aa93358eef8a4338dde8961dd41873d48a44f9503ad1f68ddad441cfc618cbae

Analysis

max time kernel
19s
max time network
617s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

XONE.exe
Size

1.7MB
MD5

10984ef93cd073f6008790d3038323cf
SHA1

da8970f3dbf8a0794ea1555d01b769a0dbe5cf17
SHA256

6d96b14c956002266e8945c9c20dd65e340a2add5640c8b7e90f1ea5a1c3e8e7
SHA512

5513a5ceaa7020ddc99e0e68a7e6ab7d7b20d138263ac1f4dd5edeec9cbcc04ca2ebbfb35dbd009063bce896e86e64640203874fe40b630ff86d510be64b9060
SSDEEP

49152:zBgXmywawS0M/32GN1a5nHnKT6lzykP0eo:NHywRVGNAOKvo

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5176	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5272	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5344	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5416	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5528	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5492	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5468	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5444	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5392	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5368	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5320	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5296	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5248	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5224	432	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5200	432	schtasks.exe	89

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3084	powershell.exe
5996	powershell.exe
5980	powershell.exe
5972	powershell.exe
5908	powershell.exe
816	powershell.exe
1884	powershell.exe
4416	powershell.exe
3696	powershell.exe
5952	powershell.exe
5900	powershell.exe
5116	powershell.exe
4644	powershell.exe
1584	powershell.exe
3052	powershell.exe
6012	powershell.exe
5988	powershell.exe
5960	powershell.exe
5944	powershell.exe
3244	powershell.exe
516	powershell.exe
4428	powershell.exe
6024	powershell.exe
5924	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	XONE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1536	reviewsaves.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\conhost.exe	reviewsaves.exe
File created	C:\Program Files (x86)\Windows Portable Devices\088424020bedd6	reviewsaves.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Registration\CRMLog\sppsvc.exe	reviewsaves.exe
File created	C:\Windows\Registration\CRMLog\0a1fd5f707cd16	reviewsaves.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5224	schtasks.exe
5176	schtasks.exe
5272	schtasks.exe
5528	schtasks.exe
5492	schtasks.exe
5248	schtasks.exe
2080	schtasks.exe
5344	schtasks.exe
5468	schtasks.exe
5296	schtasks.exe
2576	schtasks.exe
4400	schtasks.exe
5444	schtasks.exe
5392	schtasks.exe
5368	schtasks.exe
5416	schtasks.exe
5320	schtasks.exe
5200	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	XONE.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4088	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe
1536	reviewsaves.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1536	reviewsaves.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	516	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4772	3496	XONE.exe	84
PID 3496 wrote to memory of 4772	3496	XONE.exe	84
PID 3496 wrote to memory of 4772	3496	XONE.exe	84
PID 4772 wrote to memory of 2284	4772	WScript.exe	93
PID 4772 wrote to memory of 2284	4772	WScript.exe	93
PID 4772 wrote to memory of 2284	4772	WScript.exe	93
PID 2284 wrote to memory of 1536	2284	cmd.exe	95
PID 2284 wrote to memory of 1536	2284	cmd.exe	95
PID 1536 wrote to memory of 4428	1536	reviewsaves.exe	96
PID 1536 wrote to memory of 4428	1536	reviewsaves.exe	96
PID 1536 wrote to memory of 3052	1536	reviewsaves.exe	97
PID 1536 wrote to memory of 3052	1536	reviewsaves.exe	97
PID 1536 wrote to memory of 1584	1536	reviewsaves.exe	98
PID 1536 wrote to memory of 1584	1536	reviewsaves.exe	98
PID 1536 wrote to memory of 516	1536	reviewsaves.exe	99
PID 1536 wrote to memory of 516	1536	reviewsaves.exe	99
PID 1536 wrote to memory of 3084	1536	reviewsaves.exe	100
PID 1536 wrote to memory of 3084	1536	reviewsaves.exe	100
PID 1536 wrote to memory of 3696	1536	reviewsaves.exe	101
PID 1536 wrote to memory of 3696	1536	reviewsaves.exe	101
PID 1536 wrote to memory of 4644	1536	reviewsaves.exe	102
PID 1536 wrote to memory of 4644	1536	reviewsaves.exe	102
PID 1536 wrote to memory of 5116	1536	reviewsaves.exe	103
PID 1536 wrote to memory of 5116	1536	reviewsaves.exe	103
PID 1536 wrote to memory of 4416	1536	reviewsaves.exe	104
PID 1536 wrote to memory of 4416	1536	reviewsaves.exe	104
PID 1536 wrote to memory of 1884	1536	reviewsaves.exe	105
PID 1536 wrote to memory of 1884	1536	reviewsaves.exe	105
PID 1536 wrote to memory of 3244	1536	reviewsaves.exe	107
PID 1536 wrote to memory of 3244	1536	reviewsaves.exe	107
PID 1536 wrote to memory of 816	1536	reviewsaves.exe	108
PID 1536 wrote to memory of 816	1536	reviewsaves.exe	108

C:\Users\Admin\AppData\Local\Temp\XONE.exe
"C:\Users\Admin\AppData\Local\Temp\XONE.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\hyperDhcpCommon\jjtmzKWYl2wrY.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\hyperDhcpCommon\2QmpbUJMvgY6pQ8iljifVStkwNjXALuoUsUVRw2XJC2SZTlHDEGIMh.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\hyperDhcpCommon\reviewsaves.exe
      "C:\hyperDhcpCommon/reviewsaves.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/hyperDhcpCommon/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:816
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fioj0k3h\fioj0k3h.cmdline"
        5⤵
        
        PID:1900
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7DAC.tmp" "c:\Windows\System32\CSC6DDF73B6EEA449199F654223162B87.TMP"
        6⤵
        
        PID:5128
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9Il4hLhTsT.bat"
        5⤵
        
        PID:5656
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5768
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5784
      - C:\Users\Public\Pictures\fontdrvhost.exe
        
        "C:\Users\Public\Pictures\fontdrvhost.exe"
        6⤵
        
        PID:5836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/hyperDhcpCommon/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\Registration\CRMLog\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\Registration\CRMLog\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewsavesr" /sc MINUTE /mo 14 /tr "'C:\hyperDhcpCommon\reviewsaves.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewsaves" /sc ONLOGON /tr "'C:\hyperDhcpCommon\reviewsaves.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewsavesr" /sc MINUTE /mo 12 /tr "'C:\hyperDhcpCommon\reviewsaves.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5528

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log
1⤵
- Opens file in notepad (likely ransom note)
PID:4088

C:\Program Files (x86)\Windows Portable Devices\conhost.exe
"C:\Program Files (x86)\Windows Portable Devices\conhost.exe"
1⤵
PID:5996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3244

C:\Recovery\WindowsRE\RuntimeBroker.exe
C:\Recovery\WindowsRE\RuntimeBroker.exe
1⤵
PID:816

C:\Recovery\WindowsRE\sysmon.exe
C:\Recovery\WindowsRE\sysmon.exe
1⤵
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Portable Devices\conhost.exe

Filesize
1.8MB

MD5
f83411372219ce91b28c971b6a8cc5a7

SHA1
7b8e6348d988b8fe02c98307fd633bcca63eee7a

SHA256
ec8ae506de0768107619af9dc6f65f18c32c1a7667cc107f61662774fd324f8c

SHA512
71a323dfd0ed65b326333785e7e3d6a0cb6e2d9c472763b3f2614e0aa0c024010b6fccb22b27014025b6ab032100b278af6a9661e029712932d7b354ac39c2c6

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.2MB

MD5
a31489bfa9e2aa161a7747d98313862f

SHA1
4035840984745c69d23752e641992949f9e2b78f

SHA256
1781146b8a0a02a4e619d34374e2a9e0ceef6ec9d5ce788d32dcca74f97c030e

SHA512
a6eca60f7fb86b5268d1329d1b9d9926f4c6c6515d5d908907e5125440eb647f0db08ca51af6fe0f8b6b9818f3f61f38e87c74ac8e9b89fc642264915fec59a5

