Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 06:56

General

  • Target

    8641247358ba296097a1694227e0609e_JaffaCakes118.exe

  • Size

    69KB

  • MD5

    8641247358ba296097a1694227e0609e

  • SHA1

    51d5a9303b918ba319cdf0efe1a7bf5916d67601

  • SHA256

    9eebc325d3de108953d3b81952e3a33e994cf073ca78a5824d8d3771b50bca6a

  • SHA512

    278c0cf654553b8743e3a226977cd919ada4eda2ddad54f3e14747ff66e34a3e81d41e94756dc476d5b279c4c0de5b4eeff78f5144b8d86813c21f0afe28488c

  • SSDEEP

    1536:UZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:qBounVyFHpfMqqDL2/Lkvd

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8641247358ba296097a1694227e0609e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8641247358ba296097a1694227e0609e_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
        PID:1700
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup nomoreransom.bit dns1.soprodns.ru
        2⤵
          PID:2332
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup gandcrab.bit dns2.soprodns.ru
          2⤵
            PID:4220
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup nomoreransom.coin dns2.soprodns.ru
            2⤵
              PID:1956
            • C:\Windows\SysWOW64\nslookup.exe
              nslookup nomoreransom.bit dns2.soprodns.ru
              2⤵
                PID:1976
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup gandcrab.bit dns1.soprodns.ru
                2⤵
                  PID:2576
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup nomoreransom.coin dns1.soprodns.ru
                  2⤵
                    PID:3280
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup nomoreransom.bit dns1.soprodns.ru
                    2⤵
                      PID:1912
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup gandcrab.bit dns2.soprodns.ru
                      2⤵
                        PID:2716
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.coin dns2.soprodns.ru
                        2⤵
                          PID:3484
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup nomoreransom.bit dns2.soprodns.ru
                          2⤵
                            PID:1796
                          • C:\Windows\SysWOW64\nslookup.exe
                            nslookup gandcrab.bit dns1.soprodns.ru
                            2⤵
                              PID:4368
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup nomoreransom.coin dns1.soprodns.ru
                              2⤵
                                PID:1500
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup nomoreransom.bit dns1.soprodns.ru
                                2⤵
                                  PID:3360
                                • C:\Windows\SysWOW64\nslookup.exe
                                  nslookup gandcrab.bit dns2.soprodns.ru
                                  2⤵
                                    PID:1296
                                  • C:\Windows\SysWOW64\nslookup.exe
                                    nslookup nomoreransom.coin dns2.soprodns.ru
                                    2⤵
                                      PID:448
                                    • C:\Windows\SysWOW64\nslookup.exe
                                      nslookup nomoreransom.bit dns2.soprodns.ru
                                      2⤵
                                        PID:3676
                                      • C:\Windows\SysWOW64\nslookup.exe
                                        nslookup gandcrab.bit dns1.soprodns.ru
                                        2⤵
                                          PID:3792
                                        • C:\Windows\SysWOW64\nslookup.exe
                                          nslookup nomoreransom.coin dns1.soprodns.ru
                                          2⤵
                                            PID:1272
                                          • C:\Windows\SysWOW64\nslookup.exe
                                            nslookup nomoreransom.bit dns1.soprodns.ru
                                            2⤵
                                              PID:4400
                                            • C:\Windows\SysWOW64\nslookup.exe
                                              nslookup gandcrab.bit dns2.soprodns.ru
                                              2⤵
                                                PID:4412
                                              • C:\Windows\SysWOW64\nslookup.exe
                                                nslookup nomoreransom.coin dns2.soprodns.ru
                                                2⤵
                                                  PID:4644
                                                • C:\Windows\SysWOW64\nslookup.exe
                                                  nslookup nomoreransom.bit dns2.soprodns.ru
                                                  2⤵
                                                    PID:1900
                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                    nslookup gandcrab.bit dns1.soprodns.ru
                                                    2⤵
                                                      PID:5068
                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                      nslookup nomoreransom.coin dns1.soprodns.ru
                                                      2⤵
                                                        PID:4520
                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                        nslookup nomoreransom.bit dns1.soprodns.ru
                                                        2⤵
                                                          PID:4292
                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                          nslookup gandcrab.bit dns2.soprodns.ru
                                                          2⤵
                                                            PID:4900
                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                            nslookup nomoreransom.coin dns2.soprodns.ru
                                                            2⤵
                                                              PID:5052
                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                              nslookup nomoreransom.bit dns2.soprodns.ru
                                                              2⤵
                                                                PID:2836
                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                nslookup gandcrab.bit dns1.soprodns.ru
                                                                2⤵
                                                                  PID:4396
                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                  nslookup nomoreransom.coin dns1.soprodns.ru
                                                                  2⤵
                                                                    PID:4468
                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                    nslookup nomoreransom.bit dns1.soprodns.ru
                                                                    2⤵
                                                                      PID:3196
                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                      nslookup gandcrab.bit dns2.soprodns.ru
                                                                      2⤵
                                                                        PID:3384
                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                        nslookup nomoreransom.coin dns2.soprodns.ru
                                                                        2⤵
                                                                          PID:1208
                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                          nslookup nomoreransom.bit dns2.soprodns.ru
                                                                          2⤵
                                                                            PID:4252
                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                            nslookup gandcrab.bit dns1.soprodns.ru
                                                                            2⤵
                                                                              PID:3804
                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                              nslookup nomoreransom.coin dns1.soprodns.ru
                                                                              2⤵
                                                                                PID:1140
                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                2⤵
                                                                                  PID:732
                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                  nslookup gandcrab.bit dns2.soprodns.ru
                                                                                  2⤵
                                                                                    PID:2512
                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                    nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                    2⤵
                                                                                      PID:4128
                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                      nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                      2⤵
                                                                                        PID:4296
                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                        nslookup gandcrab.bit dns1.soprodns.ru
                                                                                        2⤵
                                                                                          PID:2320
                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                          nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                          2⤵
                                                                                            PID:4524
                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                            nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                            2⤵
                                                                                              PID:4356
                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                              nslookup gandcrab.bit dns2.soprodns.ru
                                                                                              2⤵
                                                                                                PID:4236
                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                2⤵
                                                                                                  PID:4616
                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                  nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                  2⤵
                                                                                                    PID:1344
                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                    nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                    2⤵
                                                                                                      PID:3560
                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                      nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                      2⤵
                                                                                                        PID:404
                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                        nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                        2⤵
                                                                                                          PID:3088
                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                          nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                          2⤵
                                                                                                            PID:2952
                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                            nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                            2⤵
                                                                                                              PID:3660
                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                              nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                              2⤵
                                                                                                                PID:3148
                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                2⤵
                                                                                                                  PID:3784
                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                  nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                  2⤵
