Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 01:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a44d817c29c97f1418de7f456bd7609c37c774e90f83947b317260a87c48bedd.exe
Resource
win7-20240419-en
windows7-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
a44d817c29c97f1418de7f456bd7609c37c774e90f83947b317260a87c48bedd.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
31 signatures
150 seconds
General
-
Target
a44d817c29c97f1418de7f456bd7609c37c774e90f83947b317260a87c48bedd.exe
-
Size
23.2MB
-
MD5
aabdecc74290221f555bc6400ceef5c6
-
SHA1
6bf8559dfd409bee873f4e147f31ce313d23f2bc
-
SHA256
a44d817c29c97f1418de7f456bd7609c37c774e90f83947b317260a87c48bedd
-
SHA512
880d741faf049b9276c4ab10e6e3a0817ef28cb05f0e00fa3edf814ebf545d3d316dfac022fcff4b8fee9f95e18542e2cf7e89f02702e30409409f40a5fb6bbe
-
SSDEEP
393216:+/NvciCzO7XohRMU0K611YKvcg7dSVqMXDVZm/3hL1/VYs0tvj1Q3QJrSZ0aP54d:+1ciC6ohRMPK6gKzRctVZmf//VYRtvjR
Score
10/10
Malware Config
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023baf-24.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" encrypt.exe -
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023baf-24.dat INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM -
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023baf-24.dat INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023baf-24.dat INDICATOR_SUSPICIOUS_USNDeleteJournal -
Detects executables containing commands for clearing Windows Event Logs 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023baf-24.dat INDICATOR_SUSPICIOUS_ClearWinLogs -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4992 bcdedit.exe 2936 bcdedit.exe -
Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 4868 wbadmin.exe -
pid Process 1624 wbadmin.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\r.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservrs.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation a44d817c29c97f1418de7f456bd7609c37c774e90f83947b317260a87c48bedd.exe -
Executes dropped EXE 8 IoCs
pid Process 4728 encrypt.exe 3348 encrypt.exe 3000 encrypt.exe 1352 encrypt.exe 4444 encrypt.exe 2272 Everything.exe 3896 Everything.exe 2920 sdel64.exe -
Loads dropped DLL 5 IoCs
pid Process 4728 encrypt.exe 3348 encrypt.exe 3000 encrypt.exe 1352 encrypt.exe 4444 encrypt.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell\open\command encrypt.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell encrypt.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell\open\command encrypt.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell\open encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\encrypt = "\"C:\\Users\\Admin\\AppData\\Local\\encrypt\\encrypt.exe\" -e all -sd -crc " encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\encrypt.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\HACKLENDINIZ.txt\"" encrypt.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\G: encrypt.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\E: encrypt.exe File opened (read-only) \??\H: encrypt.exe File opened (read-only) \??\J: encrypt.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\U: encrypt.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\O: encrypt.exe File opened (read-only) \??\Y: encrypt.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\I: encrypt.exe File opened (read-only) \??\L: encrypt.exe File opened (read-only) \??\S: encrypt.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\A: encrypt.exe File opened (read-only) \??\Z: encrypt.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\B: encrypt.exe File opened (read-only) \??\M: encrypt.exe File opened (read-only) \??\Q: encrypt.exe File opened (read-only) \??\X: encrypt.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\K: encrypt.exe File opened (read-only) \??\V: encrypt.exe File opened (read-only) \??\W: encrypt.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\P: encrypt.exe File opened (read-only) \??\R: encrypt.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\N: encrypt.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\[email protected] encrypt.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\[email protected] encrypt.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\fr-FR\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\[email protected] encrypt.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\[email protected] encrypt.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] encrypt.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\[email protected] encrypt.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] encrypt.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] encrypt.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\[email protected] encrypt.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\[email protected] encrypt.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\[email protected] encrypt.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\[email protected] encrypt.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\[email protected] encrypt.exe File opened for modification C:\Program Files\Mozilla Firefox\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\[email protected] encrypt.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sk-SK\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\[email protected] encrypt.exe File opened for modification C:\Program Files\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sk-sk\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\[email protected] encrypt.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\[email protected] encrypt.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\[email protected] encrypt.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] encrypt.exe File opened for modification C:\Program Files\7-Zip\Lang\[email protected] encrypt.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\[email protected] encrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\[email protected] encrypt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.com encrypt.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell\open\command encrypt.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command encrypt.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell\open\command encrypt.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile encrypt.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell encrypt.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell encrypt.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell\open encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.com\ = "mimicfile" encrypt.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\HACKLENDINIZ.txt\"" encrypt.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1960 notepad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1352 encrypt.exe 1352 encrypt.exe 4444 encrypt.exe 4444 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 3348 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe 1352 encrypt.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4728 encrypt.exe Token: SeSecurityPrivilege 4728 encrypt.exe Token: SeTakeOwnershipPrivilege 4728 encrypt.exe Token: SeLoadDriverPrivilege 4728 encrypt.exe Token: SeSystemProfilePrivilege 4728 encrypt.exe Token: SeSystemtimePrivilege 4728 encrypt.exe Token: SeProfSingleProcessPrivilege 4728 encrypt.exe Token: SeIncBasePriorityPrivilege 4728 encrypt.exe Token: SeCreatePagefilePrivilege 4728 encrypt.exe Token: SeBackupPrivilege 4728 encrypt.exe Token: SeRestorePrivilege 4728 encrypt.exe Token: SeShutdownPrivilege 4728 encrypt.exe Token: SeDebugPrivilege 4728 encrypt.exe Token: SeSystemEnvironmentPrivilege 4728 encrypt.exe Token: SeChangeNotifyPrivilege 4728 encrypt.exe Token: SeRemoteShutdownPrivilege 4728 encrypt.exe Token: SeUndockPrivilege 4728 encrypt.exe Token: SeManageVolumePrivilege 4728 encrypt.exe Token: SeImpersonatePrivilege 4728 encrypt.exe Token: SeCreateGlobalPrivilege 4728 encrypt.exe Token: 33 4728 encrypt.exe Token: 34 4728 encrypt.exe Token: 35 4728 encrypt.exe Token: 36 4728 encrypt.exe Token: SeIncreaseQuotaPrivilege 3348 encrypt.exe Token: SeSecurityPrivilege 3348 encrypt.exe Token: SeTakeOwnershipPrivilege 3348 encrypt.exe Token: SeLoadDriverPrivilege 3348 encrypt.exe Token: SeSystemProfilePrivilege 3348 encrypt.exe Token: SeSystemtimePrivilege 3348 encrypt.exe Token: SeProfSingleProcessPrivilege 3348 encrypt.exe Token: SeIncBasePriorityPrivilege 3348 encrypt.exe Token: SeCreatePagefilePrivilege 3348 encrypt.exe Token: SeBackupPrivilege 3348 encrypt.exe Token: SeRestorePrivilege 3348 encrypt.exe Token: SeShutdownPrivilege 3348 encrypt.exe Token: SeDebugPrivilege 3348 encrypt.exe Token: SeSystemEnvironmentPrivilege 3348 encrypt.exe