a6ddcbca65d8fdd771f1d9e271a42e601fcebb5e6f6c49ec30113e930b2cd790

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

devilransom.exe
Size

240KB
MD5

b834c44a3e5298a3f23a1355409d2578
SHA1

ba9fc22891f7480c49ee9e4d9409f833fc9484d8
SHA256

a6ddcbca65d8fdd771f1d9e271a42e601fcebb5e6f6c49ec30113e930b2cd790
SHA512

dad2007f6ffdae861cd7eec928a0b1dacf6058595bb9d33e1cd08701c721e347a04921e177e8639fef6e80e3fe29885f7067448f978921075b1e7490b40c0ad3
SSDEEP

6144:UeLttJ+VSjv6S0qhH6NAw497/WBzzcT22sW6fvyENEb1HwoS:HLttJ+VSeS0e6N697/+zca2sFf6wtoS

Score

10^/10

discovery evasion persistence ransomware trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D346.tmp\\installsetupupdate.exe"	installsetupupdate.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
2656	installsetupupdate.exe

Loads dropped DLL 1 IoCs

pid	Process
2336	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2492-0-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral1/memory/2492-33-0x0000000000400000-0x00000000004FD000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D346.tmp\\installsetupupdate.exe"	installsetupupdate.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "c:\\bg.bmp"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installsetupupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	devilransom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2340	reg.exe
1576	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2752	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2020	explorer.exe
Token: SeShutdownPrivilege	2020	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe
2656	installsetupupdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2336	2492	devilransom.exe	32
PID 2492 wrote to memory of 2336	2492	devilransom.exe	32
PID 2492 wrote to memory of 2336	2492	devilransom.exe	32
PID 2492 wrote to memory of 2336	2492	devilransom.exe	32
PID 2336 wrote to memory of 2340	2336	cmd.exe	33
PID 2336 wrote to memory of 2340	2336	cmd.exe	33
PID 2336 wrote to memory of 2340	2336	cmd.exe	33
PID 2336 wrote to memory of 2340	2336	cmd.exe	33
PID 2336 wrote to memory of 1576	2336	cmd.exe	34
PID 2336 wrote to memory of 1576	2336	cmd.exe	34
PID 2336 wrote to memory of 1576	2336	cmd.exe	34
PID 2336 wrote to memory of 1576	2336	cmd.exe	34
PID 2336 wrote to memory of 924	2336	cmd.exe	35
PID 2336 wrote to memory of 924	2336	cmd.exe	35
PID 2336 wrote to memory of 924	2336	cmd.exe	35
PID 2336 wrote to memory of 924	2336	cmd.exe	35
PID 2336 wrote to memory of 2736	2336	cmd.exe	36
PID 2336 wrote to memory of 2736	2336	cmd.exe	36
PID 2336 wrote to memory of 2736	2336	cmd.exe	36
PID 2336 wrote to memory of 2736	2336	cmd.exe	36
PID 2336 wrote to memory of 2736	2336	cmd.exe	36
PID 2336 wrote to memory of 2736	2336	cmd.exe	36
PID 2336 wrote to memory of 2736	2336	cmd.exe	36
PID 2336 wrote to memory of 2644	2336	cmd.exe	37
PID 2336 wrote to memory of 2644	2336	cmd.exe	37
PID 2336 wrote to memory of 2644	2336	cmd.exe	37
PID 2336 wrote to memory of 2644	2336	cmd.exe	37
PID 2336 wrote to memory of 2644	2336	cmd.exe	37
PID 2336 wrote to memory of 2644	2336	cmd.exe	37
PID 2336 wrote to memory of 2644	2336	cmd.exe	37
PID 2336 wrote to memory of 828	2336	cmd.exe	38
PID 2336 wrote to memory of 828	2336	cmd.exe	38
PID 2336 wrote to memory of 828	2336	cmd.exe	38
PID 2336 wrote to memory of 828	2336	cmd.exe	38
PID 2336 wrote to memory of 828	2336	cmd.exe	38
PID 2336 wrote to memory of 828	2336	cmd.exe	38
PID 2336 wrote to memory of 828	2336	cmd.exe	38
PID 2336 wrote to memory of 2660	2336	cmd.exe	39
PID 2336 wrote to memory of 2660	2336	cmd.exe	39
PID 2336 wrote to memory of 2660	2336	cmd.exe	39
PID 2336 wrote to memory of 2660	2336	cmd.exe	39
PID 2336 wrote to memory of 2660	2336	cmd.exe	39
PID 2336 wrote to memory of 2660	2336	cmd.exe	39
PID 2336 wrote to memory of 2660	2336	cmd.exe	39
PID 2336 wrote to memory of 2448	2336	cmd.exe	40
PID 2336 wrote to memory of 2448	2336	cmd.exe	40
PID 2336 wrote to memory of 2448	2336	cmd.exe	40
PID 2336 wrote to memory of 2448	2336	cmd.exe	40
PID 2336 wrote to memory of 2448	2336	cmd.exe	40
PID 2336 wrote to memory of 2448	2336	cmd.exe	40
PID 2336 wrote to memory of 2448	2336	cmd.exe	40
PID 2336 wrote to memory of 2696	2336	cmd.exe	41
PID 2336 wrote to memory of 2696	2336	cmd.exe	41
PID 2336 wrote to memory of 2696	2336	cmd.exe	41
PID 2336 wrote to memory of 2696	2336	cmd.exe	41
PID 2336 wrote to memory of 2696	2336	cmd.exe	41
PID 2336 wrote to memory of 2696	2336	cmd.exe	41
PID 2336 wrote to memory of 2696	2336	cmd.exe	41
PID 2336 wrote to memory of 2752	2336	cmd.exe	42
PID 2336 wrote to memory of 2752	2336	cmd.exe	42
PID 2336 wrote to memory of 2752	2336	cmd.exe	42
PID 2336 wrote to memory of 2752	2336	cmd.exe	42
PID 2336 wrote to memory of 2656	2336	cmd.exe	43
PID 2336 wrote to memory of 2656	2336	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\devilransom.exe
"C:\Users\Admin\AppData\Local\Temp\devilransom.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\D346.tmp\devilransom.bat""
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2340
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1576
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\bg.bmp /f
    3⤵
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    PID:924
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2736
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2644
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:828
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2448
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2696
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\devilransom.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\D346.tmp\installsetupupdate.exe
    installsetupupdate.exe
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2656
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2372
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2744
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2808
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2668
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2144
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2932
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2872
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2724
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2720
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2604
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2820
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2548
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:788
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2912
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2792
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2876
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2732
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2036