Download Submit
C:\Recovery\WindowsRE\sysmon.exe

Filesize
923KB

MD5
d8490029bb76560e64cd931c2cd8297d

SHA1
469d2ac5f1f737db3f56b4c5717bdf163d3a60b6

SHA256
3fd5bfc612891a44fc29000bb86f66b4c9611b4f7c92dee441115f72977978bd

SHA512
64449f35ccedf8f1dfda3df9247241003b4c91af5357b9504be85c40b5e7ef52eb62ab9fb6ceb1de7d675f71a2e9b9ee97982e2dc9142170f283c3bf2d6f668f

Download Submit
C:\Recovery\WindowsRE\sysmon.exe

Filesize
1.1MB

MD5
82380034753bde57f5c766582fe8224f

SHA1
0b9747a3c6a059e8d0c3632d04d44f0b36f8123d

SHA256
f18bdeb62bb576da34687488b38a2d944b5349e804438dc0e748afa2a51d432b

SHA512
0357887748f3ba2f658e3ce23a9d7664543ba7d3b04935a4b520566f7d6bfade103c1c335d8c3270d82120077cf0ec4f6422db1f592cf29addcdea1cf05392ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a43e653ffb5ab07940f4bdd9cc8fade4

SHA1
af43d04e3427f111b22dc891c5c7ee8a10ac4123

SHA256
c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

SHA512
62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d14ccefeb263594e60b1765e131f7a3

SHA1
4a9ebdc0dff58645406c40b7b140e1b174756721

SHA256
57cd435c8b2bf10a2c77698301789c032e1b6b623ff1420c72e8bca0b10f1e5c

SHA512
2013a26123f72a4106524fd9d7389ac4654f97033d22707efc084fb2a3ad01c298eb64f01bb64861ab603615022dbe7cfc97475346edb16b3ba72e905127f101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cbc41bceec6e8cf6d23f68d952487858

SHA1
f52edbceff042ded7209e8be90ec5e09086d62eb

SHA256
b97a8a2a5dbc3c1b994affa4751e61e1ac6bddcf336a4c77ee96a3ce07c59f4d

SHA512
0f025ea2559e477c56500b9f4ecc251325793629cf1ae8d43ad783f1036b830c51757274b0aa8bb3183ac636cdfc1e0e8be1163a45695b8fb57df98c362534fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0d8abf9638c74e2459427f0738f597a0

SHA1
7f0d7f08e3bab3736388f3db7e5cb5beb726ef4d

SHA256
cad3af71b0b153675d87318a3fd44524d95a1b158549e5dd94d64795972d9382

SHA512
52e226e566b0b3b3800538c452deccde78ca22fbc47139c34e9f35fc49c2549b44ac4e5c5debc0692251244757af6f2ab447cad4c28fa6a2711661c472ae7b30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
705e397ba2c670b0b9fcebdd31e0feea

SHA1
8566fe7e0903b7495e659ba0588b72e3ce538c3b

SHA256
ae5d0de2ba6fe534bf67dcdbbfd71cf3f8c26f3d6ec852d73362d274a242732f

SHA512
a2914a193cbea13119567199082c52eebe67719c80bc056b3820c6a4b2e8cf8c7ecd3e38975f6ffc616b171ab722a6664f44f65496fdaf114615c1bbdf98306c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9301fb10a9394288e8324feb7da20e8d

SHA1
13cf5e60e24b5ee2c70badf42a0c0a8a1af4d3d0

SHA256
1687eeb30b85104251b199766ec1f00574c3ecd46a35578c2d7ce6db95ea28ec

SHA512
9fb789ff290c48028e0bd3ddc6fbc5bc1e34d37a967123f3f565ba639cc820901885ab4316e64dbf72515fa254f12ffc16273560aa681b7a28f564301181ab66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3fd1207fb34732237602c32614f8e7a5

SHA1
3c17778095da518c209e6854340c140cff556a50

SHA256
b89786113f914c4c6c44f0455750d167a760b375dc12c18a52054e71f0d24737

SHA512
54e7f41aa11b147d6734d1b2972c11dd6a4703be366dd9b26dbca14a9392205a4f19545c39db9807751468522c9e761fe7009bebf743e3ef852d7b79429ba482

Download Submit
C:\Users\Admin\AppData\Local\Temp\9Il4hLhTsT.bat

Filesize
216B

MD5
ff7cf0b0fe42690f5da4b1eb1a68ec86

SHA1
9780b0926af1a3d4ce6183ee92aa4d829277c93e

SHA256
5ed4c0ce9e4939752c208d17898cc3e68dc084fcc85e4f1669d8e37ae79678ff

SHA512
797ff64ee26e4451702a567ac4dfaa7421a3d0331e5f1d24aeefb27e32ef12f552461ea41ba8cb29b85d17efe9cf2d1ef93bd277f3307c521a4b81d793aea735

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7DAC.tmp

Filesize
1KB

MD5
ebc1e49fc44f3765475251febbe8eb5b

SHA1
9a3bc448596a99d0e3950696d84815f136394d96

SHA256
aab52079725ab79d907efa70980df1684a18a38c6ba532ddff8d6e9468dc42e1

SHA512
5ae5c3d2359c9a2a80bfa42fd70c6024ac389969f6bc0c1299086df00bda9655ca30de225047d29b7c4c09b7c953b6d4daa98f43c6966d52b27b6a553503d6b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tknu1hb3.g4z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\hyperDhcpCommon\2QmpbUJMvgY6pQ8iljifVStkwNjXALuoUsUVRw2XJC2SZTlHDEGIMh.bat

Filesize
72B

MD5
c4d2014abe7e69e6e4f8328ab07e7c25

SHA1
c294eba2cc8164148487fe44f53fdfb256261461

SHA256
864ff21fdabbfe5dd375dde727d287ae25cfe98349d7fb19426805f67d03408c

SHA512
72b0ae44b9ad1331094250d4c54502ed0a8304a96ee9ec2a5e71227699345626ec2ae4f90b836a1f5545b5808db622df0775edc79be6bdaea36c57d07456cb57

Download Submit
C:\hyperDhcpCommon\jjtmzKWYl2wrY.vbe

Filesize
248B

MD5
951d6dc94ee65368a94f5dbf4cea9aa0

SHA1
a5319561dffa98cfa9b41aed8b6518c70c1c35af

SHA256
03f7e5c874a35a3a5eb28244fa1ac129147728bc961745674f1896d04759269e

SHA512
1d4788b390db9e466a837395d51b28dce9470a8ae4e2cef880372533249d2daa4640446389f7e1ae0da4149b2882d17efb6fe0b873c6422932c3b53269a630d3

Download Submit
C:\hyperDhcpCommon\reviewsaves.exe

Filesize
448KB

MD5
725be5d7d677b8569af8a2f810b4fe5d

SHA1
15618a8f2c2efa22b7b5cd5c5d69aaf92500ec96

SHA256
907ef8f1e16b74cefeef782c13467496e1637c5c8596c8ad1d33c29cf41ddd13

SHA512
ef7a60bad0f6104269e446fceec7268f9b6ed0ea496a58680b3210360de929df3b1a56f9716412511b3dea151d7490af39f4bf79546b392adb2285075ec4f930

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fioj0k3h\fioj0k3h.0.cs

Filesize
364B

MD5
bdec68b4c8097f016dfd12e3d58a35c8

SHA1
03a66004681e6ef5f48e827e44f58814c4d3d3fc

SHA256
fe955d74f8a536d87df9c7e984ab6fed4f47157f39e9f85290ca5bf13f29c077

SHA512
d48b585ef475b3c52f36de2848f3f7c31a69e72a093ac1fae3049c65b48b6bc199d04182a83212b5f9dd17e621a2440e01074dd90e92d95e53a716a05a782d1e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fioj0k3h\fioj0k3h.cmdline

