Overview
overview
10Static
static
1001aabfaa41...50.exe
windows7-x64
301aabfaa41...50.exe
windows10-2004-x64
301c647838c...7f.exe
windows7-x64
1001c647838c...7f.exe
windows10-2004-x64
1002f5c32fa2...d6.exe
windows7-x64
602f5c32fa2...d6.exe
windows10-2004-x64
61a05cba687...a3.exe
windows7-x64
101a05cba687...a3.exe
windows10-2004-x64
101a8f35d0f2...b9.exe
windows7-x64
1a8f35d0f2...b9.exe
windows10-2004-x64
1af797776e...13.exe
windows7-x64
101af797776e...13.exe
windows10-2004-x64
101b2b369f31...2e.exe
windows7-x64
31b2b369f31...2e.exe
windows10-2004-x64
31b4a0b685c...db.exe
windows7-x64
31b4a0b685c...db.exe
windows10-2004-x64
31b4d73a9a7...89.exe
windows7-x64
101b4d73a9a7...89.exe
windows10-2004-x64
101ba8934b2e...4d.exe
windows7-x64
11ba8934b2e...4d.exe
windows10-2004-x64
31c2a51daa5...5b.exe
windows7-x64
101c2a51daa5...5b.exe
windows10-2004-x64
101c8bc3890f...45.exe
windows7-x64
61c8bc3890f...45.exe
windows10-2004-x64
71ce9fa5304...ef.exe
windows7-x64
1ce9fa5304...ef.exe
windows10-2004-x64
1d51d46e07...cd.exe
windows7-x64
101d51d46e07...cd.exe
windows10-2004-x64
101db9ec5678...e0.exe
windows7-x64
101db9ec5678...e0.exe
windows10-2004-x64
101dbbed25cf...88.exe
windows7-x64
1dbbed25cf...88.exe
windows10-2004-x64
Resubmissions
15-10-2024 03:47
241015-ecgjlashrh 1005-08-2024 04:49
240805-ffygys1eke 1005-08-2024 03:50
240805-eee4jszepd 10Analysis
-
max time kernel
92s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2024 03:50
Static task
static1
Behavioral task
behavioral1
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral14
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral24
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral28
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral30
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral32
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
-
Size
2.0MB
-
MD5
fa06e6aadef2365052156f12c92d7b09
-
SHA1
82de91795547028be327e75cee0fdf082352bfc9
-
SHA256
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813
-
SHA512
1629a2d234c70e7f1f5927b5a816c80b9fb2c995b4b334ff994848d3c7fe1c8797b231c4baaa63ca1e837081e9859c3ca138cd76a1db314c6b98685f5489566e
-
SSDEEP
24576:a5SndG2iSNjN2w9Os9cRfO/d8mT6c6aVqwPhUMelU+V:aMfJqsgXmgyJPE
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
resource yara_rule behavioral12/memory/4832-1-0x0000000000A50000-0x0000000000C54000-memory.dmp family_chaos behavioral12/files/0x000900000002338f-7.dat family_chaos -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2824 bcdedit.exe 1100 bcdedit.exe -
pid Process 3360 wbadmin.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation Windows Defender.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.url Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Windows Defender.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\傻逼，你被耍了！你的所有文件都被加密！.txt Windows Defender.exe -
Executes dropped EXE 1 IoCs
pid Process 2044 Windows Defender.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\OneDrive\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini Windows Defender.exe File opened for modification C:\Users\Public\Pictures\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Windows Defender.exe File opened for modification C:\Users\Public\Documents\desktop.ini Windows Defender.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Links\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Windows Defender.exe File opened for modification C:\Users\Public\Music\desktop.ini Windows Defender.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Music\desktop.ini Windows Defender.exe File opened for modification C:\Users\Public\Videos\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Windows Defender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Windows Defender.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ivnoovfkw.jpg" Windows Defender.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4476 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings Windows Defender.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2044 Windows Defender.exe -
Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe 2044 Windows Defender.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe Token: SeDebugPrivilege 2044 Windows Defender.exe Token: SeBackupPrivilege 1548 vssvc.exe Token: SeRestorePrivilege 1548 vssvc.exe Token: SeAuditPrivilege 1548 vssvc.exe Token: SeIncreaseQuotaPrivilege 3348 WMIC.exe Token: SeSecurityPrivilege 3348 WMIC.exe Token: SeTakeOwnershipPrivilege 3348 WMIC.exe Token: SeLoadDriverPrivilege 3348 WMIC.exe Token: SeSystemProfilePrivilege 3348 WMIC.exe Token: SeSystemtimePrivilege 3348 WMIC.exe Token: SeProfSingleProcessPrivilege 3348 WMIC.exe Token: SeIncBasePriorityPrivilege 3348 WMIC.exe Token: SeCreatePagefilePrivilege 3348 WMIC.exe Token: SeBackupPrivilege 3348 WMIC.exe Token: SeRestorePrivilege 3348 WMIC.exe Token: SeShutdownPrivilege 3348 WMIC.exe Token: SeDebugPrivilege 3348 WMIC.exe Token: SeSystemEnvironmentPrivilege 3348 WMIC.exe Token: SeRemoteShutdownPrivilege 3348 WMIC.exe Token: SeUndockPrivilege 3348 WMIC.exe Token: SeManageVolumePrivilege 3348 WMIC.exe Token: 33 3348 WMIC.exe Token: 34 3348 WMIC.exe Token: 35 3348 WMIC.exe Token: 36 3348 WMIC.exe Token: SeIncreaseQuotaPrivilege 3348 WMIC.exe Token: SeSecurityPrivilege 3348 WMIC.exe Token: SeTakeOwnershipPrivilege 3348 WMIC.exe Token: SeLoadDriverPrivilege 3348 WMIC.exe Token: SeSystemProfilePrivilege 3348 WMIC.exe Token: SeSystemtimePrivilege 3348 WMIC.exe Token: SeProfSingleProcessPrivilege 3348 WMIC.exe Token: SeIncBasePriorityPrivilege 3348 WMIC.exe Token: SeCreatePagefilePrivilege 3348 WMIC.exe Token: SeBackupPrivilege 3348 WMIC.exe Token: SeRestorePrivilege 3348 WMIC.exe Token: SeShutdownPrivilege 3348 WMIC.exe Token: SeDebugPrivilege 3348 WMIC.exe Token: SeSystemEnvironmentPrivilege 3348 WMIC.exe Token: SeRemoteShutdownPrivilege 3348 WMIC.exe Token: SeUndockPrivilege 3348 WMIC.exe Token: SeManageVolumePrivilege 3348 WMIC.exe Token: 33 3348 WMIC.exe Token: 34 3348 WMIC.exe Token: 35 3348 WMIC.exe Token: 36 3348 WMIC.exe Token: SeBackupPrivilege 5008 wbengine.exe Token: SeRestorePrivilege 5008 wbengine.exe Token: SeSecurityPrivilege 5008 wbengine.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4832 wrote to memory of 2044 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 92 PID 4832 wrote to memory of 2044 4832 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe 92 PID 2044 wrote to memory of 4668 2044 Windows Defender.exe 94 PID 2044 wrote to memory of 4668 2044 Windows Defender.exe 94 PID 4668 wrote to memory of 4476 4668 cmd.exe 96 PID 4668 wrote to memory of 4476 4668 cmd.exe 96 PID 4668 wrote to memory of 3348 4668 cmd.exe 99 PID 4668 wrote to memory of 3348 4668 cmd.exe 99 PID 2044 wrote to memory of 3444 2044 Windows Defender.exe 100 PID 2044 wrote to memory of 3444 2044 Windows Defender.exe 100 PID 3444 wrote to memory of 2824 3444 cmd.exe 102 PID 3444 wrote to memory of 2824 3444 cmd.exe 102 PID 3444 wrote to memory of 1100 3444 cmd.exe 103 PID 3444 wrote to memory of 1100 3444 cmd.exe 103 PID 2044 wrote to memory of 3460 2044 Windows Defender.exe 104 PID 2044 wrote to memory of 3460 2044 Windows Defender.exe 104 PID 3460 wrote to memory of 3360 3460 cmd.exe 106 PID 3460 wrote to memory of 3360 3460 cmd.exe 106 PID 2044 wrote to memory of 4200 2044 Windows Defender.exe 110 PID 2044 wrote to memory of 4200 2044 Windows Defender.exe 110 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe"C:\Users\Admin\AppData\Local\Temp\1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Roaming\Windows Defender.exe"C:\Users\Admin\AppData\Roaming\Windows Defender.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:4476
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2824
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1100
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:3360
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\傻逼，你被耍了！你的所有文件都被加密！.txt3⤵PID:4200
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5008
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1424
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:3404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5fa06e6aadef2365052156f12c92d7b09
SHA182de91795547028be327e75cee0fdf082352bfc9
SHA2561af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813
SHA5121629a2d234c70e7f1f5927b5a816c80b9fb2c995b4b334ff994848d3c7fe1c8797b231c4baaa63ca1e837081e9859c3ca138cd76a1db314c6b98685f5489566e
-
Filesize
470B
MD5c83c2b8e368e928c7ab979f7bb44dac4
SHA14662ae6c1d2195a178bdeb23141df221181b9fdf
SHA256d42f2a19a64f644085bb2411b58397f5ce8ff1d85857e9985163138964ea0251
SHA512599f1cb6d607069544a492ed198fea62e51c5cefeb02ec33843cb63255705a2cf412467814493edf7a920b38ad71c65d8e6bd803b28b2f160e3b0727fc2cba2e