mimic | 351cfdf1916444b9a975254f900ed2b6c502c2c5cb7b7b5576eedfaa496a986c

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Amigodainapasik.exe

Clears Windows event logs 1 TTPs 3 IoCs

evasion ransomware

Indicator Removal

T1070

pid	Process
2084	wevtutil.exe
2628	wevtutil.exe
2548	wevtutil.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

pid	Process
1620	bcdedit.exe
1684	bcdedit.exe

Renames multiple (5772) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes System State backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
2512	wbadmin.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
2120	wbadmin.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe

Executes dropped EXE 6 IoCs

pid	Process
2864	Amigodainapasik.exe
600	Amigodainapasik.exe
1664	Amigodainapasik.exe
2548	Amigodainapasik.exe
1588	Everything.exe
2788	Everything.exe

Loads dropped DLL 15 IoCs

pid	Process
2188	Amigodainapasik.exe
2864	Amigodainapasik.exe
600	Amigodainapasik.exe
1664	Amigodainapasik.exe
2548	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
2788	Everything.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell\open\command	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell\open	Amigodainapasik.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Amigodainapasik = "\"C:\\Users\\Admin\\AppData\\Local\\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\\Amigodainapasik.exe\" "	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Amigodainapasik.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\Amigodainapasik_Decryption.txt\""	Amigodainapasik.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Amigodainapasik.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\T:	Amigodainapasik.exe
File opened (read-only)	\??\W:	Amigodainapasik.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\E:	Amigodainapasik.exe
File opened (read-only)	\??\H:	Amigodainapasik.exe
File opened (read-only)	\??\Z:	Amigodainapasik.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\S:	Amigodainapasik.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\U:	Amigodainapasik.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Q:	Amigodainapasik.exe
File opened (read-only)	\??\Y:	Amigodainapasik.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\B:	Amigodainapasik.exe
File opened (read-only)	\??\P:	Amigodainapasik.exe
File opened (read-only)	\??\R:	Amigodainapasik.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\I:	Amigodainapasik.exe
File opened (read-only)	\??\N:	Amigodainapasik.exe
File opened (read-only)	\??\X:	Amigodainapasik.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\K:	Amigodainapasik.exe
File opened (read-only)	\??\M:	Amigodainapasik.exe
File opened (read-only)	\??\A:	Amigodainapasik.exe
File opened (read-only)	\??\G:	Amigodainapasik.exe
File opened (read-only)	\??\L:	Amigodainapasik.exe
File opened (read-only)	\??\O:	Amigodainapasik.exe
File opened (read-only)	\??\V:	Amigodainapasik.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKREQ.CFG.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\OUTDR_01.MID.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_partly-cloudy.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CONTACTINFOBB.DPV.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227558.JPG.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImageMask.bmp.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_up.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14580_.GIF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01743_.GIF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\ORG97R.SAM.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Office Word 2003 Look.dotx.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\init.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00443_.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02214_.GIF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107482.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts2.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AD98.POC.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Oriel.xml.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341742.JPG.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217302.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186364.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00177_.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01354_.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00298_.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR36F.GIF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Generic.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGMARQ.DPV.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18241_.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309902.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Foundry.thmx.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PPINTL.REST.IDX_DLL.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\TaxonomyControl.dll.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00208_.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\HORN.WAV.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0301076.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15168_.GIF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0300840.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00809_.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099173.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00780L.GIF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195428.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090027.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00882_.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\RSSFeeds.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\HEADER.GIF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\SUCTION.WAV.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACTL.ICO.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18243_.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Median.xml.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Contacts.accdt.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0150150.WMF.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Students.accdt.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT.an8uxv2w	Amigodainapasik.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell\open	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\Amigodainapasik_Decryption.txt\""	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.an8uxv2w	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.an8uxv2w\ = "mimicfile"	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\exefile\shell\open\command	Amigodainapasik.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1340	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2388	PING.EXE

