5b4b1117c661a07ced26879561d3bc8c54f97c16728836c13130d0cd5ad2b430

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ran/ransomware.exe
Size 184KB
Sample240518-br4qwsdd82
SHA256 5ae878c07e7420511755ef8e4a32412a4f0f619519b278c0014b56f344ec3427
MD5 803c34801f921a3618eca6791c269cf7
SHA1 e32e74e31846ee423dedd4bd2b00a3c3d93bfaee
SHA512 d0c73020899e782fdf2b50359ac15e9febf49005c4f2d9a123c68ec72b1f6fb2a31e589b3222be4b5b53ed30c4569addf856fb6808d8180e137b64d4c1fd9404
SSDEEP 3072:H/IBtQnE7OhssdWJ5jy392aCmCbBqM2x8XzUr380WFiIU6w4iAPcgxj7DRkF:Kqvhssdu5jyYaCmCQMc8XzUrM0Kiv6Nu
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Executes dropped EXE 2 IoCs

pid	Process
848	uchi.exe
2864	uchi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{82552039-770F-F767-1A82-2466A5BD8DE6} = "C:\\Users\\Admin\\AppData\\Roaming\\Agxaib\\uchi.exe"	Explorer.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

pid	Process
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
2864	uchi.exe
2864	uchi.exe
2864	uchi.exe
2864	uchi.exe
2188	RuntimeBroker.exe
2188	RuntimeBroker.exe
2188	RuntimeBroker.exe
2188	RuntimeBroker.exe
1144	RuntimeBroker.exe
1144	RuntimeBroker.exe
1144	RuntimeBroker.exe
1144	RuntimeBroker.exe
2864	uchi.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 904 set thread context of 5040	904	ransomware.exe	85
PID 848 set thread context of 2864	848	uchi.exe	89

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	backgroundTaskHost.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3096	vssadmin.exe