Token: SeChangeNotifyPrivilege 3348 encrypt.exe Token: SeRemoteShutdownPrivilege 3348 encrypt.exe Token: SeUndockPrivilege 3348 encrypt.exe Token: SeManageVolumePrivilege 3348 encrypt.exe Token: SeImpersonatePrivilege 3348 encrypt.exe Token: SeCreateGlobalPrivilege 3348 encrypt.exe Token: 33 3348 encrypt.exe Token: 34 3348 encrypt.exe Token: 35 3348 encrypt.exe Token: 36 3348 encrypt.exe Token: SeIncreaseQuotaPrivilege 3000 encrypt.exe Token: SeSecurityPrivilege 3000 encrypt.exe Token: SeTakeOwnershipPrivilege 3000 encrypt.exe Token: SeLoadDriverPrivilege 3000 encrypt.exe Token: SeSystemProfilePrivilege 3000 encrypt.exe Token: SeSystemtimePrivilege 3000 encrypt.exe Token: SeProfSingleProcessPrivilege 3000 encrypt.exe Token: SeIncBasePriorityPrivilege 3000 encrypt.exe Token: SeCreatePagefilePrivilege 3000 encrypt.exe Token: SeBackupPrivilege 3000 encrypt.exe Token: SeRestorePrivilege 3000 encrypt.exe Token: SeShutdownPrivilege 3000 encrypt.exe Token: SeDebugPrivilege 3000 encrypt.exe Token: SeSystemEnvironmentPrivilege 3000 encrypt.exe Token: SeChangeNotifyPrivilege 3000 encrypt.exe Token: SeRemoteShutdownPrivilege 3000 encrypt.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2272 Everything.exe 4712 StartMenuExperienceHost.exe 3896 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 4728 2840 a44d817c29c97f1418de7f456bd7609c37c774e90f83947b317260a87c48bedd.exe 86 PID 2840 wrote to memory of 4728 2840 a44d817c29c97f1418de7f456bd7609c37c774e90f83947b317260a87c48bedd.exe 86 PID 2840 wrote to memory of 4728 2840 a44d817c29c97f1418de7f456bd7609c37c774e90f83947b317260a87c48bedd.exe 86 PID 4728 wrote to memory of 3348 4728 encrypt.exe 88 PID 4728 wrote to memory of 3348 4728 encrypt.exe 88 PID 4728 wrote to memory of 3348 4728 encrypt.exe 88 PID 3348 wrote to memory of 3000 3348 encrypt.exe 89 PID 3348 wrote to memory of 3000 3348 encrypt.exe 89 PID 3348 wrote to memory of 3000 3348 encrypt.exe 89 PID 3348 wrote to memory of 1352 3348 encrypt.exe 90 PID 3348 wrote to memory of 1352 3348 encrypt.exe 90 PID 3348 wrote to memory of 1352 3348 encrypt.exe 90 PID 3348 wrote to memory of 4444 3348 encrypt.exe 91 PID 3348 wrote to memory of 4444 3348 encrypt.exe 91 PID 3348 wrote to memory of 4444 3348 encrypt.exe 91 PID 3348 wrote to memory of 2272 3348 encrypt.exe 92 PID 3348 wrote to memory of 2272 3348 encrypt.exe 92 PID 3348 wrote to memory of 2272 3348 encrypt.exe 92 PID 3348 wrote to memory of 4328 3348 encrypt.exe 111 PID 3348 wrote to memory of 4328 3348 encrypt.exe 111 PID 3348 wrote to memory of 3536 3348 encrypt.exe 112 PID 3348 wrote to memory of 3536 3348 encrypt.exe 112 PID 3348 wrote to memory of 548 3348 encrypt.exe 113 PID 3348 wrote to memory of 548 3348 encrypt.exe 113 PID 3348 wrote to memory of 320 3348 encrypt.exe 114 PID 3348 wrote to memory of 320 3348 encrypt.exe 114 PID 3348 wrote to memory of 4876 3348 encrypt.exe 115 PID 3348 wrote to memory of 4876 3348 encrypt.exe 115 PID 3348 wrote to memory of 3504 3348 encrypt.exe 116 PID 3348 wrote to memory of 3504 3348 encrypt.exe 116 PID 3348 wrote to memory of 3336 3348 encrypt.exe 117 PID 3348 wrote to memory of 3336 3348 encrypt.exe 117 PID 3348 wrote to memory of 3304 3348 encrypt.exe 118 PID 3348 wrote to memory of 3304 3348 encrypt.exe 118 PID 3348 wrote to memory of 4224 3348 encrypt.exe 119 PID 3348 wrote to memory of 4224 3348 encrypt.exe 119 PID 3348 wrote to memory of 4176 3348 encrypt.exe 120 PID 3348 wrote to memory of 4176 3348 encrypt.exe 120 PID 3348 wrote to memory of 4880 3348 encrypt.exe 121 PID 3348 wrote to memory of 4880 3348 encrypt.exe 121 PID 3348 wrote to memory of 540 3348 encrypt.exe 122 PID 3348 wrote to memory of 540 3348 encrypt.exe 122 PID 3348 wrote to memory of 4232 3348 encrypt.exe 123 PID 3348 wrote to memory of 4232 3348 encrypt.exe 123 PID 3348 wrote to memory of 1440 3348 encrypt.exe 124 PID 3348 wrote to memory of 1440 3348 encrypt.exe 124 PID 3348 wrote to memory of 4548 3348 encrypt.exe 125 PID 3348 wrote to memory of 4548 3348 encrypt.exe 125 PID 3348 wrote to memory of 4992 3348 encrypt.exe 155 PID 3348 wrote to memory of 4992 3348 encrypt.exe 155 PID 3348 wrote to memory of 2936 3348 encrypt.exe 156 PID 3348 wrote to memory of 2936 3348 encrypt.exe 156 PID 3348 wrote to memory of 4868 3348 encrypt.exe 157 PID 3348 wrote to memory of 4868 3348 encrypt.exe 157 PID 3348 wrote to memory of 1624 3348 