Malware Analysis Report

2024-09-11 02:35

Sample ID 240705-mwfemszara
Target d5f2ff838910ac0122366f261be209021747b53e9f4e7e75aec59710696e34b2
SHA256 d5f2ff838910ac0122366f261be209021747b53e9f4e7e75aec59710696e34b2
Tags
medusalocker defense_evasion evasion execution impact persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d5f2ff838910ac0122366f261be209021747b53e9f4e7e75aec59710696e34b2

Threat Level: Known bad

The file d5f2ff838910ac0122366f261be209021747b53e9f4e7e75aec59710696e34b2 was found to be: Known bad.

Malicious Activity Summary

medusalocker defense_evasion evasion execution impact persistence ransomware spyware stealer

Medusalocker family

MedusaLocker payload

Renames multiple (622) files with added filename extension

Renames multiple (919) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes shadow copies

Drops file in Drivers directory

Deletes System State backups

Deletes itself

Checks computer location settings

Reads user/profile data of web browsers

Enumerates connected drives

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Uses Volume Shadow Copy service COM API

System policy modification

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Windows Management Instrumentation
T1047
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Direct Volume Access
T1006
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-05 10:48

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-05 10:48

Reported

2024-07-05 10:51

Platform

win7-20240704-en

Max time kernel

74s

Max time network

56s

Command Line

"C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe"

Signatures

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (919) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\protocol C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\drivers\etc\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe\" e" C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\h: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\D: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\D: C:\Windows\system32\vssadmin.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\LogFiles\Scm\20ffa017-5481-4f6b-92ea-adb623fbebf4.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\config\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\SECURITY C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\Microsoft\Protect\S-1-5-18\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\cd2dc0a3-b028-415f-a3bd-e9d070a6982d C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\SOFTWARE C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\DEFAULT C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\SAM C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1740fc16-a4e6-4435-a5fa-5dd25b12902d.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\config\RegBack\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\SYSTEM C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\30658922-e1e4-458d-ae56-9f5b69ba66b5.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1740fc16-a4e6-4435-a5fa-5dd25b12902d C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\SAM C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\LogFiles\Scm\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\cd2dc0a3-b028-415f-a3bd-e9d070a6982d.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1740fc16-a4e6-4435-a5fa-5dd25b12902d.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Singapore C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Cocos C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Madrid C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guam C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Palau.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Antigua C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Miquelon.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Whitehorse C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Andorra C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\GMT.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Brunei C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Samara C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hovd C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Winnipeg C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Taipei.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\classlist.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th1 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\Boot\PCAT\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_2 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb0 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_1 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\Panther\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Boot\PCAT\bootmgr C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb1 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_1 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_0 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\enwindow C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Panther\setupinfo C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb1 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Panther\setupinfo.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\dewindow C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th2 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb2 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_3 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Boot\DVD\EFI\BCD C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_0 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Boot\DVD\PCAT\BCD C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb2 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th1 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\Boot\DVD\EFI\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th0 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\ehome\CreateDisc\Components\tables\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th0 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_2 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Panther\setupinfo.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th2 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\Boot\DVD\PCAT\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb0 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1952 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\vssadmin.exe
PID 1952 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\bcdedit.exe
PID 1952 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\bcdedit.exe
PID 1952 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\bcdedit.exe
PID 1952 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\bcdedit.exe
PID 1952 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\bcdedit.exe
PID 1952 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\bcdedit.exe
PID 1952 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\wbadmin.exe
PID 1952 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\wbadmin.exe
PID 1952 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\wbadmin.exe
PID 1952 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\wbadmin.exe
PID 1952 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\wbadmin.exe
PID 1952 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\wbadmin.exe
PID 1952 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\System32\Wbem\wmic.exe
PID 1952 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\System32\Wbem\wmic.exe
PID 1952 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\System32\Wbem\wmic.exe
PID 1952 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\cmd.exe
PID 1952 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\cmd.exe
PID 1952 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe

"C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe"

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled No

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\528502~1.EXE >> NUL

Network

N/A

Files

C:\Users\Admin\!!!HOW_TO_DECRYPT!!!.mht

MD5 206a231b4f6aa7c56da16a500b53e5ff
SHA1 4e64d9d2ef6691a6490bba40e24308d03cd0d7bc
SHA256 99c7c86c73a44882c3225bf6333b99c8a3620efffa76a659c339ea899bf96521
SHA512 13d02410d9d16cfbfe3aabe388b98cffb4a6f25455c02e1d89be4568462dc963ad3a6664def0394081bfb10a5f01cacd57e20ccdac5111f5eeb21c8d4ed72b9b

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-05 10:48

Reported

2024-07-05 10:51

Platform

win10v2004-20240704-en

Max time kernel

94s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe"

Signatures

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Renames multiple (622) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\wbadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\wbadmin.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\protocol C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\drivers\etc\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe\" e" C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-2494989678-839960665-2515455429-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\D: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\F: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\E: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\D: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\G: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\H: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\h: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\h: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened (read-only) \??\E: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\F: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\config\COMPONENTS.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\SOFTWARE C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\e43c9bdb-f82d-4cc6-8ebc-ad646f816421 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\0b6cf3eb-4bc8-44ef-8821-23828e8ac96f.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\ELAM C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\ResPriHMImageList C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\BCD-Template.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\e43c9bdb-f82d-4cc6-8ebc-ad646f816421.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\ResPriHMImageListLowCost C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\DEFAULT C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\DRIVERS C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\ELAM.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\BCD-Template C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\ResPriImageListLowCost C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\17e03686-8677-4001-ac4a-fd9cdc5767ec.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\e43c9bdb-f82d-4cc6-8ebc-ad646f816421.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\precomplete.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f33\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Mozilla Firefox\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\removed-files.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\precomplete.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\removed-files C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\precomplete C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\postSigningData C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Google\Chrome\Application\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_w1\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f14\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\removed-files.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\postSigningData.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f2\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\SourceHash{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{C7B73281-AB0A-4DAD-A09F-5C30D40679AC} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{E634F316-BEB6-4FB3-A612-F7102F576165}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\Installer\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{2BB73336-4F69-4141-9797-E9BD6FE3980A} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{77924AE4-039E-4CA4-87B4-2F64180381F0} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{B175520C-86A2-35A7-8619-86DC379688B9}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\SYSTEM32\wbadmin.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{79043ED0-7ED1-4227-A5E5-04C5594D21F7}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{9F51D16B-42E8-4A4A-8228-75045541A2AE}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Boot\DVD\PCAT\BCD C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\Boot\DVD\EFI\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\SYSTEM32\wbadmin.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{4A03706F-666A-4037-7777-5F2748764D10}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{77924AE4-039E-4CA4-87B4-2F64180381F0}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{37B8F9C7-03FB-3253-8781-2517C99D7C00} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{37B8F9C7-03FB-3253-8781-2517C99D7C00}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Panther\setupinfo.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\Panther\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Boot\PCAT\bootnxt C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_3391016d-f0b6-457a-866d-88b771c7b6ac.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{2BB73336-4F69-4141-9797-E9BD6FE3980A}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BF08E976-B92E-4336-B56F-2171179476C4}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4 C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180381}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\Boot\DVD\PCAT\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{9F51D16B-42E8-4A4A-8228-75045541A2AE}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File created C:\Windows\Boot\PCAT\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{77924AE4-039E-4CA4-87B4-2F64180381F0}.inprocess C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CB0836EC-B072-368D-82B2-D3470BF95707}.1btc C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1652 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1652 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1652 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1652 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1652 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 1652 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 1652 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 1652 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 1652 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 1652 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\System32\Wbem\wmic.exe
PID 1652 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\System32\Wbem\wmic.exe
PID 1652 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\cmd.exe
PID 1652 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe C:\Windows\system32\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe

"C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe"

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled No

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SYSTEM32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\528502~1.EXE >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

\Device\HarddiskVolume1\Boot\bg-BG\!!!HOW_TO_DECRYPT!!!.mht

MD5 0cb353b3ecb14f62c98aeef498069ce2
SHA1 65e233b506299a5a094e94eed2ef227bb15ecaf2
SHA256 cb76556e8580ecfb176d118e3c0dbde648973e2c437ddf7d1b3eae9436b5ca98
SHA512 789679e0d0fac7eb71d4962ca4440819fdf5b64b26f0b3d9ba307acec97a1f3a61d7db1ac5bb88f9e76d34b532864f4f7622323819831e382526e3c3c6f341ae