targetcompany | 0f8de2a116f590ace3a818302d2531af9f3c972816638c92773048c640807acc

General

Target

red.exe
Size

376KB
MD5

120c6ddfc24274b6e2e3a1ba7dc519ab
SHA1

29936b1aa952a89905bf0f7b7053515fd72d8c5c
SHA256

2289706f678585059502a24283e0f55d56cf477524753c606f64825bba66fca8
SHA512

dd9b2fb6cd5f6f044daa80ef634078849032ebbdbd1d293bb7bcb0270aa8b7360c39addb0826c7a3ddc8714b559bf8828e8e506ac91bcb4702a72f4c8ec4850a
SSDEEP

6144:KFtgKBIxGS/bbWGGJK8PpzR1WpOJOQMeEBwhUg5bBDNPbsP/qrscpyj4CVKSkn:+tgKIxfbbezR1WpOJJMjihU030/qRMra

Score

10^/10

targetcompany defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

\Device\HarddiskVolume1\HOW TO BACK FILES.txt

Ransom Note

Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 5EF91C121D8F58C58779EEC3 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion �

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
ransomware targetcompany
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (6520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

red.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation red.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	red.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

red.exe

description	ioc	process
File opened (read-only)	\??\T:	red.exe
File opened (read-only)	\??\D:	red.exe
File opened (read-only)	\??\A:	red.exe
File opened (read-only)	\??\H:	red.exe
File opened (read-only)	\??\L:	red.exe
File opened (read-only)	\??\M:	red.exe
File opened (read-only)	\??\N:	red.exe
File opened (read-only)	\??\O:	red.exe
File opened (read-only)	\??\W:	red.exe
File opened (read-only)	\??\E:	red.exe
File opened (read-only)	\??\P:	red.exe
File opened (read-only)	\??\Q:	red.exe
File opened (read-only)	\??\R:	red.exe
File opened (read-only)	\??\U:	red.exe
File opened (read-only)	\??\X:	red.exe
File opened (read-only)	\??\Z:	red.exe
File opened (read-only)	\??\G:	red.exe
File opened (read-only)	\??\J:	red.exe
File opened (read-only)	\??\K:	red.exe
File opened (read-only)	\??\Y:	red.exe
File opened (read-only)	\??\B:	red.exe
File opened (read-only)	\??\I:	red.exe
File opened (read-only)	\??\S:	red.exe
File opened (read-only)	\??\V:	red.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org

flow	ioc
4	api.ipify.org

Drops file in Program Files directory 64 IoCs

Processes:

red.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-40_altform-lightunplated.png	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\ui-strings.js	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\eu.pak	red.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms	red.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-200.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-100.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\BadgeLogo.scale-200.png	red.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-200.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\9.jpg	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	red.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui	red.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-100.png	red.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\HOW TO BACK FILES.txt	red.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms	red.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-125.png	red.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-400_contrast-white.png	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\sticker8.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxManifest.xml	red.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailWideTile.scale-100.png	red.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white.png	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\rename.svg	red.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\HOW TO BACK FILES.txt	red.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-MX\View3d\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-unplated.png	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nb-no\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\AppxMetadata\AppxBundleManifest.xml	red.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorMedTile.contrast-white_scale-125.png	red.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\fr-FR\setup_wm.exe.mui	red.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\selector.js	red.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ko_135x40.svg	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\msedge_100_percent.pak.DATA	red.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\HOW TO BACK FILES.txt	red.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png	red.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-300.png	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon.png	red.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hi-IN\View3d\3DViewerProductDescription-universal.xml	red.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-150.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	red.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

red.execmd.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	red.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

2256 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

red.exe

pid process

4436 red.exe
4436 red.exe
4436 red.exe
4436 red.exe

pid	process
2256	vssadmin.exe

pid	process
4436	red.exe
4436	red.exe
4436	red.exe
4436	red.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

red.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeDebugPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe
Token: SeTakeOwnershipPrivilege	4436	red.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

red.exe

description	pid	process	target process
PID 4436 wrote to memory of 3020	4436	red.exe	cmd.exe
PID 4436 wrote to memory of 3020	4436	red.exe	cmd.exe
PID 4436 wrote to memory of 3020	4436	red.exe	cmd.exe
PID 4436 wrote to memory of 2660	4436	red.exe	cmd.exe
PID 4436 wrote to memory of 2660	4436	red.exe	cmd.exe
PID 4436 wrote to memory of 2660	4436	red.exe	cmd.exe
PID 4436 wrote to memory of 2256	4436	red.exe	vssadmin.exe
PID 4436 wrote to memory of 2256	4436	red.exe	vssadmin.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

red.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" red.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	red.exe

C:\Users\Admin\AppData\Local\Temp\red.exe
"C:\Users\Admin\AppData\Local\Temp\red.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4436

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
2⤵
- System Location Discovery: System Language Discovery
PID:3020

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
2⤵
- System Location Discovery: System Language Discovery
PID:2660

C:\Windows\system32\vssadmin.exe
"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

1

T1006

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

1

T1217

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.2c6c9842.pri
Filesize
88KB

MD5
24954b54c7fd3ecf7851564d77afe249

SHA1
5f22fb5783880ed239c76c042cca48677b6e83a3

SHA256
41d4babdc3f6c1d24bdc2f6b9bf54d460d6e2344d670b67a136252f4b8e3589a

SHA512
4b46db706e55d13cd69d3105d9c6fab5368722ea4f1c63c1c4d366075df806db7e0c8ec3488e4b276f9efa9a3a596561d77478d8d4f0ddd124cdb7ee003cfce7

Download Submit
C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.35ca3df1.pri
Filesize
80KB

MD5
7b938ee27590c0e44306d89fdd3d4bfb

SHA1
19b7bedd72b4acf856cdb0d0f7ab238bdc950077

SHA256
6ca25785a5ce4c359c76f19edd657de653a7ba127c0921fe9f17c3744cb3449a

SHA512
c07d3b00a53ace108c2ae932264328cdd22fac9b6788a80c84cff12929f071070ee20b530ea61e1e6e6a5897d8f41280a469ba7b1860e3f363d5f49e7a3eb3c8

Download Submit
\Device\HarddiskVolume1\HOW TO BACK FILES.txt
Filesize
910B

MD5
c4bba99b0567643b33ce5e98f2816ec4

SHA1
ee1550962aa06e1ac4eb1c5194e10bbea6c40d94

SHA256
fdfd8d9e4520af2503e683545589829e4bbd6c84f49b7429589627248ca59c8a

SHA512
31ca8abf6e65d93d59ecc748e2dcf9acff6cd0160e06fa0ebba12437b2a636b62bec328aa7f5ea1b5dbcd6efcfc4272ffa5c7904d7789ad35b08a694831248b2

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads