Malware Analysis Report

2024-09-11 01:48

Sample ID 240122-jrxlkscad6
Target 6f21a85894e91b7082407e08e7c231c8
SHA256 f5fb7fa5231c18f0951c755c4cb0ec07b0889b5e320f42213cbf6bbbe499ad31
Tags
medusalocker evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f5fb7fa5231c18f0951c755c4cb0ec07b0889b5e320f42213cbf6bbbe499ad31

Threat Level: Known bad

The file 6f21a85894e91b7082407e08e7c231c8 was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion persistence ransomware spyware stealer

Medusalocker family

MedusaLocker payload

Renames multiple (658) files with added filename extension

Renames multiple (921) files with added filename extension

Deletes shadow copies

Modifies boot configuration data using bcdedit

Drops file in Drivers directory

Deletes System State backups

Checks computer location settings

Reads user/profile data of web browsers

Deletes itself

Adds Run key to start application

Drops desktop.ini file(s)

Enumerates connected drives

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Interacts with shadow copies

System policy modification

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-01-22 07:54

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-22 07:54

Reported

2024-01-22 07:57

Platform

win7-20231215-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe"

Signatures

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (921) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\networks.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\drivers\etc\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6f21a85894e91b7082407e08e7c231c8.exe\" e" C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-3818056530-936619650-3554021955-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\D: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\D: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\g: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\config\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\SYSTEM C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\70ede4ed-794b-4f83-9c44-1260b7d1ebde.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\BCD-Template C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\DEFAULT C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\1da1a4aa-14f7-49d3-aecc-2509b8cde4dc.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\Microsoft\Protect\S-1-5-18\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\931bd4aa-fe52-473b-b884-df04ca9342e0.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\SOFTWARE C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\1da1a4aa-14f7-49d3-aecc-2509b8cde4dc.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\70ede4ed-794b-4f83-9c44-1260b7d1ebde.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\config\RegBack\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\931bd4aa-fe52-473b-b884-df04ca9342e0.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\LogFiles\Scm\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\BCD-Template.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\SECURITY C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\1da1a4aa-14f7-49d3-aecc-2509b8cde4dc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\SYSTEM C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\SAM C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\70ede4ed-794b-4f83-9c44-1260b7d1ebde C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Merida.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Curacao.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Java\jre7\lib\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\GMT.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Inuvik C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nipigon.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Swift_Current C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Toronto.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Rome.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Godthab.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Qatar.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montreal.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Yakutat C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Godthab.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Sitka C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\MST.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Adak.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Noronha.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dili.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Juneau C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Panama.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Amman C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Managua C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Madrid.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Beirut.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Godthab C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Martinique.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Rome C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb2 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_1 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\Boot\DVD\EFI\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th0 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File created C:\Windows\Boot\PCAT\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Boot\DVD\PCAT\BCD C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_2 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb0 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\ehome\CreateDisc\Components\tables\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th2 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Panther\setupinfo.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb2 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_0 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th1 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb1 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb0 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb1 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\dewindow C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Panther\setupinfo.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_1 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_0 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_3 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\Boot\DVD\PCAT\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_2 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Panther\setupinfo C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\Panther\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Boot\PCAT\bootmgr C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th0 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th1 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Boot\DVD\EFI\BCD C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th2 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\enwindow C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2284 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\vssadmin.exe
PID 2284 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\bcdedit.exe
PID 2284 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\bcdedit.exe
PID 2284 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\bcdedit.exe
PID 2284 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\bcdedit.exe
PID 2284 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\bcdedit.exe
PID 2284 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\bcdedit.exe
PID 2284 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\wbadmin.exe
PID 2284 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\wbadmin.exe
PID 2284 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\wbadmin.exe
PID 2284 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\wbadmin.exe
PID 2284 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\wbadmin.exe
PID 2284 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\wbadmin.exe
PID 2284 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\System32\Wbem\wmic.exe
PID 2284 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\System32\Wbem\wmic.exe
PID 2284 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\System32\Wbem\wmic.exe
PID 2284 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\cmd.exe
PID 2284 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\cmd.exe
PID 2284 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe

"C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe"

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled No

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6F21A8~1.EXE >> NUL

Network

N/A

Files

C:\Users\Admin\!!!HOW_TO_DECRYPT!!!.mht

MD5 ec59d4348c9c5117c73ac265ecd1a906
SHA1 eb53c8334d0eaaf966756da857388b23e0b6ba56
SHA256 951eb92a70ac1f3f3bf4d8081c7af364fc503db8eac5b752537720068f67250d
SHA512 3c184ff84db5d9db63a3271c45f931addf6ec4b1524a45335664bc37beb55d3c5592634fff34af2777bced1ccdb554a8a961d60655ca63957ca312d8c3c87ca2

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-22 07:54

Reported

2024-01-22 07:57

Platform

win10v2004-20231215-en

Max time kernel

144s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe"