Modifies registry class 44 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f0faedd8-18c2-4813 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f0faedd8-18c2-4813 = "\\\\?\\Volume{8CCC3C3F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\db3e2a0dfacd9c43e7636fedbdb46e65f90a7e290d4e40fa97f28ce82e35f6dd"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\37ebfeee-dd16-40a0 = 5f8bbe3fc2a8da01	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\37ebfeee-dd16-40a0 = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\MuiCache	backgroundTaskHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6862a2a5-e9c1-4684 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000b557df3fc2a8da018e7b2440c2a8da018e7b2440c2a8da01e25606000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b2582b0b2000646233653261306466616364396334336537363336666564626462343665363566393061376532393064346534306661393766323863653832653335663664640000b20009000400efbeb2582b0bb2582b0b2e0000000000000000000000000000000000000000000000000092ebd500640062003300650032006100300064006600610063006400390063003400330065003700360033003600660065006400620064006200340036006500360035006600390030006100370065003200390030006400340065003400300066006100390037006600320038006300650038003200650033003500660036006400640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000be08e8381000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64623365326130646661636439633433653736333666656462646234366536356639306137653239306434653430666139376632386365383265333566366464000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f626a6979756965000000000000000096f7560095bce14897a93e3da1d528bc841318e2370def1195197e85bbd6b18796f7560095bce14897a93e3da1d528bc841318e2370def1195197e85bbd6b187d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0034003100320034003900300030003500350031002d0034003000360038003400370036003000360037002d0033003400390031003200310032003500330033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003f3ccc8c000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b605fa4-6d49-415e = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\37ebfeee-dd16-40a0 = "\\\\?\\Volume{8CCC3C3F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\6c2e94ca6e5e1623f26b6ed0943f5fd3da7d5aa44703003f51decf8a377497ab"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\37ebfeee-dd16-40a0 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000c7cfb63fc2a8da01c7cfb63fc2a8da01c7cfb63fc2a8da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b2582b0b2000366332653934636136653565313632336632366236656430393433663566643364613764356161343437303330303366353164656366386133373734393761620000b20009000400efbeb2582b0bb2582b0b2e00000000000000000000000000000000000000000000000000399dc700360063003200650039003400630061003600650035006500310036003200330066003200360062003600650064003000390034003300660035006600640033006400610037006400350061006100340034003700300033003000300033006600350031006400650063006600380061003300370037003400390037006100620000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000be08e8381000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36633265393463613665356531363233663236623665643039343366356664336461376435616134343730333030336635316465636638613337373439376162000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f626a6979756965000000000000000096f7560095bce14897a93e3da1d528bc811318e2370def1195197e85bbd6b18796f7560095bce14897a93e3da1d528bc811318e2370def1195197e85bbd6b187d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0034003100320034003900300030003500350031002d0034003000360038003400370036003000360037002d0033003400390031003200310032003500330033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003f3ccc8c000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f0faedd8-18c2-4813 = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b605fa4-6d49-415e	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b605fa4-6d49-415e = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6862a2a5-e9c1-4684 = "\\\\?\\Volume{8CCC3C3F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\db3e2a0dfacd9c43e7636fedbdb46e65f90a7e290d4e40fa97f28ce82e35f6dd"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	backgroundTaskHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f0faedd8-18c2-4813	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b605fa4-6d49-415e = a3843940c2a8da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6862a2a5-e9c1-4684	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f0faedd8-18c2-4813	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\ManagedByApp	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f0faedd8-18c2-4813 = a87eb53fc2a8da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\37ebfeee-dd16-40a0 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b605fa4-6d49-415e = "\\\\?\\Volume{8CCC3C3F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\6c2e94ca6e5e1623f26b6ed0943f5fd3da7d5aa44703003f51decf8a377497ab"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6862a2a5-e9c1-4684 = 638f4440c2a8da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\37ebfeee-dd16-40a0 = "8324"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6862a2a5-e9c1-4684	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6862a2a5-e9c1-4684 = "0"	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\37ebfeee-dd16-40a0	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f0faedd8-18c2-4813 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f0faedd8-18c2-4813 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000006e81a83fc2a8da016e81a83fc2a8da016e81a83fc2a8da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b2582b0b2000646233653261306466616364396334336537363336666564626462343665363566393061376532393064346534306661393766323863653832653335663664640000b20009000400efbeb2582b0bb2582b0b2e0000000000000000000000000000000000000000000000000092ebd500640062003300650032006100300064006600610063006400390063003400330065003700360033003600660065006400620064006200340036006500360035006600390030006100370065003200390030006400340065003400300066006100390037006600320038006300650038003200650033003500660036006400640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000be08e8381000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64623365326130646661636439633433653736333666656462646234366536356639306137653239306434653430666139376632386365383265333566366464000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f626a6979756965000000000000000096f7560095bce14897a93e3da1d528bc801318e2370def1195197e85bbd6b18796f7560095bce14897a93e3da1d528bc801318e2370def1195197e85bbd6b187d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0034003100320034003900300030003500350031002d0034003000360038003400370036003000360037002d0033003400390031003200310032003500330033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003f3ccc8c000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\37ebfeee-dd16-40a0	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b605fa4-6d49-415e = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000000be1e83fc2a8da01ff8f1840c2a8da01ff8f1840c2a8da01619206000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b2582b0b2000366332653934636136653565313632336632366236656430393433663566643364613764356161343437303330303366353164656366386133373734393761620000b20009000400efbeb2582b0bb2582b0b2e00000000000000000000000000000000000000000000000000399dc700360063003200650039003400630061003600650035006500310036003200330066003200360062003600650064003000390034003300660035006600640033006400610037006400350061006100340034003700300033003000300033006600350031006400650063006600380061003300370037003400390037006100620000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000be08e8381000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36633265393463613665356531363233663236623665643039343366356664336461376435616134343730333030336635316465636638613337373439376162000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f626a6979756965000000000000000096f7560095bce14897a93e3da1d528bc831318e2370def1195197e85bbd6b18796f7560095bce14897a93e3da1d528bc831318e2370def1195197e85bbd6b187d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0034003100320034003900300030003500350031002d0034003000360038003400370036003000360037002d0033003400390031003200310032003500330033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003f3ccc8c000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6862a2a5-e9c1-4684 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6862a2a5-e9c1-4684 = "8324"	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f0faedd8-18c2-4813	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\MostRecentlyUsed	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\37ebfeee-dd16-40a0	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b605fa4-6d49-415e	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b605fa4-6d49-415e = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
904	ransomware.exe
848	uchi.exe
848	uchi.exe
848	uchi.exe
848	uchi.exe
848	uchi.exe
848	uchi.exe
848	uchi.exe
848	uchi.exe
848	uchi.exe
848	uchi.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeBackupPrivilege	3488	vssvc.exe
Token: SeRestorePrivilege	3488	vssvc.exe
Token: SeAuditPrivilege	3488	vssvc.exe
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	4056	RuntimeBroker.exe
Token: SeShutdownPrivilege	4056	RuntimeBroker.exe
Token: SeShutdownPrivilege	4056	RuntimeBroker.exe
Token: SeShutdownPrivilege	4056	RuntimeBroker.exe
Token: SeShutdownPrivilege	4056	RuntimeBroker.exe
Token: SeShutdownPrivilege	4056	RuntimeBroker.exe
Token: SeShutdownPrivilege	4056	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 5040	904	ransomware.exe	85
PID 904 wrote to memory of 5040	904	ransomware.exe	85
PID 904 wrote to memory of 5040	904	ransomware.exe	85
PID 904 wrote to memory of 5040	904	ransomware.exe	85
PID 904 wrote to memory of 5040	904	ransomware.exe	85
PID 904 wrote to memory of 5040	904	ransomware.exe	85
PID 904 wrote to memory of 5040	904	ransomware.exe	85
PID 904 wrote to memory of 5040	904	ransomware.exe	85
PID 904 wrote to memory of 5040	904	ransomware.exe	85
PID 5040 wrote to memory of 848	5040	ransomware.exe	86
PID 5040 wrote to memory of 848	5040	ransomware.exe	86
PID 5040 wrote to memory of 4768	5040	ransomware.exe	87
PID 5040 wrote to memory of 4768	5040	ransomware.exe	87
PID 5040 wrote to memory of 4768	5040	ransomware.exe	87
PID 848 wrote to memory of 2864	848	uchi.exe	89
PID 848 wrote to memory of 2864	848	uchi.exe	89
PID 848 wrote to memory of 2864	848	uchi.exe	89
PID 848 wrote to memory of 2864	848	uchi.exe	89
PID 848 wrote to memory of 2864	848	uchi.exe	89
PID 848 wrote to memory of 2864	848	uchi.exe	89
PID 848 wrote to memory of 2864	848	uchi.exe	89
PID 848 wrote to memory of 2864	848	uchi.exe	89
PID 848 wrote to memory of 2864	848	uchi.exe	89
PID 2864 wrote to memory of 2556	2864	uchi.exe	44
PID 2864 wrote to memory of 2556	2864	uchi.exe	44
PID 2864 wrote to memory of 2556	2864	uchi.exe	44
PID 2864 wrote to memory of 2684	2864	uchi.exe	45
PID 2864 wrote to memory of 2684	2864	uchi.exe	45
PID 2864 wrote to memory of 2684	2864	uchi.exe	45
PID 2864 wrote to memory of 2824	2864	uchi.exe	48
PID 2864 wrote to memory of 2824	2864	uchi.exe	48
PID 2864 wrote to memory of 2824	2864	uchi.exe	48
PID 2864 wrote to memory of 3456	2864	uchi.exe	56
PID 2864 wrote to memory of 3456	2864	uchi.exe	56
PID 2864 wrote to memory of 3456	2864	uchi.exe	56
PID 2864 wrote to memory of 3680	2864	uchi.exe	57
PID 2864 wrote to memory of 3680	2864	uchi.exe	57
PID 2864 wrote to memory of 3680	2864	uchi.exe	57
PID 2864 wrote to memory of 3860	2864	uchi.exe	58
PID 2864 wrote to memory of 3860	2864	uchi.exe	58
PID 2864 wrote to memory of 3860	2864	uchi.exe	58
PID 2864 wrote to memory of 3952	2864	uchi.exe	59
PID 2864 wrote to memory of 3952	2864	uchi.exe	59
PID 2864 wrote to memory of 3952	2864	uchi.exe	59
PID 2864 wrote to memory of 4056	2864	uchi.exe	60
PID 3456 wrote to memory of 3096	3456	Explorer.EXE	90
PID 3456 wrote to memory of 3096	3456	Explorer.EXE	90
PID 2864 wrote to memory of 4056	2864	uchi.exe	60
PID 2864 wrote to memory of 4056	2864	uchi.exe	60
PID 2864 wrote to memory of 656	2864	uchi.exe	61
PID 2864 wrote to memory of 656	2864	uchi.exe	61
PID 2864 wrote to memory of 656	2864	uchi.exe	61
PID 2864 wrote to memory of 1680	2864	uchi.exe	62
PID 2864 wrote to memory of 1680	2864	uchi.exe	62
PID 2864 wrote to memory of 1680	2864	uchi.exe	62
PID 2864 wrote to memory of 436	2864	uchi.exe	64
PID 2864 wrote to memory of 436	2864	uchi.exe	64
PID 2864 wrote to memory of 436	2864	uchi.exe	64
PID 2864 wrote to memory of 2444	2864	uchi.exe	76
PID 2864 wrote to memory of 2444	2864	uchi.exe	76
PID 2864 wrote to memory of 2444	2864	uchi.exe	76
PID 2864 wrote to memory of 952	2864	uchi.exe	82
PID 2864 wrote to memory of 952	2864	uchi.exe	82
PID 2864 wrote to memory of 952	2864	uchi.exe	82

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2684

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2824

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\ran\ransomware.exe
  "C:\Users\Admin\AppData\Local\Temp\ran\ransomware.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Users\Admin\AppData\Local\Temp\ran\ransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\ran\ransomware.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Users\Admin\AppData\Roaming\Agxaib\uchi.exe
      "C:\Users\Admin\AppData\Roaming\Agxaib\uchi.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:848
    - - C:\Users\Admin\AppData\Roaming\Agxaib\uchi.exe
        
        "C:\Users\Admin\AppData\Roaming\Agxaib\uchi.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:2864
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_0234a5e0.bat"
      4⤵
      PID:4768
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2700
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3096
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3680

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3860

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3952

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:656

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1680

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:436

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2444

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:952

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3160

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3488

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2188

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

1715995421

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1715995421
Size 7KB
SHA256 8aaf05300d6526221fa8b8f567219485577539437595d1005ad5bcae3fd19e94
MD5 c5ec3ccfc1d46aee584791153aec2751
SHA1 457dc0d6fd2bd13e446ac283de95b7450e9efc01
SHA512 340deb9feaab31ff5f2f980abb754bbed0e839a56e14748000e4e735668a5fe1b49044acc13d169f731fb1471b70b1480b87e70d8167234e6356622aa12d0979
SSDEEP 96:LcTcg8Jk4b9f1jVxE12BvjKcC2xFS8jtAp0jD+qc2n2hNk4bMf1jVxE12BvjvmuZ:L247kEBbpFSiRDrc22h64OkEBb+u8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp_0234a5e0.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp_0234a5e0.bat
Size 208B
SHA256 6cb50bfc808642c5dcd183020b8bceeb00564500b1694ce668cd827c228a03c8
MD5 87a3e635f4126b93d1f12b8d52063979
SHA1 034ea2af4f93f87784688243f4a9788a9afe2457
SHA512 111b5efa4575ccd59c0416959099c27fa75281e28d09c53270c89915ed7e80e3e3a3ffbdd9a4417bfbc983801f0c3e9eca4983eebb5678cef21ca1b28fb5400c
MD5 SHA1 SHA512

Submit Download

uchi.exe

Path C:\Users\Admin\AppData\Roaming\Agxaib\uchi.exe
Size 67KB
SHA256 b4840a07c26845286696d9afdc55fbe5d76bb47e3a799f0ce0a71e6a8213bd26
MD5 d44b9fd0ec1a86451652ff4832705a59
SHA1 72dd80bf9a7406f602603ca567d8e7cfa09a0a0d
SHA512 326214c0ee870d0b0ae0a5fa24dfdd42622abdb0a6d44abb3ff1418a025d8644a27dd639a50bb2e7b82122e6629c86aa3aa541a51e4fe613eefd56190e278b93
SSDEEP 1536:6lM3UCxVlATYPpM4BmL6rgipnO70GWXiHgcFCL:l3UCxETcpM4Bm+gix+ASHtCL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-59-0x0000020FC61A0000-0x0000020FC61B7000-memory.dmp

Download

memory/436-66-0x0000020FC61A0000-0x0000020FC61B7000-memory.dmp

Download

memory/656-57-0x000002C4F5950000-0x000002C4F5967000-memory.dmp

Download

memory/848-32-0x0000000000B30000-0x0000000000BDC000-memory.dmp

Download

memory/848-43-0x0000000002C30000-0x0000000002C48000-memory.dmp

Download

memory/848-34-0x0000000000D50000-0x0000000000D7B000-memory.dmp

Download

memory/848-35-0x0000000000F20000-0x0000000000FBB000-memory.dmp

Download

memory/848-36-0x0000000000D80000-0x0000000000E1E000-memory.dmp

Download

memory/848-29-0x0000000000170000-0x0000000000200000-memory.dmp

Download

memory/848-37-0x0000000000FC0000-0x00000000010EA000-memory.dmp

Download

memory/848-38-0x00000000010F0000-0x00000000011FB000-memory.dmp

Download

memory/848-39-0x0000000001200000-0x000000000129D000-memory.dmp

Download

memory/848-40-0x00000000012A0000-0x00000000013A0000-memory.dmp

Download

memory/848-41-0x00000000015A0000-0x00000000015D0000-memory.dmp

Download

memory/848-42-0x0000000002BF0000-0x0000000002C21000-memory.dmp

Download

memory/848-14-0x0000000000410000-0x00000000004CE000-memory.dmp

Download

memory/848-44-0x0000000002D00000-0x0000000002D34000-memory.dmp

Download

memory/848-45-0x0000000002D40000-0x0000000002D67000-memory.dmp

Download

memory/848-46-0x00000000030B0000-0x00000000030BC000-memory.dmp

Download

memory/848-33-0x0000000000D20000-0x0000000000D42000-memory.dmp

Download

memory/848-47-0x00000000030C0000-0x0000000003143000-memory.dmp

Download

memory/848-31-0x0000000000980000-0x0000000000B21000-memory.dmp

Download

memory/848-16-0x00000000006B0000-0x0000000000979000-memory.dmp

Download

memory/952-61-0x000002130F1D0000-0x000002130F1E7000-memory.dmp

Download

memory/1680-65-0x000002753FF50000-0x000002753FF67000-memory.dmp

Download

memory/1680-58-0x000002753FF50000-0x000002753FF67000-memory.dmp

Download

memory/2444-60-0x000001529FBE0000-0x000001529FBF7000-memory.dmp

Download

memory/2444-67-0x000001529FBE0000-0x000001529FBF7000-memory.dmp

Download

memory/2556-48-0x000001E2183B0000-0x000001E2183C7000-memory.dmp

Download

memory/2556-17-0x000001E2183B0000-0x000001E2183C7000-memory.dmp

Download

memory/2684-53-0x0000017FA8400000-0x0000017FA8417000-memory.dmp

Download

memory/2684-18-0x0000017FA8400000-0x0000017FA8417000-memory.dmp

Download

memory/2824-19-0x0000020E86C80000-0x0000020E86C97000-memory.dmp

Download

memory/2824-50-0x0000020E86C80000-0x0000020E86C97000-memory.dmp

Download

memory/2864-201-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2864-121-0x0000000004B80000-0x0000000004B97000-memory.dmp

Download

memory/2864-15-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2864-30-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2864-11-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2864-123-0x0000000004B80000-0x0000000004B97000-memory.dmp

Download

memory/3096-63-0x000001BBE2BF0000-0x000001BBE2C07000-memory.dmp

Download

memory/3096-69-0x000001BBE2BF0000-0x000001BBE2C07000-memory.dmp

Download

memory/3160-70-0x000001927C0C0000-0x000001927C0D7000-memory.dmp

Download

memory/3160-62-0x000001927C0C0000-0x000001927C0D7000-memory.dmp

Download

memory/3456-25-0x0000000000D60000-0x0000000000D77000-memory.dmp

Download

memory/3456-28-0x0000000000D60000-0x0000000000D77000-memory.dmp

Download

memory/3456-27-0x0000000000D60000-0x0000000000D77000-memory.dmp

Download

memory/3456-26-0x0000000000D60000-0x0000000000D77000-memory.dmp

Download

memory/3456-23-0x0000000000D60000-0x0000000000D77000-memory.dmp

Download

memory/3456-20-0x0000000000D60000-0x0000000000D77000-memory.dmp

Download

memory/3680-21-0x00000290649C0000-0x00000290649D7000-memory.dmp

Download

memory/3680-49-0x00000290649C0000-0x00000290649D7000-memory.dmp

Download

memory/3860-22-0x0000022F521D0000-0x0000022F521E7000-memory.dmp

Download

memory/3860-51-0x0000022F521D0000-0x0000022F521E7000-memory.dmp

Download

memory/3952-24-0x00000235F6D40000-0x00000235F6D57000-memory.dmp

Download

memory/3952-54-0x00000235F6D40000-0x00000235F6D57000-memory.dmp

Download

memory/4056-55-0x00000262FDCD0000-0x00000262FDCE7000-memory.dmp

Download

memory/4056-52-0x00000262FDCD0000-0x00000262FDCE7000-memory.dmp

Download

memory/4996-68-0x0000019E37AA0000-0x0000019E37AB7000-memory.dmp

Download

memory/4996-64-0x0000019E37AA0000-0x0000019E37AB7000-memory.dmp

Download

memory/5040-0-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5040-9-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5040-3-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5040-2-0x0000000000400000-0x0000000000412000-memory.dmp

Download