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1664	Amigodainapasik.exe
2548	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
1800	powershell.exe
2168	powershell.exe
1136	powershell.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
1664	Amigodainapasik.exe
2548	Amigodainapasik.exe
2548	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe
2864	Amigodainapasik.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2188	Amigodainapasik.exe
Token: SeSecurityPrivilege	2188	Amigodainapasik.exe
Token: SeTakeOwnershipPrivilege	2188	Amigodainapasik.exe
Token: SeLoadDriverPrivilege	2188	Amigodainapasik.exe
Token: SeSystemProfilePrivilege	2188	Amigodainapasik.exe
Token: SeSystemtimePrivilege	2188	Amigodainapasik.exe
Token: SeProfSingleProcessPrivilege	2188	Amigodainapasik.exe
Token: SeIncBasePriorityPrivilege	2188	Amigodainapasik.exe
Token: SeCreatePagefilePrivilege	2188	Amigodainapasik.exe
Token: SeBackupPrivilege	2188	Amigodainapasik.exe
Token: SeRestorePrivilege	2188	Amigodainapasik.exe
Token: SeShutdownPrivilege	2188	Amigodainapasik.exe
Token: SeDebugPrivilege	2188	Amigodainapasik.exe
Token: SeSystemEnvironmentPrivilege	2188	Amigodainapasik.exe
Token: SeChangeNotifyPrivilege	2188	Amigodainapasik.exe
Token: SeRemoteShutdownPrivilege	2188	Amigodainapasik.exe
Token: SeUndockPrivilege	2188	Amigodainapasik.exe
Token: SeManageVolumePrivilege	2188	Amigodainapasik.exe
Token: SeImpersonatePrivilege	2188	Amigodainapasik.exe
Token: SeCreateGlobalPrivilege	2188	Amigodainapasik.exe
Token: 33	2188	Amigodainapasik.exe
Token: 34	2188	Amigodainapasik.exe
Token: 35	2188	Amigodainapasik.exe
Token: SeIncreaseQuotaPrivilege	2864	Amigodainapasik.exe
Token: SeSecurityPrivilege	2864	Amigodainapasik.exe
Token: SeTakeOwnershipPrivilege	2864	Amigodainapasik.exe
Token: SeLoadDriverPrivilege	2864	Amigodainapasik.exe
Token: SeSystemProfilePrivilege	2864	Amigodainapasik.exe
Token: SeSystemtimePrivilege	2864	Amigodainapasik.exe
Token: SeProfSingleProcessPrivilege	2864	Amigodainapasik.exe
Token: SeIncBasePriorityPrivilege	2864	Amigodainapasik.exe
Token: SeCreatePagefilePrivilege	2864	Amigodainapasik.exe
Token: SeBackupPrivilege	2864	Amigodainapasik.exe
Token: SeRestorePrivilege	2864	Amigodainapasik.exe
Token: SeShutdownPrivilege	2864	Amigodainapasik.exe
Token: SeDebugPrivilege	2864	Amigodainapasik.exe
Token: SeSystemEnvironmentPrivilege	2864	Amigodainapasik.exe
Token: SeChangeNotifyPrivilege	2864	Amigodainapasik.exe
Token: SeRemoteShutdownPrivilege	2864	Amigodainapasik.exe
Token: SeUndockPrivilege	2864	Amigodainapasik.exe
Token: SeManageVolumePrivilege	2864	Amigodainapasik.exe
Token: SeImpersonatePrivilege	2864	Amigodainapasik.exe
Token: SeCreateGlobalPrivilege	2864	Amigodainapasik.exe
Token: 33	2864	Amigodainapasik.exe
Token: 34	2864	Amigodainapasik.exe
Token: 35	2864	Amigodainapasik.exe
Token: SeIncreaseQuotaPrivilege	600	Amigodainapasik.exe
Token: SeSecurityPrivilege	600	Amigodainapasik.exe
Token: SeIncreaseQuotaPrivilege	1664	Amigodainapasik.exe
Token: SeTakeOwnershipPrivilege	600	Amigodainapasik.exe
Token: SeSecurityPrivilege	1664	Amigodainapasik.exe
Token: SeLoadDriverPrivilege	600	Amigodainapasik.exe
Token: SeTakeOwnershipPrivilege	1664	Amigodainapasik.exe
Token: SeSystemProfilePrivilege	600	Amigodainapasik.exe
Token: SeLoadDriverPrivilege	1664	Amigodainapasik.exe
Token: SeSystemtimePrivilege	600	Amigodainapasik.exe
Token: SeProfSingleProcessPrivilege	600	Amigodainapasik.exe
Token: SeIncBasePriorityPrivilege	600	Amigodainapasik.exe
Token: SeCreatePagefilePrivilege	600	Amigodainapasik.exe
Token: SeBackupPrivilege	600	Amigodainapasik.exe
Token: SeRestorePrivilege	600	Amigodainapasik.exe
Token: SeShutdownPrivilege	600	Amigodainapasik.exe
Token: SeSystemProfilePrivilege	1664	Amigodainapasik.exe
Token: SeDebugPrivilege	600	Amigodainapasik.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1588	Everything.exe
2788	Everything.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2864	2188	Amigodainapasik.exe	30
PID 2188 wrote to memory of 2864	2188	Amigodainapasik.exe	30
PID 2188 wrote to memory of 2864	2188	Amigodainapasik.exe	30
PID 2188 wrote to memory of 2864	2188	Amigodainapasik.exe	30
PID 2864 wrote to memory of 2720	2864	Amigodainapasik.exe	31
PID 2864 wrote to memory of 2720	2864	Amigodainapasik.exe	31
PID 2864 wrote to memory of 2720	2864	Amigodainapasik.exe	31
PID 2864 wrote to memory of 2720	2864	Amigodainapasik.exe	31
PID 2864 wrote to memory of 600	2864	Amigodainapasik.exe	33
PID 2864 wrote to memory of 600	2864	Amigodainapasik.exe	33
PID 2864 wrote to memory of 600	2864	Amigodainapasik.exe	33
PID 2864 wrote to memory of 600	2864	Amigodainapasik.exe	33
PID 2864 wrote to memory of 1664	2864	Amigodainapasik.exe	35
PID 2864 wrote to memory of 1664	2864	Amigodainapasik.exe	35
PID 2864 wrote to memory of 1664	2864	Amigodainapasik.exe	35
PID 2864 wrote to memory of 1664	2864	Amigodainapasik.exe	35
PID 2864 wrote to memory of 2548	2864	Amigodainapasik.exe	34
PID 2864 wrote to memory of 2548	2864	Amigodainapasik.exe	34
PID 2864 wrote to memory of 2548	2864	Amigodainapasik.exe	34
PID 2864 wrote to memory of 2548	2864	Amigodainapasik.exe	34
PID 2864 wrote to memory of 1588	2864	Amigodainapasik.exe	36
PID 2864 wrote to memory of 1588	2864	Amigodainapasik.exe	36
PID 2864 wrote to memory of 1588	2864	Amigodainapasik.exe	36
PID 2864 wrote to memory of 1588	2864	Amigodainapasik.exe	36
PID 2864 wrote to memory of 1356	2864	Amigodainapasik.exe	37
PID 2864 wrote to memory of 1356	2864	Amigodainapasik.exe	37
PID 2864 wrote to memory of 1356	2864	Amigodainapasik.exe	37
PID 2864 wrote to memory of 1356	2864	Amigodainapasik.exe	37
PID 2864 wrote to memory of 1688	2864	Amigodainapasik.exe	56
PID 2864 wrote to memory of 1688	2864	Amigodainapasik.exe	56
PID 2864 wrote to memory of 1688	2864	Amigodainapasik.exe	56
PID 2864 wrote to memory of 1688	2864	Amigodainapasik.exe	56
PID 2864 wrote to memory of 2020	2864	Amigodainapasik.exe	55
PID 2864 wrote to memory of 2020	2864	Amigodainapasik.exe	55
PID 2864 wrote to memory of 2020	2864	Amigodainapasik.exe	55
PID 2864 wrote to memory of 2020	2864	Amigodainapasik.exe	55
PID 2864 wrote to memory of 932	2864	Amigodainapasik.exe	54
PID 2864 wrote to memory of 932	2864	Amigodainapasik.exe	54
PID 2864 wrote to memory of 932	2864	Amigodainapasik.exe	54
PID 2864 wrote to memory of 932	2864	Amigodainapasik.exe	54
PID 2864 wrote to memory of 2220	2864	Amigodainapasik.exe	52
PID 2864 wrote to memory of 2220	2864	Amigodainapasik.exe	52
PID 2864 wrote to memory of 2220	2864	Amigodainapasik.exe	52
PID 2864 wrote to memory of 2220	2864	Amigodainapasik.exe	52
PID 2864 wrote to memory of 2044	2864	Amigodainapasik.exe	38
PID 2864 wrote to memory of 2044	2864	Amigodainapasik.exe	38
PID 2864 wrote to memory of 2044	2864	Amigodainapasik.exe	38
PID 2864 wrote to memory of 2044	2864	Amigodainapasik.exe	38
PID 2864 wrote to memory of 2036	2864	Amigodainapasik.exe	50
PID 2864 wrote to memory of 2036	2864	Amigodainapasik.exe	50
PID 2864 wrote to memory of 2036	2864	Amigodainapasik.exe	50
PID 2864 wrote to memory of 2036	2864	Amigodainapasik.exe	50
PID 2864 wrote to memory of 828	2864	Amigodainapasik.exe	49
PID 2864 wrote to memory of 828	2864	Amigodainapasik.exe	49
PID 2864 wrote to memory of 828	2864	Amigodainapasik.exe	49
PID 2864 wrote to memory of 828	2864	Amigodainapasik.exe	49
PID 2864 wrote to memory of 1968	2864	Amigodainapasik.exe	48
PID 2864 wrote to memory of 1968	2864	Amigodainapasik.exe	48
PID 2864 wrote to memory of 1968	2864	Amigodainapasik.exe	48
PID 2864 wrote to memory of 1968	2864	Amigodainapasik.exe	48
PID 2864 wrote to memory of 2004	2864	Amigodainapasik.exe	47
PID 2864 wrote to memory of 2004	2864	Amigodainapasik.exe	47
PID 2864 wrote to memory of 2004	2864	Amigodainapasik.exe	47
PID 2864 wrote to memory of 2004	2864	Amigodainapasik.exe	47

