	34
PID 564 wrote to memory of 1352	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	34
PID 564 wrote to memory of 1352	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	34
PID 564 wrote to memory of 592	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	35
PID 564 wrote to memory of 592	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	35
PID 564 wrote to memory of 592	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	35
PID 564 wrote to memory of 592	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	35
PID 564 wrote to memory of 548	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	37
PID 564 wrote to memory of 548	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	37
PID 564 wrote to memory of 548	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	37
PID 564 wrote to memory of 548	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	37
PID 1488 wrote to memory of 1484	1488	[email protected]	36
PID 1488 wrote to memory of 1484	1488	[email protected]	36
PID 1488 wrote to memory of 1484	1488	[email protected]	36
PID 1488 wrote to memory of 1484	1488	[email protected]	36
PID 1488 wrote to memory of 1484	1488	[email protected]	36
PID 1488 wrote to memory of 1484	1488	[email protected]	36
PID 1488 wrote to memory of 1484	1488	[email protected]	36
PID 564 wrote to memory of 1068	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	38
PID 564 wrote to memory of 1068	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	38
PID 564 wrote to memory of 1068	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	38
PID 564 wrote to memory of 1068	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	38
PID 564 wrote to memory of 2028	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	39
PID 564 wrote to memory of 2028	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	39
PID 564 wrote to memory of 2028	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	39
PID 564 wrote to memory of 2028	564	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	39

Views/modifies file attributes 1 TTPs 2 IoCs

Hidden Files and Directories

T1158

pid	Process
2684	attrib.exe
2276	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe"
1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1116
- - C:\WINDOWS\302746537.exe
    "C:\WINDOWS\302746537.exe"
    3⤵
    - Executes dropped EXE
    PID:1868
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\AC18.tmp\302746537.bat" "
      4⤵
      PID:2612
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s c:\windows\comctl32.ocx
        5⤵
        
        PID:2804
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s c:\windows\mscomctl.ocx
        5⤵
        
        PID:3028
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1344
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:1824
- - C:\Program Files (x86)\antiviruspc2009\avpc2009.exe
    "C:\Program Files (x86)\antiviruspc2009\avpc2009.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1688
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      PID:980
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        
        PID:2348
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 386111685 && exit"
      4⤵
      PID:472
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 386111685 && exit"
        5⤵
        Creates scheduled task(s)
        
        PID:2852
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 14:56:00
      4⤵
      PID:960
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 14:56:00
        5⤵
        Creates scheduled task(s)
        
        PID:2376
  - - C:\Windows\9DB7.tmp
      "C:\Windows\9DB7.tmp" \\.\pipe\{5D983210-E07A-4516-81E0-21DD0A2D9431}
      4⤵
      PID:2060
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    PID:1956
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:592
- - C:\Users\Admin\AppData\Local\6AdwCleaner.exe
    "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
    3⤵
    - Executes dropped EXE
    PID:584
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Enumerates VirtualBox registry keys
  - Executes dropped EXE
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2000
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:2168
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall reset
    3⤵
    - Modifies Windows Firewall
    PID:3592
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  PID:1268
- - C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe
    "C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe"
    3⤵
    PID:3560
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1692 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\[email protected]" & start C:\Users\Admin\AppData\Local\xeozppms.exe -f
    3⤵
    PID:2728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /pid 1692
      4⤵
      Kills process with taskkill
      PID:3424
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1624
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- - C:\Users\Admin\qiUYEYUk\vQkIcwYI.exe
    "C:\Users\Admin\qiUYEYUk\vQkIcwYI.exe"
    3⤵
    PID:904
- - C:\ProgramData\IIwkMYAg\wqccYwoU.exe
    "C:\ProgramData\IIwkMYAg\wqccYwoU.exe"
    3⤵
    PID:1864
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom"
    3⤵
    PID:780
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom
      4⤵
      PID:2864
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:2108
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - Modifies registry key
    PID:2176
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:2224
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\QWQgYkUo.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
    3⤵
    PID:2316
  - - C:\Windows\SysWOW64\cscript.exe
      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
      4⤵
      PID:2828
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  PID:1600
- - C:\Users\Admin\AppData\Local\Temp\is-DD3U8.tmp\is-2Q9DL.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-DD3U8.tmp\is-2Q9DL.tmp" /SL4 $20190 "C:\Users\Admin\AppData\Local\Temp\[email protected]" 779923 55808
    3⤵
    PID:2796
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  PID:288
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    C:\Users\Admin\AppData\Local\Temp\[email protected]
    3⤵
    PID:2628
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  PID:1464
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 152
    3⤵
    - Program crash
    PID:2380
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  PID:2116
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:3600
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:3624
- - C:\Users\Admin\AppData\Roaming\lflesb.exe
    C:\Users\Admin\AppData\Roaming\lflesb.exe
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\EN2B55~1.EXE" >> NUL
    3⤵
    PID:4044
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  PID:2184
- - C:\Users\Admin\AppData\Local\Temp\winsp2up.exe
    "C:\Users\Admin\AppData\Local\Temp\winsp2up.exe"
    3⤵
    PID:1820
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock"
    3⤵
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock
      4⤵
      PID:368
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock"
        5⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock
        6⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock"
        7⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock
        8⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock"
        9⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        7⤵
        Modifies registry key
        
