Analysis
-
max time kernel
121s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 09:23
Behavioral task
behavioral1
Sample
d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
-
Size
544KB
-
MD5
d201bd19e60d500963aff0c235b07727
-
SHA1
341552a8650d2bdad5f3ec12e333e3153172ee66
-
SHA256
d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
-
SHA512
4afa7da1bf2a86dc9a3b94b674ecffea638304c42c43c955631bbe29c605be673b7182ed1fcb8997c55c6bbd2a48e5ec46177e8327e9e903781d1ffb2abd991c
-
SSDEEP
6144:h0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:Gzv66zaISTW9asWxxAh4IlXC4PUqBq/
Score
10/10
Malware Config
Extracted
Path
C:\HOW TO BACK FILES.txt
Ransom Note
Hello
Your data has been stolen and encrypted
We will delete the stolen data and help with the recovery of encrypted files after payment has been made
Do not try to change or restore files yourself, this will break them
We provide free decryption for any 3 files up to 3MB in size on our website
How to contact with us:
1) Download and install TOR browser by this link: https://www.torproject.org/download/
2) If TOR blocked in your country and you can't access to the link then use any VPN software
3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
4) Copy your private ID in the input field. Your Private key: B9AA0BBAF8CCB382CDE37D2C
5) You will see chat, payment information and we can make free test decryption here
Our blog of leaked companies:
wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
�
URLs
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1692 bcdedit.exe 1708 bcdedit.exe 2412 bcdedit.exe 2420 bcdedit.exe -
Renames multiple (7262) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2508 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 1904 red.exe 1724 red.exe -
Loads dropped DLL 7 IoCs
pid Process 1200 Process not Found 1200 Process not Found 2508 powershell.exe 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: red.exe File opened (read-only) \??\A: red.exe File opened (read-only) \??\J: red.exe File opened (read-only) \??\L: red.exe File opened (read-only) \??\T: red.exe File opened (read-only) \??\W: red.exe File opened (read-only) \??\M: red.exe File opened (read-only) \??\S: red.exe File opened (read-only) \??\U: red.exe File opened (read-only) \??\Y: red.exe File opened (read-only) \??\Z: red.exe File opened (read-only) \??\H: red.exe File opened (read-only) \??\I: red.exe File opened (read-only) \??\O: red.exe File opened (read-only) \??\P: red.exe File opened (read-only) \??\R: red.exe File opened (read-only) \??\E: red.exe File opened (read-only) \??\B: red.exe File opened (read-only) \??\G: red.exe File opened (read-only) \??\K: red.exe File opened (read-only) \??\N: red.exe File opened (read-only) \??\Q: red.exe File opened (read-only) \??\V: red.exe File opened (read-only) \??\X: red.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar red.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo red.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387591.JPG red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143749.GIF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck.css red.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\EmptyDatabase.zip red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01590_.WMF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0211949.WMF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10253_.GIF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21481_.GIF red.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif red.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186364.WMF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237336.WMF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00833_.WMF red.exe File created C:\Program Files (x86)\Adobe\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo red.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLNOTER.FAE red.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png red.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg red.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP red.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau red.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107090.WMF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR50F.GIF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\COUGH.WAV red.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENV98.POC red.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png red.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar red.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar red.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199465.WMF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\RE00006_.WMF red.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar red.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIconMask.bmp red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16ImagesMask.bmp red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css red.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml red.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api red.