                                                                                                                    PID:1780
                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                    nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                    2⤵
                                                                                                                      PID:4216
                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                      nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                                      2⤵
                                                                                                                        PID:1728
                                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                        nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                                        2⤵
                                                                                                                          PID:4708
                                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                          nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                                          2⤵
                                                                                                                            PID:1984
                                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                            nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                            2⤵
                                                                                                                              PID:2972
                                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                              nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                              2⤵
                                                                                                                                PID:1568
                                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                                2⤵
                                                                                                                                  PID:1892
                                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                  nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                                                  2⤵
                                                                                                                                    PID:1520
                                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                    nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                                                    2⤵
                                                                                                                                      PID:2796
                                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                      nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                                                      2⤵
                                                                                                                                        PID:5016
                                                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                        nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                                        2⤵
                                                                                                                                          PID:2804
                                                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                          nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                                          2⤵
                                                                                                                                            PID:1556
                                                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                            nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                                            2⤵
                                                                                                                                              PID:3748
                                                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                              nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                                                              2⤵
                                                                                                                                                PID:2820
                                                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                                                                2⤵
                                                                                                                                                  PID:3160
                                                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                  nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4460
                                                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                    nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4736
                                                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                      nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1436
                                                                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                        nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2928
                                                                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                          nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3092
                                                                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                            nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                                                                            2⤵
                                                                                                                                                              PID:836
                                                                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                              nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3604
                                                                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3172
                                                                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                  nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4648
                                                                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                    nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3008
                                                                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                      nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2556
                                                                                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                        nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3608
                                                                                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                          nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2892
                                                                                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                            nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4700
                                                                                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                              nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4880
                                                                                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3968
                                                                                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                  nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:3076
                                                                                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                    nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4168
                                                                                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                      nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3976
                                                                                                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                        nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3876
                                                                                                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                          nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1980
                                                                                                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                            nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:368
                                                                                                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                              nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3720
                                                                                                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:4316
                                                                                                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                  nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:3672
                                                                                                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                    nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4336
                                                                                                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                      nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                        nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                          nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4192
                                                                                                                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                            nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1684
                                                                                                                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                              nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5084
                                                                                                                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                                nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1652
                                                                                                                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                                  nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4652
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                                    nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4676
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                                      nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2616
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                                        nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2040
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                                          nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:3108
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                                            nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1212
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                                              nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:4028
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                                                                                                                nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2024

                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                              MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                              2
                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                              1
                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                              2
                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                              Downloads