        PID:1700
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\RYwAQMsk.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
        7⤵
        
        PID:896
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        8⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        7⤵
        Modifies registry key
        
        PID:1932
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        7⤵
        Modifies registry key
        
        PID:1908
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Executes dropped EXE
        Modifies registry key
        
        PID:1692
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:2076
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2288
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\fwUcoUQE.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
        5⤵
        
        PID:2548
      - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        6⤵
        
        PID:1396
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:2876
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - Modifies registry key
    PID:3064
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\saMkQEcw.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
    3⤵
    PID:2280
  - - C:\Windows\SysWOW64\cscript.exe
      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
      4⤵
      PID:2724
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  PID:2252
- - C:\Program Files (x86)\VAV\vav.exe
    "C:\Program Files (x86)\VAV\vav.exe"
    3⤵
    PID:1912
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  PID:2340
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - Views/modifies file attributes
    PID:2684
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\taskdl.exe
    taskdl.exe
    3⤵
    PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c 154151664462343.bat
    3⤵
    PID:2708
  - - C:\Windows\SysWOW64\cscript.exe
      cscript.exe //nologo m.vbs
      4⤵
      PID:2388
- - C:\Users\Admin\AppData\Local\Temp\taskdl.exe
    taskdl.exe
    3⤵
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\@[email protected]
    @[email protected] co
    3⤵
    PID:3584
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b @[email protected] vs
    3⤵
    PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected] vs
      4⤵
      PID:3912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "aztxuihvriyhjfk319" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
    3⤵
    PID:3860
- - C:\Users\Admin\AppData\Local\Temp\@[email protected]
    @[email protected]
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\taskse.exe
    taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
    3⤵
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\taskdl.exe
    taskdl.exe
    3⤵
    PID:832
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  PID:2392
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\[email protected] SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
    3⤵
    PID:2668
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  PID:2568
- C:\Users\Admin\AppData\Local\Temp\Fantom.exe
  "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
  2⤵
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
    3⤵
    PID:2712
- C:\Users\Admin\AppData\Local\Temp\ose00000.exe
  "C:\Users\Admin\AppData\Local\Temp\ose00000.exe"
  2⤵
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
  "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe"
  2⤵
  PID:2676
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3108
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3092
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3076
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:2192
- - C:\Users\Admin\AppData\Local\Temp\@[email protected]
    "C:\Users\Admin\AppData\Local\Temp\@[email protected]"
    3⤵
    PID:2220
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3220
  - - C:\Users\Admin\AppData\Local\6AdwCleaner.exe
      "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
      4⤵
      PID:2604
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3240
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3456
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3640
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom"
      4⤵
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom
        5⤵
        
        PID:3676
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:3944
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:4024
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:4076
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\muYwoMUs.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
      4⤵
      PID:4084
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3668
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\is-BQ48U.tmp\is-GS133.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BQ48U.tmp\is-GS133.tmp" /SL4 $300D0 "C:\Users\Admin\AppData\Local\Temp\[email protected]" 779923 55808
      4⤵
      PID:2132
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 152
      4⤵
      Program crash
      PID:3820
- - C:\Users\Admin\AppData\Local\Temp\taskdl.exe
    "C:\Users\Admin\AppData\Local\Temp\taskdl.exe"
    3⤵
    PID:3868
- - C:\Users\Admin\AppData\Local\Temp\ose00000.exe
    "C:\Users\Admin\AppData\Local\Temp\ose00000.exe"
    3⤵
    PID:3860
- - C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3828
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h .
      4⤵
      Views/modifies file attributes
      PID:2276
  - - C:\Windows\SysWOW64\icacls.exe
      icacls . /grant Everyone:F /T /C /Q
      4⤵
      Modifies file permissions
      PID:2704
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3812
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock"
      4⤵
      PID:3280
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:3320
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\icYMcwcs.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
      4⤵
      PID:3344
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:3336
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:3328
- - C:\Users\Admin\AppData\Local\Temp\taskse.exe
    "C:\Users\Admin\AppData\Local\Temp\taskse.exe"
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\winsp2up.exe
    "C:\Users\Admin\AppData\Local\Temp\winsp2up.exe"
    3⤵
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe"
    3⤵
    PID:3996

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Bootkit

T1067

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Impair Defenses

T1562

Install Root Certificate

T1130

Modify Registry