Analysis Overview
SHA256
98ae4ea0d6b8a0e9e474ba156cffbc5337638c6a328d84195777d77c6491b371
Threat Level: Likely malicious
The file Folders.txt was found to be: Likely malicious.
Malicious Activity Summary
Manipulates Digital Signatures
Drops file in Drivers directory
Possible privilege escalation attempt
Modifies file permissions
Drops file in System32 directory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Modifies registry class
Opens file in notepad (likely ransom note)
Suspicious use of FindShellTrayWindow
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-03-12 00:23
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-03-12 00:23
Reported
2024-03-12 00:27
Platform
win7-20240221-en
Max time kernel
176s
Max time network
179s
Command Line
Signatures
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\drivers\it-IT\volmgrx.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\MTConfig.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\partmgr.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\TsUsbFlt.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\fr-FR\ULIAGPKX.SYS.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\it-IT\afd.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\vwifibus.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\mrxsmb10.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\stream.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\usbhub.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\pnpmem.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\fr-FR\vdrvroot.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\hidusb.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\bthpan.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\vhdmp.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\ndis.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\fr-FR\Dot4usb.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\fr-FR\luafv.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\mssmbios.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\ndisuio.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\modem.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\rdpwd.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\de-DE\mouclass.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\de-DE\mouhid.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\cdrom.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\RNDISMP.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\tsusbhub.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\ohci1394.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\dxg.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\kbdclass.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\sermouse.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\disk.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\tunnel.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\ndis.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\pci.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\wdf01000.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\bthport.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\nwifi.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\it-IT\bfe.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\it-IT\RNDISMP.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\tcpip.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\de-DE\battc.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\BrSerId.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\ohci1394.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\it-IT\hidbth.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\it-IT\wdf01000.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\scfilter.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\netbios.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\pci.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\usbrpm.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\wd.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\pcmcia.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\tunnel.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\UMDF\it-IT\WpdMtpDr.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\de-DE\ndisuio.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\fr-FR\amdk8.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ja-JP\1394ohci.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ndisuio.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ntfs.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\rdyboost.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\de-DE\volmgrx.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\es-ES\pacer.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\rasacd.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\BrSerIb.sys.mui | C:\Windows\system32\cmd.exe | N/A |
Manipulates Digital Signatures
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\wintrust.dll | C:\Windows\system32\cmd.exe | N/A |
Possible privilege escalation attempt
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\ja-JP\RW330Ext.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\spp\tokens\issuance\client-issuance-pkc.xrm-ms | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\en-US\OfflineFilesWmiProvider.mfl | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\en-US\prnhp004.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\AVMX64~1.INF\fpcmbase.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\oobe\it-IT\OOBE_HELP_What_is_User_Account.rtf | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\ja-JP\xrWPcoin.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\de-DE\win32_tpm.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\config\SAM~2.LOG | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\MDMMHZ~1.INF\mdmmhzel.PNF | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\en-US\setupcln.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\en-US\prnbr00a.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\PRNCS3~1.INF\Amd64\CS60RN10.ICM | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\fr-FR\ql2300.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\fr-FR\tpm.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\ja-JP\MTConfig.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\en-US\rdvgumd64.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\DeviceProperties.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\WABSyncProvider.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\en-US\prnep004.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\1394~2.INF\1394bus.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\MDMCM2~1.INF\mdmcm28.PNF | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\Speech\SpeechUX\sapi.cpl | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\ja-JP\oleres.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\netcfgx.dll | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\PR5648~1.INF\Amd64\CNB_0289.DLL | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\en-US\wsqmcons.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\CNHW500.DLL.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\inetppui.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\ja-JP\sppuinotify.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\ja-JP\systeminfo.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\fr-FR\iscsiprf.mfl | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\LSI_SA~2.INF\lsi_sas2.PNF | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\MDMBUG~1.INF\mdmbug3.inf | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\PRNHP0~4.INF\Amd64\hpd2600t.vdf | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\fr-FR\imageres.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\msieftp.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\ja-JP\fdprint.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\it-IT\wmiutils.