Overview

overview

10

Static

static

3

FoxRansomware.zip

windows10-1703-x64

1

FoxRansomw...65.exe

windows10-1703-x64

10

FoxRansomw...a7.exe

windows10-1703-x64

10

FoxRansomw...20.exe

windows10-1703-x64

10

FoxRansomw...0b.exe

windows10-1703-x64

10

FoxRansomw...53.exe

windows10-1703-x64

10

FoxRansomw...b1.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25-07-2024 07:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FoxRansomware/91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe

  • Size

    1.2MB

  • MD5

    1fa1b6d4b3ed867c1d4baffc77417611

  • SHA1

    afb5e385f9cc8910d7a970b6c32b8d79295579da

  • SHA256

    91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

  • SHA512

    0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5

  • SSDEEP

    24576:K/SA+2lraRrjSJR5ezmT1dM9bBkNIDreFqO:2Xl9Ife

Score
10/10
matrixcredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\#FOX_README#.rtf

Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected] \par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 2C662E793C7EC500\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 2C662E793C7EC500\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 E53WgM5J\cf0\f1\fs32\lang1049\par \par }
Emails
URLs

https://bitmsg.me

https://bitmsg.me/users/sign_up

https://bitmsg.me/users/sign_in

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Drops desktop.ini file(s) 29 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
    "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe"
    1⤵
    • Matrix Ransomware
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4664
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWXMAwoc.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4872
    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWXMAwoc.exe
      "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWXMAwoc.exe" -n
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3728
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\yMEv75IK.txt"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2428
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\o3XrGI1c.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2276
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\o3XrGI1c.bmp" /f
        3⤵
        • Sets desktop wallpaper using registry
        • System Location Discovery: System Language Discovery
        PID:4200
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5476
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6264
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\rEGiL4sT.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3320
      • C:\Windows\SysWOW64\wscript.exe
        wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\rEGiL4sT.vbs"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\NUdiikVF.bat" /sc minute /mo 5 /RL HIGHEST /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5776
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\NUdiikVF.bat" /sc minute /mo 5 /RL HIGHEST /F
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:8752
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:8508
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Run /I /tn DSHCA
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4308
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\zPkFDlCY.bat" "C:\pagefile.sys""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Windows\SysWOW64\attrib.exe
        attrib -R -A -S "C:\pagefile.sys"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2420
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\pagefile.sys" /E /G Admin:F /C
        3⤵
        • System Location Discovery: System Language Discovery
        PID:7436
      • C:\Windows\SysWOW64\takeown.exe
        takeown /F "C:\pagefile.sys"
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5448
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c wQgeeuhU.exe -accepteula "pagefile.sys" -nobanner
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\wQgeeuhU.exe
          wQgeeuhU.exe -accepteula "pagefile.sys" -nobanner
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4624
          • C:\Users\Admin\AppData\Local\Temp\wQgeeuhU64.exe
            wQgeeuhU.exe -accepteula "pagefile.sys" -nobanner
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Executes dropped EXE
            • Enumerates connected drives
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: LoadsDriver
            • Suspicious use of AdjustPrivilegeToken
            PID:7412
  • C:\Windows\SYSTEM32\cmd.exe
    C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\NUdiikVF.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:7488
    • C:\Windows\system32\vssadmin.exe
      vssadmin Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:5612
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic SHADOWCOPY DELETE
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:6488
    • C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:5728
    • C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:9144
    • C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN DSHCA /F
      2⤵
        PID:8428
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:6380

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    PowerShell

    1
    T1059.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Windows Management Instrumentation

    1
    T1047

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Direct Volume Access

    1
    T1006

    File and Directory Permissions Modification

    1
    T1222

    Hide Artifacts

    1
    T1564

    Hidden Files and Directories

    1
    T1564.001

    Indicator Removal

    2
    T1070

    File Deletion

    2
    T1070.004

    Modify Registry

    2
    T1112

    Credential Access

    Credentials from Password Stores

    2
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Windows Credential Manager

