Malware Analysis Report

2024-09-11 01:42

Sample ID 240320-l27kmseb32
Target 220629-p7hp9ahfel
SHA256 117fc30c25b1f28cd923b530ab9f91a0a818925b0b89b8bc9a7f820a9e630464
Tags
agenda persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

117fc30c25b1f28cd923b530ab9f91a0a818925b0b89b8bc9a7f820a9e630464

Threat Level: Known bad

The file 220629-p7hp9ahfel was found to be: Known bad.

Malicious Activity Summary

agenda persistence ransomware

Agenda Ransomware

Detects executables containing many references to VEEAM. Observed in ransomware

Detects executables referencing many IR and analysis tools

Agenda family

Detects command variations typically used by ransomware

Detects command variations typically used by ransomware

Renames multiple (158) files with added filename extension

Detects executables containing many references to VEEAM. Observed in ransomware

Detects executables referencing many IR and analysis tools

Deletes shadow copies

Executes dropped EXE

Checks computer location settings

Enumerates connected drives

Adds Run key to start application

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-03-20 10:02

Signatures

Agenda family

agenda

Detects command variations typically used by ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing many references to VEEAM. Observed in ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many IR and analysis tools

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-20 10:02

Reported

2024-03-20 10:05

Platform

win7-20240221-en

Max time kernel

119s

Max time network

129s

Command Line

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

Signatures

Deletes shadow copies

ransomware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*aster = "C:\\Users\\Public\\enc.exe" C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2500 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe C:\Windows\System32\cmd.exe
PID 2500 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe C:\Windows\System32\cmd.exe
PID 2500 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe C:\Windows\System32\cmd.exe
PID 2528 wrote to memory of 2552 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2528 wrote to memory of 2552 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2528 wrote to memory of 2552 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2500 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe C:\Windows\System32\svchost.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe

"C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

Network

N/A

Files

memory/812-3-0x0000000000820000-0x0000000000821000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-20 10:02

Reported

2024-03-20 10:05

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

154s

Command Line

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

Signatures

Agenda Ransomware

ransomware agenda

Deletes shadow copies

ransomware

Detects command variations typically used by ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing many references to VEEAM. Observed in ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many IR and analysis tools

Description Indicator Process Target
N/A N/A N/A N/A

Renames multiple (158) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System32\svchost.exe N/A
N/A N/A C:\Users\Public\enc.exe N/A
N/A N/A C:\Users\Public\enc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*aster = "C:\\Users\\Public\\enc.exe" C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\U: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\Z: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\B: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\K: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\T: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\V: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\N: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\Q: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\G: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\I: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\L: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\U: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\X: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\Y: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\E: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\J: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\O: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\H: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\P: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\W: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\S: C:\Users\Public\enc.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\OnHnnBvUej-RECOVER-README.txt C:\Users\Public\enc.exe N/A
File created C:\Program Files (x86)\OnHnnBvUej-RECOVER-README.txt C:\Users\Public\enc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\OnHnnBvUej-RECOVER-README.txt C:\Users\Public\enc.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" C:\Users\Public\enc.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" C:\Users\Public\enc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Public\enc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\enc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\enc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2036 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe C:\Windows\System32\cmd.exe
PID 2036 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe C:\Windows\System32\cmd.exe
PID 3936 wrote to memory of 1316 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3936 wrote to memory of 1316 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2036 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe C:\Windows\System32\svchost.exe
PID 4560 wrote to memory of 2708 N/A C:\Windows\System32\svchost.exe C:\Users\Public\enc.exe
PID 4560 wrote to memory of 2708 N/A C:\Windows\System32\svchost.exe C:\Users\Public\enc.exe
PID 4560 wrote to memory of 1368 N/A C:\Windows\System32\svchost.exe C:\Users\Public\enc.exe
PID 4560 wrote to memory of 1368 N/A C:\Windows\System32\svchost.exe C:\Users\Public\enc.exe
PID 1368 wrote to memory of 4936 N/A C:\Users\Public\enc.exe C:\Windows\System32\cmd.exe
PID 1368 wrote to memory of 4936 N/A C:\Users\Public\enc.exe C:\Windows\System32\cmd.exe
PID 2708 wrote to memory of 1168 N/A C:\Users\Public\enc.exe C:\Windows\System32\cmd.exe
PID 2708 wrote to memory of 1168 N/A C:\Users\Public\enc.exe C:\Windows\System32\cmd.exe
PID 4936 wrote to memory of 2476 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4936 wrote to memory of 2476 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1168 wrote to memory of 4616 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1168 wrote to memory of 4616 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe

"C:\Users\Admin\AppData\Local\Temp\220629-p7hp9ahfel.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Users\Public\enc.exe

"C:\Users\Public\enc.exe"

C:\Users\Public\enc.exe

"C:\Users\Public\enc.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 211.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

C:\Users\Public\pwndll.dll

MD5 e966c38c5b1a05d0bd86eb0edc1d3b84
SHA1 f10443e13b82c93f203c0428a357205aa55f2dee
SHA256 28aeb2d6576b2437ecab535c0a1bf41713ee9864611965bf1d498a87cbdd2fab
SHA512 6c80ec34f0d581e0924cb58f22e5bc70e36fcc6119db779744fad007bd943d95e5f646f06244e9a5aa40685649b7730e46dded68c0732e81559dded33a4dbe7b

C:\Users\Public\enc.exe

MD5 a7ab0969bf6641cd0c7228ae95f6d217
SHA1 002971b6d178698bf7930b5b89c201750d80a07e
SHA256 117fc30c25b1f28cd923b530ab9f91a0a818925b0b89b8bc9a7f820a9e630464
SHA512 7e1cce428e3b80b60635c354801af6e86354c9437ba7a661ca6a922c17057a16439a97d1ea11873eb359c05018df9eb6040b72fa97b30cf4d04cae56bf052b8a

\??\PIPE\wkssvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\$Recycle.Bin\OnHnnBvUej-RECOVER-README.txt

MD5 3a29ccf8fcbac5d1797999d3699375b1
SHA1 9993778053593d2704992f9e9cd7b79f4bd4a244
SHA256 534b085697b8406738b3281c1ca067cc90290ca8d44d2608eecdf4c0626c7e16
SHA512 99c1c76acd7e6ba366505000a21dc77400cb5531203f658d311d4b3926db90f331b870bb4d0bd6cd7731a41657b97d62feedb6fab74cee602c8fd91cc1d73600