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02313_.WMF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198377.WMF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341455.JPG red.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK red.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\HOW TO BACK FILES.txt red.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar red.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105912.WMF red.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15302_.GIF red.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\HOW TO BACK FILES.txt red.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2508 powershell.exe 2508 powershell.exe 2508 powershell.exe 1904 red.exe 1724 red.exe 1724 red.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2596 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2596 7zFM.exe Token: 35 2596 7zFM.exe Token: SeSecurityPrivilege 2596 7zFM.exe Token: SeDebugPrivilege 2508 powershell.exe Token: SeTakeOwnershipPrivilege 1904 red.exe Token: SeDebugPrivilege 1904 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeDebugPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe Token: SeTakeOwnershipPrivilege 1724 red.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2596 7zFM.exe 2596 7zFM.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1192 wrote to memory of 2676 1192 cmd.exe 29 PID 1192 wrote to memory of 2676 1192 cmd.exe 29 PID 1192 wrote to memory of 2676 1192 cmd.exe 29 PID 2508 wrote to memory of 1904 2508 powershell.exe 35 PID 2508 wrote to memory of 1904 2508 powershell.exe 35 PID 2508 wrote to memory of 1904 2508 powershell.exe 35 PID 1904 wrote to memory of 1960 1904 red.exe 36 PID 1904 wrote to memory of 1960 1904 red.exe 36 PID 1904 wrote to memory of 1960 1904 red.exe 36 PID 1904 wrote to memory of 1940 1904 red.exe 38 PID 1904 wrote to memory of 1940 1904 red.exe 38 PID 1904 wrote to memory of 1940 1904 red.exe 38 PID 1960 wrote to memory of 1692 1960 cmd.exe 40 PID 1960 wrote to memory of 1692 1960 cmd.exe 40 PID 1960 wrote to memory of 1692 1960 cmd.exe 40 PID 1940 wrote to memory of 1708 1940 cmd.exe 41 PID 1940 wrote to memory of 1708 1940 cmd.exe 41 PID 1940 wrote to memory of 1708 1940 cmd.exe 41 PID 1724 wrote to memory of 2172 1724 red.exe 43 PID 1724 wrote to memory of 2172 1724 red.exe 43 PID 1724 wrote to memory of 2172 1724 red.exe 43 PID 1724 wrote to memory of 2212 1724 red.exe 44 PID 1724 wrote to memory of 2212 1724 red.exe 44 PID 1724 wrote to memory of 2212 1724 red.exe 44 PID 2172 wrote to memory of 2412 2172 cmd.exe 47 PID 2172 wrote to memory of 2412 2172 cmd.exe 47 PID 2172 wrote to memory of 2412 2172 cmd.exe 47 PID 2212 wrote to memory of 2420 2212 cmd.exe 48 PID 2212 wrote to memory of 2420 2212 cmd.exe 48 PID 2212 wrote to memory of 2420 2212 cmd.exe 48 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" red.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "1" red.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" red.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso1⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\System32\isoburn.exe"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso"2⤵PID:2676
-
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x4011⤵PID:2624
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2596
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -command start red.exe "1"1⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\Desktop\red.exe"C:\Users\Admin\Desktop\red.exe" 12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1904 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1692
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1708
-
-
-
-
C:\Users\Admin\Desktop\red.exe"C:\Users\Admin\Desktop\red.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1724 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2420
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\HOW TO BACK FILES.txt1⤵PID:668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD596e053ed2cf9cf1d9b97f3066b4b90b0
SHA16202eb4253ce83eb1762a7d5ba52e515e96c359a
SHA2560d6b9d126d68c217bfcdc7edfb99e4af9edb04b9c5c56247aeb79fd586fdd8e8
SHA51263bc8b644970e9fa6cec31de813d9df6de2364d7abb6f771c26241fcde5c20b290c7b3f5faf5db9620c45166876e95f6342c244e584e9485f21482ad5711a15d
-
Filesize
910B
MD5ef899f12bae05f99b4e48bf670e53680
SHA17b811dcc9ef59e8fa7d02fe33a5f5111f389a2c6
SHA256f6324dccf234fc5431f9f54d1a4d5443c2003f8e1b76fe4b107372f7d2522fec
SHA512d1f6c2892622e1d15b5f65503f32f6848a3c0dcb01f0a8a350c2a3a02d13bcb65fda99a3e2d5b888db9e1f1c6ac066ad4c6c363b54b6232befee884c2f133a74
-
Filesize
2KB
MD566bb9363e23c7ef2d16c89cd654b491e
SHA1c20e8d536804cf97584eec93d9a89c09541155bc
SHA25661f36c5ae038faa2b58a9a17b464d01414b4265e46634f353319c471d0a35789
SHA512b7a751e49218230d574ca9cc4cbbb1995d89798268124b1617889c7558c66902f81fdb77a299edcc6d96452cec81adb76768172710e00c9272d30821ab0089c5
-
Filesize
478KB
MD571efe7a21da183c407682261612afc0f
SHA10f1aea2cf0c9f2de55d2b920618a5948c5e5e119
SHA25645a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d
SHA5123cff597dbd7f0d5ab45b04e3c3731e38626b7b082a0ede7ab9a7826921848edb3c033f640da2cb13916febf84164f7415ca9ac50c3d927f04d9b61fcadb7801c