encrypt.exe 159 PID 3348 wrote to memory of 1624 3348 encrypt.exe 159 PID 3348 wrote to memory of 3896 3348 encrypt.exe 168 PID 3348 wrote to memory of 3896 3348 encrypt.exe 168 PID 3348 wrote to memory of 3896 3348 encrypt.exe 168 PID 3348 wrote to memory of 1960 3348 encrypt.exe 169 PID 3348 wrote to memory of 1960 3348 encrypt.exe 169 PID 3348 wrote to memory of 1960 3348 encrypt.exe 169 PID 3348 wrote to memory of 2920 3348 encrypt.exe 170 PID 3348 wrote to memory of 2920 3348 encrypt.exe 170 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer encrypt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System encrypt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection encrypt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" encrypt.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a44d817c29c97f1418de7f456bd7609c37c774e90f83947b317260a87c48bedd.exe"C:\Users\Admin\AppData\Local\Temp\a44d817c29c97f1418de7f456bd7609c37c774e90f83947b317260a87c48bedd.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\tempenc\encrypt.exe"C:\tempenc\encrypt.exe" -e all -sd -crc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe" -e all -sd -crc3⤵
- Modifies security service
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3348 -
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe" -e watch -pid 3348 -! -e all -sd -crc4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1352
-
-
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4444
-
-
C:\Users\Admin\AppData\Local\encrypt\Everything.exe"C:\Users\Admin\AppData\Local\encrypt\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2272
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off4⤵PID:4328
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:3536
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:548
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:320
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:4876
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:3504
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:3336
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:3304
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:4224
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:4176
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:4880
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:540
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:4232
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵PID:1440
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵PID:4548
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:4992
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2936
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
PID:4868
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:1624
-
-
C:\Users\Admin\AppData\Local\encrypt\Everything.exe"C:\Users\Admin\AppData\Local\encrypt\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:3896
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe "C:\Users\Admin\AppData\Local\HACKLENDINIZ.txt"4⤵
- Opens file in notepad (likely ransom note)
PID:1960
-
-
C:\Users\Admin\AppData\Local\encrypt\sdel64.exe"C:\Users\Admin\AppData\Local\encrypt\sdel64.exe" -accepteula -p 3 -c C:\4⤵
- Executes dropped EXE
PID:2920
-
-
-
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2920
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4472
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3804
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4556
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4800
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3612
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4256
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5092
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4456
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4332
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4252
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4712
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4032
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4164
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4932
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:4056
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2632
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:1776
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5467644c119a12feefd222c3cd8241dbc
SHA16901ba556fc97da52a62c2125a4bc3ddb63715d2
SHA256deae6acf365cc6ae27cf01aad7cc342aacf2eb5200d98a079b4ec58ea43656c4
SHA5129974942dc99dca59d46718c2be4009fa3f8e108abd874434942dd2807dcc04398e9d2c26ca20f45c01dbc5a1bb9cd1c23edc07ed3408718a80613a7be0b78b9d
-
Filesize
3KB
MD58f1b6f0058556243a64c76ee047263e9
SHA18ebe5c0785d18bbb911845cd5e91f34d2dc77719
SHA25640b0f22ab91da78ae7e655408c22d7b60c526ee7d789d0ce8fccede625cc4f82
SHA512a42930076717cf50b1ce224f8362fb283d6efae0cda97de4330aa39a0b9f3e2605a63b7f0763f6bbe78b3a4139677d56ce10780fcbc0cd1a1883b0223f2f9045
-
Filesize
1KB
MD5f9b6ac9b419e1595984a40d5cb4c2aa8
SHA13431a55631e88a2b2982c1d39955f4aca6bc83fd
SHA256bc6d6fedb065aa657a1af7e40cc589da1bceabb09ca6d8854172e4cca664cd1a
SHA512e1493ae840bb960031445a2b3560350374c5d0b84eac1cd6634d6b391d95fe542e0463e1bb7e13f9a59c62ad0c2d9856334291821b97973f8550c1985c0e953c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize13KB
MD5dfc1b52b68aab4c909b32b20b0fb4f81
SHA1ba3aa286657f4ba4597b2cea24af2bc5eb53d34a
SHA25620ba24099918e2bffed50527017efa214c041265b5282c933adec73e814cb903
SHA51230fd2ecf7a29dbf8b8666907ffd22457b32de7f016bc04dc3aebd8746197148738a4285a07539de2b2fe3b32ecf4d7ae8c8b8f8fe7f501ffd0f7de280e61f314
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize13KB
MD5a059ababde70c132bc8c2f38f55062dc
SHA18a50b2926055f9408900e531368e7e9885fe016b
SHA2560694a994f2701772039cee98730569e33476a6b7bac7329e76a963d36231ba71
SHA512e556f91127326c000c64a4a295754e62c3c1b90668c1e6cd4c4fe7a89a0124b5a70c63a980b304987cb309a2f0ac5e3513ff6c970373d133f8c7ff6079fa42b1
-
Filesize
13.3MB
MD586b93c75fcb902c1f5f6d7f21b739ca8
SHA1d8f7c8df8f01d485655751e3183995e2a098c728
SHA25603169ff47914cd6cc540b3f1b216ad01a930d02cf67eb2c27c366948002f97da
SHA512f0f5022699c42e1d76213e52052e390a668fb169ea8529ab4c0b32bf672a156c3ded8b82aa9fc297db918b6a09bd2facffcd5882e1ab2c49e063126afee20867
-
Filesize
20KB
MD5ab61252259d515c6c11e6f4942927d68
SHA1df2fbd778e9b4ed2f14b8fa7043a839190d0df3d
SHA2566840113eb4aeb73affd54819b1b7681a4a75bfe16577ebd42bacf4a0353e4d80
SHA51277245c99388d77c78e412babb604973785f5dc2da3475952885006371064e827e0b8179a730c3000b694cc0dab15565029f29c087fa6eec051a2acdfc3047531
-
Filesize
1.6MB
MD59e6962555025b46150a684e645faa2ac
SHA1917f635048b8ad8d43fdfeaf1413c42611871a02
SHA256f500c664406f71341847a7529a56554dccb5c1f15ae4b2437d0efb4fc3dabbf8
SHA5122241c39090c9ab5e33026617ba67cd1b499638b7f38b1c77d80cfdd0b4eab7a2ce6235083b6881942dd2941574bf7d1a975b2458ddc2049f8b5d116d42a2ca5a
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
-
Filesize
47.4MB
MD56e2bd9da8e4aa5ea5a4ca236bffbff2a
SHA10019332594d0ef67300c3257a2d6c708ffed53a6
SHA25612921122de3b5525aab45bec5e7e0974e5da57914693bba12d5f6234f9e508a9
SHA5120405a1ee08b7f9cdd068df78d7630f187349a75d80cb54952a8f0e1c5693dba6166db0ca469ee3c2d4025bffabe605ebb926a081aa9f3a23a86fe91eb84f6c46
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
20KB
MD5f76c7e0522feac7f22bf8d1dbe42b50c
SHA1eeac2e325dae17242a993f4be748b4f8b0aabed6
SHA256d2bda99bfdadb5e0a9464d841f66c28891c67382e6c044b8e14aa46923601326
SHA51296726be1bf168ae9be28e01f0dfc0c3b611c4d842de90ca71d009aa259f7d273bc094d34f2f7c7e1a6aa06b656d3d192baaac2c39c591610e428bc999132be2b
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
2.1MB
MD5d02d7dc907d19d2e448368d433baebfe
SHA1d66616386e968ddb4661a9f9c1ef8c63403ba8f8
SHA256816fe96f0fff9475069d14cff51def4b823e1423c1aa464961ee6a61f7a62200
SHA5128cf776ec9332fcff9a6a080f39a6c734df4ccfb9bf405232f00d967d80ff4968c248077d90a7eff368ae3d7ac0edc8f504596212bf176364bb5ae37532c7969b
-
Filesize
3.0MB
MD5a48ee000e248741247c24dc70fa2f936
SHA14c814fe7c94e6fb4d1d89cdae7e6e83905c459d7
SHA256bb28adc32ff1b9dcfaac6b7017b4896d2807b48080f9e6720afde3f89d69676c
SHA5128bdd60732bf105b9ade5d4dbc5c722a866119e0a284692afc1bd5b530a4afc3954536a14946a87f72213c92020def2ac7b5c1cbcc51b6e0ad5671b7c58543f34
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
Filesize
448KB
MD5e2114b1627889b250c7fd0425ba1bd54
SHA197412dba3cbeb0125c71b7b2ab194ea2fdff51b2
SHA2565434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60
SHA51276ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1
-
Filesize
32B
MD55d52bf0ad56a46b3ec3f0f0cdae0c74e
SHA1128b12c7f5432fa1280eb4d74c4242fa49732f6c
SHA25609c09be4e16f8e9b1ac66e62766affc2a40801dd071a14f073089ac497fe5c48
SHA512abaf7f21d9956b59dea8d761e854a1f67cf7f201c94c5cfae372da6c0da518be45f6d3b31f75e3ac55670ec1a1b5bad49b3e8d3a82fe132413f3761ac1d69f33