System policy modification 1 TTPs 13 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "\n\n￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾀﾃ￢ﾀﾃ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ\n\n￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾦ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾦ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ\n￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ\n-----------------------------[ Hello, My Dear Friend !!! ]--------------------------\n\nALL YOUR FILES HAVE BEEN ENCRYPTED DUE TO A SECURITY PROBLEM WITH YOUR PC.\n\nIf you want to restore them :\n1) Send your unique id hty9hx_RhOmlJcG-C2fRdLQ_XXurC7q4UK8olaBU-Foan8uxv2w and max 3 files for test decryption\n\nOUR CONTACTS:\n1.1) TOX messenger (fast and anonymous)\nhttps://tox.chat/download.html\nInstall qtox\nPress sign up\nCreate your own name\nPress plus\nPut there our tox ID:\nE9164A982410EFAEBC451C1D5629A2CBB75DBB6BCDBD6D2BA94F4D0A7B0B616F911496E469FB\nAnd add me/write message\n1.2) ICQ Messenger\nICQ live chat which works 24/7 - @Amigodainapasik\nInstall ICQ software on your PC here https://icq.com/windows/ or on your smartphone search for \"ICQ\" in Appstore / Google market\nWrite to our ICQ @Amigodainapasik https://icq.im/Amigodainapasik\n1.3) Skype \nAmigodainapasik Decryption\n1.4) Mail (write only in critical situations bcs your email may not be delivered or get in spam)\n [email protected]\n\nIn subject line please write your decryption ID: hty9hx_RhOmlJcG-C2fRdLQ_XXurC7q4UK8olaBU-Fo*an8uxv2w\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\nAfter payment we will send you the decryption tool that will decrypt all your files.\n\nFREE DECRYPTION AS A GUARANTEE!\nBefore paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived),\nand files should not contain valuable information. (databases, backups, large excel sheets, etc.)\n\nHow to obtain Bitcoins:\nhttps://www.alfa.cash/buy-crypto-with-credit-card (the fastest way)\nbuy.coingate.com\nhttps://bitcoin.org/en/buy\nhttps://buy.moonpay.io\nbinance.com\ncoinmama.com\n\nATTENTION!!!\nDo not rename encrypted files!\nDo not try to decrypt your data using third party software, it may cause permanent data loss!\nDecryption of your files with the help of third parties may cause increased price (they add their fee to our)\nor you may become a victim of a scam!"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " "	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System	Amigodainapasik.exe