Signatures

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Renames multiple (658) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\wbadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\wbadmin.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\drivers\etc\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6f21a85894e91b7082407e08e7c231c8.exe\" e" C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-1232405761-1209240240-3206092754-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\G: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\G: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\D: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\E: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\H: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\F: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\F: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\D: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\ResPriHMImageList C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\BCD-Template.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\DRIVERS.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\BCD-Template C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\SYSTEM C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\a9f89635-3b33-48c8-8f1c-50f90848cc8e.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\23d97bd8-ed8c-4205-a32d-6d7ff012a5c2 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\DRIVERS.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1fc5a100-cd02-44ca-8210-ed0cae57b139 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\BBI C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\Microsoft\Protect\S-1-5-18\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\23d97bd8-ed8c-4205-a32d-6d7ff012a5c2.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\SAM C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\SOFTWARE C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\System32\config\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f2\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\removed-files.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\precomplete.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_w1\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\postSigningData C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Google\Chrome\Application\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\precomplete.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\precomplete C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f33\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Mozilla Firefox\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\postSigningData.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\postSigningData.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\removed-files.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{D44822A8-FC28-42FC-8B1D-21A78579FC79}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7} C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CB0836EC-B072-368D-82B2-D3470BF95707}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_1d8b510d-d32c-42bd-9a91-b82cb6ed494a.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\SYSTEM32\wbadmin.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{4A03706F-666A-4037-7777-5F2748764D10}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\Boot\DVD\EFI\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\AppReadiness\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180381}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{3A706840-2882-423C-90EB-B31545E2BC7A}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{4A03706F-666A-4037-7777-5F2748764D10} C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{B175520C-86A2-35A7-8619-86DC379688B9}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{3A706840-2882-423C-90EB-B31545E2BC7A} C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{76DEEAB3-122F-4231-83C7-0C35363D02F9}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\SYSTEM32\wbadmin.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{6DB765A8-05AF-49A1-A71D-6F645EE3CE41} C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_1d8b510d-d32c-42bd-9a91-b82cb6ed494a.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{C7141A99-592B-4226-A4E9-B767C1D0FBAF}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Boot\PCAT\bootmgr C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{E016F2B9-01FE-4FAA-882E-ECC43FA49751} C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\Installer\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{37B8F9C7-03FB-3253-8781-2517C99D7C00}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{C7141A99-592B-4226-A4E9-B767C1D0FBAF}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\SYSTEM32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\SYSTEM32\wbadmin.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{37B8F9C7-03FB-3253-8781-2517C99D7C00}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{76DEEAB3-122F-4231-83C7-0C35363D02F9}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BF08E976-B92E-4336-B56F-2171179476C4}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4 C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F} C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{77924AE4-039E-4CA4-87B4-2F64180381F0} C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BF08E976-B92E-4336-B56F-2171179476C4}.1btc C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}.inprocess C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_1d8b510d-d32c-42bd-9a91-b82cb6ed494a C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 840 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 840 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 840 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 840 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 840 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 840 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 840 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 840 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 840 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 840 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\System32\Wbem\wmic.exe
PID 840 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\System32\Wbem\wmic.exe
PID 840 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\cmd.exe
PID 840 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe C:\Windows\system32\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe

"C:\Users\Admin\AppData\Local\Temp\6f21a85894e91b7082407e08e7c231c8.exe"

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled No

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SYSTEM32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SYSTEM32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6F21A8~1.EXE >> NUL

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp

Files

\Device\HarddiskVolume1\Boot\cs-CZ\!!!HOW_TO_DECRYPT!!!.mht

MD5 3b0ad5d99ae2ee41963e95417601a566
SHA1 41b4b53a2ea197b2de7df715df385e8bd38d9ba2
SHA256 a5d4cd8251a31748fc26ed6bd87d522a899938f6171f266b80473f1f53412a69
SHA512 114664e22dd2fe15bd17f0bd73cd1bbb57f7313187730ef4071b65811e316991c50be659e82a095429f07c33291e307f96ca5cd9f9679d8d33aa6c1e406e1944

memory/2460-862-0x0000024D74F40000-0x0000024D74F50000-memory.dmp

memory/2460-868-0x0000024D750A0000-0x0000024D750B0000-memory.dmp

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 b74058ae35c7467534f9be6e4e3eca3d
SHA1 a9943d479c0ba953fcb4584f539649a2050e495c
SHA256 4944826761569582516d606d28555954dd5deba377f6dc7ba1850f0c3aa2cbee
SHA512 d0790ce8da5369c1dd26123ff85d29dba6aea6e85d4af02dad4d28be7304cc51068c98ff9a47db0546df025d7f8862aca141aa331ff15d4b7eab39bf93bf7f3c

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

MD5 ecf1a04b526b80a73ef024c15b7c8a4c
SHA1 4768f6c16722a03ab49225deab764c5295b01121
SHA256 b353f07bb52b61ed0c574551ab04e0b6da62f19f31edf9634b805e1490f9404d
SHA512 3191238e93fe6816b507a04c5d8dee6caa45a65e3ec533e1bca0557afa131cba718587b6f7a98e00d94101970cf01eb78e47da3affb1ebb1a438d90b3f912123

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

MD5 0c49030f83a3a145042110a424cb2037
SHA1 9223ccb56ee4ffae2fe2f61af070aa51a4eeea3e
SHA256 50122746853fd24589938b0516a7c3002df0d540923342b49e9ed862ddf62c78
SHA512 559ae8c8e4ab7baa408242e9d06166f3916e6ac84415bf5b8f9f68bb1290f6f0abd8dc34f664bdceaabf7fd7be53dbbb8bff13cb51d89a6e70a2f93e2765644a

C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht

MD5 a7c32371ff48b1f9d0295c2bfe403144
SHA1 991596fa732059ef5fd83c01eaf83f447eb3afef
SHA256 575f11cc26637ea1c4e60667aa0222e57222a12246f7386faae4780cf8d1ffea
SHA512 88ac4c25d86129985a40966ebde9d2263dd33b805b649ff4804d25a9004147295990701a6a963376fbecb84f218584f1d992e98c83b85a2d110d0fc8ca0d8f2f

C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.1btc

MD5 b918f3aa99b1385c8b9f73710b5a5f59
SHA1 f3a5618702f1af6d89cc40defbb97ba00d6b762d
SHA256 baab7c3f36981fdfbfea528d5608f07370a5c4dec44a9eb93aa6b347b72265c5
SHA512 a47b64b42baebe56e6b89b7891c3c5d3b716352898e9dac5e18058c32a85dbb9a07cbfbaedac2b7097516415cce8018d7cfd7f704cd3cbd411ba4e0a2c62a5f3

C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.1btc

MD5 21ea3b368c5607e4a24f1375e5020379
SHA1 efe61228cbf02522ce4abbd8d899abe48d7a46cb
SHA256 8fcf7e8488db6e8bf1666abcd2564719a8a08673fea2d2badb924d6027822410
SHA512 4dbc2f7250c9374471a45ad09ce25d940ca2ffcb4b31c135305a67264bcdf340b207077b1475737df45707ba8b1869479cf4529278f3da63d1c78be8c61676ce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB5E2F83CE9B8330B0590B7CD2E5FF2E.1btc

MD5 a1131b4c823d44a0aaa5a88656fff0e4
SHA1 d097aedb5c000ac51c4327374e0709e3ca68b375
SHA256 553bc4721692c68ad497f131e16c6609e8ece96fe000a9a88bf36d4c03e51e74
SHA512 8c7e55261469ef985b5e1565eb1222500d64b40ce9d31c7997830c5535799e2f8f52c7038105f914cd7dbb2b46912e70fb393557b973fcbab8cdf0d43759e348

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.1btc

MD5 ff8c56c176101af09d10784495c846e0
SHA1 c2f7f6e3ae0716d37e7d172b209666b28be16219
SHA256 75819e0be3be6ffded1df1865b29ffd7b93e121ced104c4b035a90784a7c8dc2
SHA512 6b4d4c184f26d9690e0b3a6351fe0ce5a8b0464a89409d79032c9d04f463ad7775529ec9ae2c01339a3744415c1ff9f01cdc1012be436b752e2bb0ba6565aeaa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7.1btc

MD5 19ccaea6e352273aff2c8f1c04088a7f
SHA1 697da24c4894e41b08885954285eb99756a31c8b
SHA256 ee6256401ffa16ee18c720dc62508885b752d8ac59b24a643548d72cfc03be90
SHA512 b054184d23dca084a7ad2d93c68282357be195fd16d6a5967ea1ea45713d1c43137d87d5b631bd449aaf997a10204c6a3b0584e5ab3e5007643491c5f425c0ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F.1btc

MD5 dec635a5fa2389432a94620c5a598318
SHA1 cda225ce6ee41264050c19233e084a3802cc7d94
SHA256 027c4de46cb81cbb84e4bf09fd450d30a1291eec738daca73b26e93da1243710
SHA512 0333efc2bbae6734b56fcf8cec9bccdfdcd00e77fc5f83aac15069c3a5156c9d69ce3248920f0396f92a5e64929a15b203b166e9982bf697d0718c0fdb2ae743

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.1btc

MD5 691ebb1dfe759b548dd1357d25fd8c86
SHA1 f0992786df064f123d4ea6aff5f5a24641457241
SHA256 358f60463925cd51bea7153c0708eb3cd65f5de4fc07d4bddfaf4d6d2cd1d1bd
SHA512 f8c07b09d0f1ffe6808da442b20a42144017dc4229c162293bdac16d1f85bb41cd31664b0d203c81ec52e3f62f1c143709bf7a6e66541b902411c3749f61254f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1btc

MD5 9f2408a11e7bc711877aabf9af56de1b
SHA1 a3c6e414099bb5bdc1664fbf9b6b6acb93701882
SHA256 5a2dd4cbfd5c46eecdd0d86bf8978594ae36b43280ef9bec5bb6684dadf86120
SHA512 bf1fdfb8d8f16ec59bdb9820444626fb39a086b5964812de11e4ccaeeb33dbdce28580542a170347a3abee6d49fb8b1eb60d27fc339594b590787fdcf020fb24