Analysis
- max time kernel
131s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
08/08/2024, 14:56
Behavioral task
behavioral1
Sample
FridayBoycrazyV2.exe
Resource
win7-20240729-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
FridayBoycrazyV2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
30 signatures
150 seconds
General
- Target FridayBoycrazyV2.exe
- Size 280KB
- Sample240808-sbaljsvepm
- SHA256 0ef2768bdfaa0b953a5c498f18bbf2df5dce249eaf2044474c476c4367c535b5
- MD5 41e34a8240026b4e9cd8d81a73ee8b2c
- SHA1 3876b12e152dd552a7059538242b6f87a23e60f5
- SHA512 a7d610ee4f116121757f47193bf092b639cf2d439dcfa364ea800c28c0f21996fd8baa31c9abe68d2c18cc8f334c57f9d71c4e444a04a27d3b9cab90eecbba73
- SSDEEP 6144:1r93iyJ7/+WZT1kRnSeXSX9MNzxiMwP2OswK:iyJ7/+Wd1kRnFX4mNzxyeOswK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Users\Admin\Documents\Warning.txt
Ransom Note
- Your files has been encrypted By FridayBoycrazy and you won't be able to decrypt them without our help What can I do to get my files back You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer The price for the software is $100 Dollars can be made in Venmo Or Robux only Please Contact Us At Gmail: [email protected] Discord Username: fridayboycrazy Payment information Venmo Amount: $100 Robux Payment Information: 10,000 Paid Ransom: https://www.roblox.com/game-pass/887175972 Paid Ransom: https://venmo.com/u/gratefulcode
Emails
URLs
-
https://www.roblox.com/game-pass/887175972
-
https://venmo.com/u/gratefulcode
Signatures
- Chaos
Ransomware family first seen in June 2021.
- Chaos Ransomware 2 IoCs
resource yara_rule behavioral2/memory/5044-0-0x0000000000280000-0x00000000002CC000-memory.dmp family_chaos behavioral2/files/0x0007000000016844-6.dat family_chaos - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2688 bcdedit.exe 1328 bcdedit.exe -
pid Process 5152 wbadmin.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation FridayBoycrazyV2.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation FridayBoycrazy.exe - Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FridayBoycrazy.url FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini FridayBoycrazy.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Warning.txt FridayBoycrazy.exe - Executes dropped EXE 1 IoCs
pid Process 4732 FridayBoycrazy.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\Saved Games\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Searches\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Documents\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Music\desktop.ini FridayBoycrazy.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Links\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Pictures\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Desktop\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Music\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Videos\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Public\Videos\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\Documents\desktop.ini FridayBoycrazy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini FridayBoycrazy.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT svchost.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oel2xb2rl.jpg" FridayBoycrazy.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4132 vssadmin.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133676026943119660" chrome.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings FridayBoycrazy.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings OpenWith.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4972 NOTEPAD.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4732 FridayBoycrazy.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 5044 FridayBoycrazyV2.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 4732 FridayBoycrazy.exe 540 chrome.exe 540 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 540 chrome.exe 540 chrome.exe 540 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5044 FridayBoycrazyV2.exe Token: SeDebugPrivilege 4732 FridayBoycrazy.exe Token: SeBackupPrivilege 1180 vssvc.exe Token: SeRestorePrivilege 1180 vssvc.exe Token: SeAuditPrivilege 1180 vssvc.exe Token: SeIncreaseQuotaPrivilege 1368 WMIC.exe Token: SeSecurityPrivilege 1368 WMIC.exe Token: SeTakeOwnershipPrivilege 1368 WMIC.exe Token: SeLoadDriverPrivilege 1368 WMIC.exe Token: SeSystemProfilePrivilege 1368 WMIC.exe Token: SeSystemtimePrivilege 1368 WMIC.exe Token: SeProfSingleProcessPrivilege 1368 WMIC.exe Token: SeIncBasePriorityPrivilege 1368 WMIC.exe Token: SeCreatePagefilePrivilege 1368 WMIC.exe Token: SeBackupPrivilege 1368 WMIC.exe Token: SeRestorePrivilege 1368 WMIC.exe Token: SeShutdownPrivilege 1368 WMIC.exe Token: SeDebugPrivilege 1368 WMIC.exe Token: SeSystemEnvironmentPrivilege 1368 WMIC.exe Token: SeRemoteShutdownPrivilege 1368 WMIC.exe Token: SeUndockPrivilege 1368 WMIC.exe Token: SeManageVolumePrivilege 1368 WMIC.exe Token: 33 1368 WMIC.exe Token: 34 1368 WMIC.exe Token: 35 1368 WMIC.exe Token: 36 1368 WMIC.exe Token: SeIncreaseQuotaPrivilege 1368 WMIC.exe Token: SeSecurityPrivilege 1368 WMIC.exe Token: SeTakeOwnershipPrivilege 1368 WMIC.exe Token: SeLoadDriverPrivilege 1368 WMIC.exe Token: SeSystemProfilePrivilege 1368 WMIC.exe Token: SeSystemtimePrivilege 1368 WMIC.exe Token: SeProfSingleProcessPrivilege 1368 WMIC.exe Token: SeIncBasePriorityPrivilege 1368 WMIC.exe Token: SeCreatePagefilePrivilege 1368 WMIC.exe Token: SeBackupPrivilege 1368 WMIC.exe Token: SeRestorePrivilege 1368 WMIC.exe Token: SeShutdownPrivilege 1368 WMIC.exe Token: SeDebugPrivilege 1368 WMIC.exe Token: SeSystemEnvironmentPrivilege 1368 WMIC.exe Token: SeRemoteShutdownPrivilege 1368 WMIC.exe Token: SeUndockPrivilege 1368 WMIC.exe Token: SeManageVolumePrivilege 1368 WMIC.exe Token: 33 1368 WMIC.exe Token: 34 1368 WMIC.exe Token: 35 1368 WMIC.exe Token: 36 1368 WMIC.exe Token: SeBackupPrivilege 3676 wbengine.exe Token: SeRestorePrivilege 3676 wbengine.exe Token: SeSecurityPrivilege 3676 wbengine.exe Token: SeShutdownPrivilege 6084 svchost.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe - Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 436 OpenWith.exe 3016 OpenWith.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5044 wrote to memory of 4732 5044 FridayBoycrazyV2.exe 94 PID 5044 wrote to memory of 4732 5044 FridayBoycrazyV2.exe 94 PID 4732 wrote to memory of 3188 4732 FridayBoycrazy.exe 96 PID 4732 wrote to memory of 3188 4732 FridayBoycrazy.exe 96 PID 3188 wrote to memory of 4132 3188 cmd.exe 98 PID 3188 wrote to memory of 4132 3188 cmd.exe 98 PID 3188 wrote to memory of 1368 3188 cmd.exe 101 PID 3188 wrote to memory of 1368 3188 cmd.exe 101 PID 4732 wrote to memory of 2936 4732 FridayBoycrazy.exe 103 PID 4732 wrote to memory of 2936 4732 FridayBoycrazy.exe 103 PID 2936 wrote to memory of 2688 2936 cmd.exe 105 PID 2936 wrote to memory of 2688 2936 cmd.exe 105 PID 2936 wrote to memory of 1328 2936 cmd.exe 106 PID 2936 wrote to memory of 1328 2936 cmd.exe 106 PID 4732 wrote to memory of 3620 4732 FridayBoycrazy.exe 107 PID 4732 wrote to memory of 3620 4732 FridayBoycrazy.exe 107 PID 3620 wrote to memory of 5152 3620 cmd.exe 109 PID 3620 wrote to memory of 5152 3620 cmd.exe 109 PID 4732 wrote to memory of 4972 4732 FridayBoycrazy.exe 113 PID 4732 wrote to memory of 4972 4732 FridayBoycrazy.exe 113 PID 540 wrote to memory of 2676 540 chrome.exe 137 PID 540 wrote to memory of 2676 540 chrome.exe 137 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2740 540 chrome.exe 138 PID 540 wrote to memory of 2864 540 chrome.exe 139 PID 540 wrote to memory of 2864 540 chrome.exe 139 PID 540 wrote to memory of 4740 540 chrome.exe 140 PID 540 wrote to memory of 4740 540 chrome.exe 140 PID 540 wrote to memory of 4740 540 chrome.exe 140 PID 540 wrote to memory of 4740 540 chrome.exe 140 PID 540 wrote to memory of 4740 540 chrome.exe 140 PID 540 wrote to memory of 4740 540 chrome.exe 140 PID 540 wrote to memory of 4740 540 chrome.exe 140 PID 540 wrote to memory of 4740 540 chrome.exe 140 PID 540 wrote to memory of 4740 540 chrome.exe 140 PID 540 wrote to memory of 4740 540 chrome.exe 140 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FridayBoycrazyV2.exe"C:\Users\Admin\AppData\Local\Temp\FridayBoycrazyV2.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Roaming\FridayBoycrazy.exe"C:\Users\Admin\AppData\Roaming\FridayBoycrazy.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:4132
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2688
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1328
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:5152
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Warning.txt3⤵
- Opens file in notepad (likely ransom note)
PID:4972
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4300,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:81⤵PID:4112
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1780
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:432
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:436
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3016