    1
    T1555.004

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Browser Information Discovery

    1
    T1217

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Defacement

    1
    T1491

    Inhibit System Recovery

    3
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3699363923-1875576828-3287151903-1000\desktop.ini
      Filesize

      1KB

      MD5

      59f26d375411cca118da65ed276c64b0

      SHA1

      622b7ee2609677775ca78b6a6caf7e7c63654024

      SHA256

      38b63381a6d5813fd2539ddc4dc7ad2e94ba37a4bc1206114a6ed3c7802cfde4

      SHA512

      7f749d1391443c0f045e2e1a845b4df97b43cf96a8c844c45a0f58c89157980c1e973fe3a212ca3bde7d31d94b411b1cd11c54850c7f933edde4d828e61a5c88

      Download Submit

    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\#FOX_README#.rtf
      Filesize

      8KB

      MD5

      67a68f12dcfc18ec063b5135c14e821f

      SHA1

      40f13bdf740894294383fd9f49b9b7c8d80e3979

      SHA256

      2dc9cfb1ad5a950cafca08213a31632131aa75eddd8955407234d77b298c2e17

      SHA512

      cf1ca5bb11c4f18c5d609168cc991fabb2dc5e53cdfeeab9f64396263cf92dc4396b25849141da4d76c7722c427f2ad23b21c73c69f77eb4b5715ec3f8782c28

      Download Submit

    • C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\[[email protected] ].VIfBdqL4-Y0bMZFgz.FOX
      Filesize

      3.3MB

      MD5

      590debfafba9199b297998fe3ad0b84a

      SHA1

      b7be86b63cd5362f538424a72b1d32fc20fe0cfb

      SHA256

      945ad8cea7a84ddb2d528116ad7e8e1e0161af551812a39cd3562f368a4211fc

      SHA512

      6e629492760d906209b714cf0b75eb35cd99459d81011ef3fb5ae8f86add0d9a09d26e0ab51d8fcd4107c9b01e2ef89fadfe0fd6cde2bafa3f592fd7d06dc021

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
      Filesize

      3KB

      MD5

      3cdd95eae4b5adf27171440e8e670660

      SHA1

      b1a62b6c0bcd70b8da305b6bfe77fb9967d0b343

      SHA256

      829a4211e913e823e6337c281d6deca0c67e45bedc6bed7f381f40c893e741c0

      SHA512

      a80e2e2693ff49b7a213d3fa94d04eb5eba0a7fb1e463a1ca77a1f877c554b9d68d8f2d3d0dd1fa1d76ea2702544af1a409e96093771c4f4b3c39fd4b0c95435

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWXMAwoc.exe
      Filesize

      1.2MB

      MD5

      1fa1b6d4b3ed867c1d4baffc77417611

      SHA1

      afb5e385f9cc8910d7a970b6c32b8d79295579da

      SHA256

      91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

      SHA512

      0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_2C662E793C7EC500.txt
      Filesize

      85KB

      MD5

      88f4352db93f97520d8b59dd072bba28

      SHA1

      1e8a02308e70895d2640b339395b835832556a2a

      SHA256

      637d53ad014b1b8fc635b1adf7cb074e6156abef603d4edaad37fe4b859a6353

      SHA512

      79cbd9f59f7817e14b88e1dcc7298f3d4b3ff9ff03da70464e82b32189cd97f6c31246552618389b8bc3f33bf327122c89e5fcf5c5b2da55730a91a971e2483c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\wQgeeuhU.exe
      Filesize

      181KB

      MD5

      2f5b509929165fc13ceab9393c3b911d

      SHA1

      b016316132a6a277c5d8a4d7f3d6e2c769984052

      SHA256

      0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

      SHA512

      c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\yMEv75IK.txt
      Filesize