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious use of AdjustPrivilegeToken
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D346.tmp\bg.bmp

Filesize
506KB

MD5
ee1b910539fb2e71ed52d051c6a5c9b5

SHA1
ffee3fdfaf7e62ea14fd52f6a9d5b774d58ab720

SHA256
4b23052d3e199074c625ba9c5ed3969e8122190ce602917105a4c34efdfe826a

SHA512
097ab1ee2a2207264f789defb6b78d8bb1b4538461eb3af0ce7a6163f1007ecdab678eeeaebcd65853fa2430a9890f8e0ecac5b89908e045cf9493fc4017e23d

Download Submit
C:\Users\Admin\AppData\Local\Temp\D346.tmp\devilransom.bat

Filesize
2KB

MD5
accb994f867d9220d44459a0c8c04de7

SHA1
411d8675cab78d319a38dbc9b056c45cc19eba63

SHA256
36329399497e0e53e89d66a7ad23ce8094cd08601aac65173a4d73135f1d77ff

SHA512
93558ca1e9e941dde6e77337a53f6929d9ef62d4b676490be78550ec0ae93b24545100cf15f8b8ed1138cd8fbe25a1399d862e1e40a2f6a826eca0619dad0f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\D346.tmp\installsetupupdate.exe

Filesize
436KB

MD5
6c5a3a112b3940c55f8653597b1b7152

SHA1
3578eb4cf6c30d3bd779c5e3b1ddbf6a8a2ab3b5

SHA256
471a338122025eb481779092de78653df6434715590d741c95e5138c87147488

SHA512
12edede68b9b473cbe0f0a650643912f394d3ad60b2687e465f7a27d15ac5fd94568c29692140b84c5a194b65a450a65358f6278a6f1025bfd44071d357c716b

Download Submit
C:\devilransom.txt

Filesize
106B

MD5
f9cfc983bdfc1fb2f265918fbe0d9c65

SHA1
ee5d34343e484e8133c3423db32bd458779896b9

SHA256
eb2521cac865e84299e54641b5036ec4c789b012850c859fb38de0599e408312

SHA512
a97fb3e00139a1ab40648ff645700cebdfabacf2ac117c10f6e24efd8bf05fc2218fa866c8189e67ea99295f0966eafaea2f3e5dd19eb3bb46d78a89ba25f5d6

Download Submit
memory/2492-0-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/2492-33-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/2656-36-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-35-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-34-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-37-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-38-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-39-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-40-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-41-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-42-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-43-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-46-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-47-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download