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf9b6183dh0c47h4342h9a01h264578d5bc8c1⤵PID:2688
-
C:\Windows\system32\CredentialEnrollmentManager.exeC:\Windows\system32\CredentialEnrollmentManager.exe1⤵PID:5604
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4972
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:6084
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9c49dcc40,0x7ff9c49dcc4c,0x7ff9c49dcc582⤵PID:2676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,1415749253744780584,14051937155934426181,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1912 /prefetch:22⤵PID:2740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,1415749253744780584,14051937155934426181,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2436 /prefetch:32⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,1415749253744780584,14051937155934426181,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2520 /prefetch:82⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,1415749253744780584,14051937155934426181,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:1220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,1415749253744780584,14051937155934426181,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3752,i,1415749253744780584,14051937155934426181,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4544 /prefetch:12⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4740,i,1415749253744780584,14051937155934426181,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4800 /prefetch:82⤵PID:3328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4972,i,1415749253744780584,14051937155934426181,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4824 /prefetch:82⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 c426a340a93edb322679bbf85dbfea7a16021c186763020011260d436a6f51e4
- MD5 aa5d05bc679c4656ec645d5c18569336
- SHA1 b704de46cd54679829e7dc703c415dac872204ca
- SHA512 67da133be88e89f07bf3eddd26255055c9530211afab4aa5e8d94c16676bdd043e56f042b6954a086b07aa561b8106c0c1f896dd13de3cc370f340d3c61f5494
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 9640490982b5bbb6f252da9e7f05a7bfa6f7a546909ef69a88f5eee74cc7ef13
- MD5 f0d415283f9b9d45bbf128d656ab3265
- SHA1 a243ac6f1f617a03e6866804a42b459fd50f2048
- SHA512 b4efc8048bdc956e0e1fecf5829dd64cacb73e74fb14a4fc904b9108e13cb70ce1ded77e9b65836b741c3e9c0ea18e0161428d4d0455040903609cc9781028ad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 74e09f7628a188fc5ff1f4d35c1a09a74f9a56130a3f93b6bedf296cb7b8fec9
- MD5 124f8a1b125d3ac3dbbad1a49a39536b
- SHA1 df85d57dd4548d23a23d5746278fb61bde9913aa
- SHA512 effb26ffca811835608543cd038bdba580fd8ce18e25c6f05dc70e5a6fb2e52bd2bcd8fe0916431efc71f7088f736511fcfcf7a6c9569ae36bc05ed2d86f7016
- SSDEEP 96:X43PU5X8QxCYPVTKIWCPaeY16Z7eH7/x+6MhmuecVT2OQ+BwhjtXIMoAy8yIsnVB:X4/U5QEpEejeHV+FRpTejdo6yIsnVdg4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 7aec49ec0a390b579b24c1a8f25d47cebcb523e7049ecb3e516eec169da32de4
- MD5 056a85cf079d49d2223df0e462468b4f
- SHA1 8ec0ed443fe64e9f25314dd3c0b44c29bf94feac
- SHA512 bda198c5f0fd7b2a040c28f79e731aed1af5f142a3a78e3cdd3b7bc446abab6fe65194b290715b39999076d75798229f1e130eee8a21ee45e941bafcf82d652a
- SSDEEP 384:7/tU7pLhLc+ejmXgi1kXqKf/pUZNCgVLH2HfSDOrUCPHGwEPLNS+:71U7pLhLn8sgi1kXqKf/pUZNCgVLH2H+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 193KB
- SHA256 8e5cd780c0b87e042532431b027b12a3a875a4aa53a616668182438fbdfc4049
- MD5 98459b301c80992cd7e74c7c31ee8e0d
- SHA1 e798ec799857885e4aab8e0cbfd0290316a01f75
- SHA512 ed72cfe86908dd050e8fa764d81de2b00fcc226feba94d702970582d585cfad3c4bbd439a2cb92958bf1b1dedcbff9c007506b1b41f84fe301c519863d96a81d
- SSDEEP 3072:kOFPF4PocTj6+uR1Vgd139bPF3dBUnMfLWzGH03oe35YUG0TFrmf7lJaQodShMev:NdIxuR1VEb7UMf5U3o310MBdodSx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\FridayBoycrazy.exe
- Size 280KB
- SHA256 0ef2768bdfaa0b953a5c498f18bbf2df5dce249eaf2044474c476c4367c535b5
- MD5 41e34a8240026b4e9cd8d81a73ee8b2c
- SHA1 3876b12e152dd552a7059538242b6f87a23e60f5
- SHA512 a7d610ee4f116121757f47193bf092b639cf2d439dcfa364ea800c28c0f21996fd8baa31c9abe68d2c18cc8f334c57f9d71c4e444a04a27d3b9cab90eecbba73
- SSDEEP 6144:1r93iyJ7/+WZT1kRnSeXSX9MNzxiMwP2OswK:iyJ7/+Wd1kRnFX4mNzxyeOswK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\Warning.txt
- Size 642B
- SHA256 f7b22500b7a82a9446b635353aceecbdc205c9208eeb72c2e2c1b6d0a9a1bd62
- MD5 072e26ca8a9c9502061d1c3d9e3bbeaa
- SHA1 fe55bffddd0d415c293e8e926d302e3586212322
- SHA512 2bc83902a56df2a3178c3b59ad8014a08b282e60289123a10d9a4d643a604876e008e782a6c861bfd211580a5fdbb1bcf748c3197210d71dc18d8949c62d4610
- MD5 SHA1 SHA512