Filesize
235B

MD5
b8c234d33af7dc1e1cd66a6f12726d87

SHA1
358b17c53f4ff7b47aef9778177d793d89eb7fa9

SHA256
bfa4d081d95a336e3d5be3f00b13aab622641c3f6fc2e1a8e5013e9f2df87527

SHA512
4984b7cd8b83928f3ba2ff096b68d28cb150da7cb93fe769c8694d8c5f471f2837473c561fbd8bafbdefbce097aeb366a5e0101f083bd83f0f38a39b857e6550

Download Submit
\??\c:\Windows\System32\CSC6DDF73B6EEA449199F654223162B87.TMP

Filesize
1KB

MD5
dbd9f08fe1204b55edd7689f0ff86d2f

SHA1
93a0995d1e07ebd10d10d7dd36e7fa021b2b3637

SHA256
300e4915ed524682a79eda6cdd246098e05bb3b84380c692fe50ed7f41177e56

SHA512
aaa1769baabc4858021e071d89a6012a3e5c3f36fab0a93c4160e6265f8e7ad9203c1940fa8f1def91239c68b5e274cccfa14aba75c517bbe341c4c70588f0d8

Download Submit
memory/516-48-0x000001F4B8D70000-0x000001F4B8D92000-memory.dmp

Filesize
136KB

Download
memory/516-173-0x000001F4B8DA0000-0x000001F4B8FBC000-memory.dmp

Filesize
2.1MB

Download
memory/816-191-0x00000213379E0000-0x0000021337BFC000-memory.dmp

Filesize
2.1MB

Download
memory/1536-20-0x000000001B480000-0x000000001B498000-memory.dmp

Filesize
96KB

Download
memory/1536-13-0x0000000000660000-0x000000000083A000-memory.dmp

Filesize
1.9MB

Download
memory/1536-12-0x00007FFE7AB23000-0x00007FFE7AB25000-memory.dmp

Filesize
8KB

Download
memory/1536-15-0x000000001B430000-0x000000001B43E000-memory.dmp

Filesize
56KB

Download
memory/1536-17-0x000000001B460000-0x000000001B47C000-memory.dmp

Filesize
112KB

Download
memory/1536-18-0x000000001B820000-0x000000001B870000-memory.dmp

Filesize
320KB

Download
memory/1536-22-0x000000001B440000-0x000000001B44C000-memory.dmp

Filesize
48KB

Download
memory/1584-166-0x0000025719870000-0x0000025719A8C000-memory.dmp

Filesize
2.1MB

Download
memory/1884-194-0x0000021260E30000-0x000002126104C000-memory.dmp

Filesize
2.1MB

Download
memory/3052-189-0x0000017837960000-0x0000017837B7C000-memory.dmp

Filesize
2.1MB

Download
memory/3084-190-0x000001C2BC0B0000-0x000001C2BC2CC000-memory.dmp

Filesize
2.1MB

Download
memory/3244-177-0x0000025E65490000-0x0000025E656AC000-memory.dmp

Filesize
2.1MB

Download
memory/3696-184-0x0000022AD3410000-0x0000022AD362C000-memory.dmp

Filesize
2.1MB

Download
memory/4416-167-0x0000028F7FA30000-0x0000028F7FC4C000-memory.dmp

Filesize
2.1MB

Download
memory/4428-180-0x0000014CB0B60000-0x0000014CB0D7C000-memory.dmp

Filesize
2.1MB

Download
memory/4644-157-0x00000282591B0000-0x00000282593CC000-memory.dmp

Filesize
2.1MB

Download
memory/5116-176-0x0000020BD9D90000-0x0000020BD9FAC000-memory.dmp

Filesize
2.1MB

Download