      15B

      MD5

      494436e38cfbff698c30e72dd63813e1

      SHA1

      1ed10def48a1622c8a75e9e197d6c600d617cf98

      SHA256

      705d6eb22b78adf67cc9ac523602bbe8c5cdd363c6d187a374a9387a1b98d355

      SHA512

      9309bb0a409cb106f998aac62d084dee577252ec8ceeeff928a0a2b262c444824085d7ae64fd96dcdb180401d02c3e527de43cd7c80969ea8d84518a21b27c05

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\zPkFDlCY.bat
      Filesize

      246B

      MD5

      75927d62e71e709a6a3f92f14a391f8c

      SHA1

      5b4e286d8428b913237a78211270e1b73128342e

      SHA256

      d8d36e90fa6ab56f8407aa635ace0cfe8217d6f6df2c474b34a996e8f9b857de

      SHA512

      aa4c9aa5eb535560c43939303063dbff69b07ea0c226410d1236fc5d89d4b0c377eec80649e3fcc585c7b0560b6d427a8f70c434bbb77dd4cacc6438f25c275d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bdycoely.ih0.ps1
      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\wQgeeuhU64.exe
      Filesize

      221KB

      MD5

      3026bc2448763d5a9862d864b97288ff

      SHA1

      7d93a18713ece2e7b93e453739ffd7ad0c646e9e

      SHA256

      7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

      SHA512

      d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

      Download Submit

    • C:\Users\Admin\AppData\Roaming\NUdiikVF.bat
      Filesize

      265B

      MD5

      299fd014fac402c06714bea695287687

      SHA1

      eb5de10e7a5b70a8b719d08e7afb9796dd2e0a82

      SHA256

      71f3d89130d7f0dfac0d742dc8a0a7718acb3d51611fae30c36393f9190707f5

      SHA512

      17b2f0bec282b2571edb5791bdcf7358abfa7f35b616b90ef1eff7ac2b609b0d77021cb7f13fa1d439f577960d06d9d390ad47de0f2fc965f3a63426d96db850

      Download Submit

    • C:\Users\Admin\AppData\Roaming\rEGiL4sT.vbs
      Filesize

      260B

      MD5

      990d8b49f804016897186b6f51be3150

      SHA1

      cd9ee85ceb88dda43be268051a7fb9011523ee24

      SHA256

      92995839b0485a6b061502a2347d13dd74fd3242f498aadcdc58ee48a65ba248

      SHA512

      e18295b98c98ac4ba93fc8b8fe7d58c8c4af9424df8bf2a689e88a87b2e61b2caa5da4bc5b2e4e1f806ded37a9c0bc4e5a4a0e5b209c299335d09e3c59620aa7

      Download Submit

    • memory/2428-15-0x0000000007CF0000-0x0000000007D0C000-memory.dmp

      Filesize

      112KB

      Download

    • memory/2428-11-0x0000000007AB0000-0x0000000007AD2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2428-16-0x0000000008550000-0x000000000859B000-memory.dmp

      Filesize

      300KB

      Download

    • memory/2428-32-0x0000000009DB0000-0x000000000A428000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/2428-9-0x0000000004A40000-0x0000000004A76000-memory.dmp

      Filesize

      216KB

      Download

    • memory/2428-33-0x0000000009340000-0x000000000935A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/2428-14-0x0000000007E10000-0x0000000008160000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/2428-13-0x0000000007BC0000-0x0000000007C26000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2428-12-0x0000000007B50000-0x0000000007BB6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2428-10-0x0000000007480000-0x0000000007AA8000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/2428-17-0x00000000084A0000-0x0000000008516000-memory.dmp

      Filesize

      472KB

      Download

    • memory/3728-4993-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3728-23044-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3728-23083-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3728-23111-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3728-23143-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4624-11903-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

      Download

    • memory/4624-23045-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

      Download

    • memory/4664-11896-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4664-4988-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4664-23043-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

      Download