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\de-DE\p2p.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\en-US\elxstor.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\WI4BF3~1.INF\CNFRA3.ICC | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\WPDShServiceObj.mof | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\CXRAPT~1.INF\cxraptor_PhilipsTUV1236D_IBV64.inf | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\it-IT\prnky003.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\ja-JP\whealogr.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\ja-JP\logagent.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\en-US\mofcomp.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\es-ES\prnky004.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\PRNNR0~1.INF\Amd64\NR9000.GPD | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\en-US\MdSched.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\de-DE\regevent.mfl | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\de-DE\comdlg32.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\hostname.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\thumbcache.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\fr-FR\WSDScDrv.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\es-ES\oobefldr.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\cofire.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\it-IT\rdpencom.mfl | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\ISCSI~2.INF\msiscsi.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DRIVER~1\FILERE~1\PRNSV0~3.INF\prnsv004.cat | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\taskhost.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\CNHW900.DLL.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\WINDOW~1\v1.0\de-DE\about_Session_Configurations.help.txt | C:\Windows\system32\cmd.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 74003100000000005558168c1100557365727300600008000400efbeee3a851a5558168c2a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 52003100000000005558168c122041707044617461003c0008000400efbe5558168c5558168c2a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000016000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\MRUListEx = ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 = 4a003100000000006c581103102054656d700000360008000400efbe5558168c6c5811032a000000ff010000000002000000000000000000000000000000540065006d007000000014000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\NodeSlot = "2" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4c003100000000005558c491100041646d696e00380008000400efbe5558168c5558c4912a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 4c0031000000000055584f8e10204c6f63616c00380008000400efbe5558168c55584f8e2a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 | C:\Windows\system32\NOTEPAD.EXE | N/A |
Opens file in notepad (likely ransom note)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\takeown.exe | N/A |
| Token: 33 | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
| Token: 33 | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Folders.txt
C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Desktop\Folders.bat" "
C:\Windows\system32\takeown.exe
takeown /f system32
C:\Windows\system32\icacls.exe
icacls system32 /grant:r Administrators:F
C:\Windows\system32\icacls.exe
icacls system32 /grant Users:f
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell wininit
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x484
Network
Files
memory/2504-0-0x0000000003600000-0x0000000003601000-memory.dmp
memory/2504-1-0x0000000003940000-0x0000000003950000-memory.dmp
memory/2504-2-0x0000000003600000-0x0000000003601000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-03-12 00:23
Reported
2024-03-12 00:32
Platform
win10v2004-20240226-en
Max time kernel
412s
Max time network
366s
Command Line
Signatures
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\drivers\HyperVideo.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\sbp2port.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\hidclass.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\UcmUcsiCx.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\UMDF\SMCCx.dll | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\IndirectKmd.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\isapnp.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\UMDF\en-US\idtsec.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\WindowsTrustedRT.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\storqosflt.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\raspppoe.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\EhStorTcgDrv.sys.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\fvevol.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\rdpvideominiport.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\fastfat.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\mslldp.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\mouclass.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\WdmCompanionFilter.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\sfloppy.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\hidspi.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\wcifs.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\PktMon.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\mrxdav.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\werkernel.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\isapnp.sys.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\pciidex.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\acpitime.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\winnat.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\kdnic.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\modem.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\Dumpata.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\watchdog.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\mrxsmb20.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\acpipagr.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\BthHfEnum.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\bthmodem.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\http.sys.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\mouhid.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\nvdimm.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\hdaudbus.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\http.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\UevAgentDriver.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\vwifibus.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\NdisImPlatform.sys.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\hdaudbus.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\nsiproxy.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\sdport.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\videoprt.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\agilevpn.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\wimmount.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ksthunk.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\USBXHCI.SYS.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\winnat.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\cng.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\tunnel.sys.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\fdc.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\mshwnclx.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\en-US\pdc.sys.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\wcifs.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\partmgr.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\ufx01000.sys | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\dxgkrnl.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\mouhid.sys | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\drivers\PEAuth.sys | C:\Windows\system32\cmd.exe | N/A |
Manipulates Digital Signatures
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\wintrust.dll | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\WindowsPowerShell\v1.0\pwrshsip.dll | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wintrust.dll | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\WindowsPowerShell\v1.0\pwrshsip.dll | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wintrust.dll | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\WindowsPowerShell\v1.0\pwrshsip.dll | C:\Windows\system32\cmd.exe | N/A |
Possible privilege escalation attempt
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\fr-FR\scrptadm.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\es-ES\jscript.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\fr-FR\LocationNotificationWindows.exe.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\es-ES\devenum.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\fr-FR\reagentc.exe.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\loghours.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\Configuration\BaseRegistration\ja-JP\MSFT_MetaConfigurationExtensionClasses.Schema.mfl | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\ja-JP\hpsamd.inf_loc | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\ja-jp\wsepno.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\fr-FR\dfshim.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\de-DE\SDFLauncher.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\es-ES\iesetup.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\IME\IMEKR\imkrudt.dll | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\migwiz\replacementmanifests\DHCPServerMigPluginWin8-Replacement.man | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\oobe\en-US\pnpibs.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\de-DE\cdpusersvc.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\de-DE\IdListen.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\storagewmi_passthru.mof | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\ja-jp\mycomput.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\en-US\megasas2i.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\spp\tokens\skus\SERVER~1\ServerRdsh-Retail-1-ul-store.xrm-ms | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\F12\DiagnosticsTap.dll | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\it-IT\ufxchipidea.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\de-DE\DisplaySwitch.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\fr-FR\Windows.Data.Activities.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\tzutil.exe.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\iscsiprf.mof | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\fr-FR\shrpubw.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\en-US\dc21x4vm.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\icu.dll | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\it-IT\ConsentUX.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\es-ES\rasctrs.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\de-DE\SnippingTool.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\de-DE\cmdial32.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\ja-jp\diskmgmt.msc | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\Dism\de-DE\ImagingProvider.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\en-US\diskperf.exe.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\en-US\twinui.pcshell.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\ntevt.dll | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\wbem\schannel.mof | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\de-DE\Licenses\Volume\PROFES~1\license.rtf | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\en-US\lpq.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\FileRepository\mdmsuprv.inf_amd64_696bb57f8e3bab65\mdmsuprv.inf | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\fr-FR\KdsCli.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\de-DE\wvmbus.inf_loc | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\setup\comsetup.dll | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\en-US\appraiser.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\ja-jp\vaultsvc.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\FileRepository\netnb.inf_amd64_0dc913ad00b14824\netnb.inf | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\FileRepository\qd3x64.inf_amd64_fd7b06296b7ac679\qd3x64.inf | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\de-DE\wlangpui.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\ja-JP\cdrom.inf_loc | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\de-DE\prnfldr.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\es-ES\fltMC.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\fr-FR\WsmSvc.dll.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.inf | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\uk-UA\mmcndmgr.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\MSECP-pipelineconfig.xml | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\it-IT\msgpiowin32.inf_loc | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\DriverStore\FileRepository\RDPIDD~1.INF\rdpidd.inf | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\fr-FR\pathping.exe.mui | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\spp\tokens\skus\PROFES~1\Professional-Volume-MAK-2-pl-rtm.xrm-ms | C:\Windows\system32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\es-ES\mydocs.dll.mui | C:\Windows\System32\cmd.exe | N/A |
| File opened for modification | C:\Windows\system32\de-DE\bisrv.dll.mui | C:\Windows\system32\cmd.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 = 50003100000000005a58d67b10004c6f63616c003c0009000400efbe5a58c9796c5824032e00000095e1010000000100000000000000000000000000000097ce66004c006f00630061006c00000014000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 50003100000000005a58c67e100041646d696e003c0009000400efbe5a58c9796c5824032e00000077e1010000000100000000000000000000000000000086422500410064006d0069006e00000014000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0 = 4e003100000000006c582403100054656d7000003a0009000400efbe5a58c9796c5824032e00000096e1010000000100000000000000000000000000000043bd8d00540065006d007000000014000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 56003100000000005a58c97912004170704461746100400009000400efbe5a58c9796c5824032e00000082e10100000001000000000000000000000000000000e7f722014100700070004400610074006100000016000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 78003100000000005a58c9791100557365727300640009000400efbe874f77486c5824032e000000c70500000000010000000000000000003a0000000000e5e32e0155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\NodeSlot = "2" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" | C:\Windows\system32\NOTEPAD.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" | C:\Windows\system32\NOTEPAD.EXE | N/A |
Opens file in notepad (likely ransom note)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\takeown.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Folders.txt
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Folders.bat" "
C:\Windows\system32\takeown.exe
takeown /f system32
C:\Windows\system32\icacls.exe
icacls system32 /grant:r Administrators:F
C:\Windows\system32\icacls.exe
icacls system32 /grant Users:f
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell wininit
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Folders.bat" "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell wininit
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\Folders.bat"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell wininit
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 194.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.173.189.20.in-addr.arpa | udp |