C:\Users\Admin\AppData\Local\Temp\Amigodainapasik.exe
"C:\Users\Admin\AppData\Local\Temp\Amigodainapasik.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
  "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe"
  2⤵
  - UAC bypass
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2864
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c DC.exe /D
    3⤵
    PID:2720
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe" -e watch -pid 2864 -!
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:600
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe" -e ul2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2548
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe" -e ul1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe" -startup
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of SetWindowsHookEx
    PID:1588
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -H off
    3⤵
    PID:1356
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:2044
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:1976
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:2184
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    PID:2252
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    PID:1084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1800
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:1788
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:2004
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:1968
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:828
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:2036
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:2220
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:932
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:2020
- - C:\Windows\system32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:1688
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1620
- - C:\Windows\system32\wbadmin.exe
    wbadmin.exe delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:2120
- - C:\Windows\system32\wbadmin.exe
    wbadmin.exe DELETE SYSTEMSTATEBACKUP
    3⤵
    - Deletes System State backups
    - Drops file in Windows directory
    PID:2512
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1684
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe" -startup
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious use of SetWindowsHookEx
    PID:2788
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fSingleSessionPerUser" /t REG_DWORD /d 0x0 /f
    3⤵
    PID:1768
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe "C:\Users\Admin\AppData\Local\Amigodainapasik_Decryption.txt"
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1340
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl security
    3⤵
    - Clears Windows event logs
    PID:2548
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl application
    3⤵
    - Clears Windows event logs
    PID:2084
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl system
    3⤵
    - Clears Windows event logs
    PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /d /c "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\sd.bat"
    3⤵
    PID:1416
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.2 -n 5
      4⤵
      Runs ping.exe
      PID:2388
  - - C:\Windows\SysWOW64\fsutil.exe
      fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe"
      4⤵
      PID:2120

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2012

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2856

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2908

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery