8bb6aca4c4e10bffca8faa44252be00cd03add6b0fb054a4302fb2d2793e8451

General

Target

65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
Size

69KB
MD5

65b4a301f614dec90c2653ad60912623
SHA1

7a7aa59df26d304637cd3ded750e97984738c411
SHA256

8bb6aca4c4e10bffca8faa44252be00cd03add6b0fb054a4302fb2d2793e8451
SHA512

c40740da89d45cd8d99bdaa6170ff2018e4733feab5b9360c89180e270bc96eb5d8e093852d519ac67bed003928253a07aa6e3d83b9bf28c607cd535faf99fb4
SSDEEP

1536:eZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:oBounVyFHpfMqqDL2/Lkvd

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\krgxlybkzki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe"	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\L:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\O:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\X:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\Z:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\V:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\W:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\Y:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\A:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\I:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\J:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\K:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\U:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\T:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\G:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\M:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\N:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\P:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\Q:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\B:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\E:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\H:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\R:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
File opened (read-only)	\??\S:	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe

pid process

2896 65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
2896 65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe

pid	process
2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe

description	pid	process	target process
PID 2896 wrote to memory of 2472	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2472	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2472	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2472	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2620	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2620	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2620	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2620	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2652	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2652	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2652	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2652	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2392	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2392	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2392	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2392	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2500	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2500	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2500	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2500	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2364	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2364	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2364	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2364	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2428	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2428	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2428	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2428	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2408	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2408	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2408	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2408	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2884	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2884	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2884	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2884	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1396	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1396	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1396	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1396	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 884	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 884	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 884	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 884	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1928	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1928	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1928	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1928	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1476	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1476	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1476	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 1476	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2332	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2332	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2332	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2332	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2168	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2168	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2168	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2168	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2688	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2688	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2688	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe
PID 2896 wrote to memory of 2688	2896	65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65b4a301f614dec90c2653ad60912623_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2472

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2620

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2652

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2392

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2500

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2364

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2428

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2408

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2884

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1396

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:884

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1928

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1476

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2332

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2168

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2688

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2032

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1692

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2432

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1344

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2244

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:868

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2136

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2548

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:776

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2280

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:912

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2296

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2072

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1816

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:692

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2708

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1672

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3044

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:908

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1640

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2788

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2832

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1564

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2184

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1940

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2324

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2224

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2468

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2672

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2592

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2416

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2532

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2380

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2876

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2268

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:592

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1384

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2348

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:568

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2572

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1932

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1904

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2320

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2164

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2464

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2240

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:844

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2712

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1708

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:540

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2992

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:584

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1712

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1112

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1552

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:708

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2804

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2008

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2004

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1084

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2828

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1684

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2336

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1752

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2328

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2904

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2148

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2640

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2776

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2292

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2676

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2524

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2396

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2660

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1592

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1652

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:700

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:968

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1916

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1068

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1912

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:864

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1100

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1124

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2908

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:800

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1492

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1092

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1488

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1716

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:588

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1888

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1724

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads