Malware Analysis Report

2024-10-24 18:21

Sample ID 241018-dfenqsshpb
Target e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe
SHA256 e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3
Tags
defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3

Threat Level: Known bad

The file e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware trojan

Modifies Windows Defender Real-time Protection settings

Deletes shadow copies

Modifies Windows Firewall

Disables Task Manager via registry modification

Drops startup file

Checks computer location settings

Drops desktop.ini file(s)

Enumerates connected drives

Adds Run key to start application

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Unsigned PE

System Location Discovery: System Language Discovery

Program crash

Modifies Internet Explorer settings

System policy modification

Suspicious use of AdjustPrivilegeToken

Interacts with shadow copies

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Modifies Control Panel

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-18 02:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-18 02:56

Reported

2024-10-18 02:59

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Deletes shadow copies

ransomware defense_evasion impact execution

Disables Task Manager via registry modification

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.bat C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Michael Gillespie = "C:\\ProgramData\\winlogon.exe" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Michael Gillespie = "C:\\Windows\\winlogon.exe" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\v3xfkar2.Loki" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\DEEPBLUE.INF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_start_a_coversation_v3.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\InAppSign.aapp C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\plugins.js C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files\dotnet\host\fxr\8.0.2\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\Font\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\HoloMDL2.ttf C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\ruleset_en-GB_TTS.lua C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\bun.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files\Common Files\DESIGNER\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\s_empty_folder_state.svg C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-200.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-16.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_contrast-black.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-100.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-72_altform-colorize.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-24_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_checkbox_unselected_18.svg C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_contrast-white.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es_2x.gif C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\es-es\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\VEN2232.OLB C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-200.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-36_contrast-black.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1113_20x20x32.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\EVRGREEN.INF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-256.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxBadge.scale-100.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\identity_helper.Sparse.Dev.msix C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.nuspec C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-lightunplated_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\next-arrow-disabled.svg C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchSmallTile.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\PNG32.FLT C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winlogon.exe C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Windows\winlogon.exe C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\WallpaperStyle = "2" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Loki\ = "Loki" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Loki\shell\open\command C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Loki C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Loki\shell C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Loki\shell\open C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Loki\shell\open\command\ = "C:\\ProgramData\\5ha2hibk.exe \"%l\" " C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Loki C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2128 wrote to memory of 5476 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 5476 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 5476 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 5476 wrote to memory of 376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 5476 wrote to memory of 376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 5476 wrote to memory of 376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2128 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2128 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2128 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 5032 wrote to memory of 5648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 5032 wrote to memory of 5648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 5032 wrote to memory of 5648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2128 wrote to memory of 6016 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6016 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6016 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6008 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6008 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6008 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6076 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6076 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6076 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6120 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6120 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6120 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6124 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6124 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 6124 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 5828 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 5828 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 5828 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 5824 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 5824 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 5824 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 6076 wrote to memory of 5696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 6076 wrote to memory of 5696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 6076 wrote to memory of 5696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 5828 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 5828 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 5828 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 5824 wrote to memory of 5340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 5824 wrote to memory of 5340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 5824 wrote to memory of 5340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2128 wrote to memory of 5452 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 5452 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 5452 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe
PID 2128 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\mshta.exe

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Encrypted by Loki locker" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your files have been encrypted due to a security problem with your computer\r\nIf you want to restore them, write us to the e-mail: [email protected]\r\nWrite this ID in the title of your message: 58344A94\r\nIn case of no answer in 24 hours write us to this e-mail: [email protected]" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe

"C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y2ckrffq\y2ckrffq.cmdline"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES319A.tmp" "c:\ProgramData\CSC3EFA743BADC04205A98E14F5CAC9A499.TMP"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\SysWOW64\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3396 -ip 3396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4784 -ip 4784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 116 -ip 116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1744 -ip 1744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5452 -ip 5452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 1368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1336

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 1436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 1428

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
N/A 10.127.0.1:445 tcp
N/A 10.127.0.40:445 tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
N/A 10.127.0.32:445 tcp
N/A 10.127.0.62:445 tcp
N/A 10.127.0.26:445 tcp
N/A 10.127.0.28:445 tcp
N/A 10.127.0.13:445 tcp
N/A 10.127.0.21:445 tcp
N/A 10.127.0.11:445 tcp
N/A 10.127.0.40:139 tcp
N/A 10.127.0.1:139 tcp
N/A 10.127.0.14:445 tcp
N/A 10.127.0.12:445 tcp
N/A 10.127.0.15:445 tcp
N/A 10.127.0.9:445 tcp
N/A 10.127.0.17:445 tcp
N/A 10.127.0.16:445 tcp
N/A 10.127.0.18:445 tcp
N/A 10.127.0.0:445 tcp
N/A 10.127.0.19:445 tcp
N/A 10.127.0.20:445 tcp
N/A 10.127.0.22:445 tcp
N/A 10.127.0.23:445 tcp
N/A 10.127.0.25:445 tcp
N/A 10.127.0.27:445 tcp
N/A 10.127.0.29:445 tcp
N/A 10.127.0.30:445 tcp
N/A 10.127.0.31:445 tcp
N/A 10.127.0.33:445 tcp
N/A 10.127.0.24:445 tcp
N/A 10.127.0.34:445 tcp
N/A 10.127.0.35:445 tcp
N/A 10.127.0.36:445 tcp
N/A 10.127.0.37:445 tcp
N/A 10.127.0.38:445 tcp
N/A 10.127.0.39:445 tcp
N/A 10.127.0.5:445 tcp
N/A 10.127.0.10:445 tcp
N/A 10.127.0.8:445 tcp
N/A 10.127.0.6:445 tcp
N/A 10.127.0.7:445 tcp
N/A 10.127.0.3:445 tcp
N/A 10.127.0.78:445 tcp
N/A 10.127.0.42:445 tcp
N/A 10.127.0.41:445 tcp
N/A 10.127.0.44:445 tcp
N/A 10.127.0.43:445 tcp
N/A 10.127.0.45:445 tcp
N/A 10.127.0.46:445 tcp
N/A 10.127.0.47:445 tcp
N/A 10.127.0.48:445 tcp
N/A 10.127.0.49:445 tcp
N/A 10.127.0.50:445 tcp
N/A 10.127.0.51:445 tcp
N/A 10.127.0.52:445 tcp
N/A 10.127.0.53:445 tcp
N/A 10.127.0.54:445 tcp
N/A 10.127.0.55:445 tcp
N/A 10.127.0.56:445 tcp
N/A 10.127.0.58:445 tcp
N/A 10.127.0.60:445 tcp
N/A 10.127.0.59:445 tcp
N/A 10.127.0.64:445 tcp
N/A 10.127.0.61:445 tcp
N/A 10.127.0.63:445 tcp
N/A 10.127.0.68:445 tcp
N/A 10.127.0.65:445 tcp
N/A 10.127.0.70:445 tcp
N/A 10.127.0.71:445 tcp
N/A 10.127.0.73:445 tcp
N/A 10.127.0.76:445 tcp
N/A 10.127.0.75:445 tcp
N/A 10.127.0.80:445 tcp
N/A 10.127.0.2:445 tcp
N/A 10.127.0.57:445 tcp
N/A 10.127.0.95:445 tcp
N/A 10.127.0.108:445 tcp
N/A 10.127.0.110:445 tcp
N/A 10.127.0.109:445 tcp
N/A 10.127.0.111:445 tcp
N/A 10.127.0.113:445 tcp
N/A 10.127.0.114:445 tcp
N/A 10.127.0.100:445 tcp
N/A 10.127.0.103:445 tcp
N/A 10.127.0.101:445 tcp
N/A 10.127.0.82:445 tcp
N/A 10.127.0.102:445 tcp
N/A 10.127.0.81:445 tcp
N/A 10.127.0.83:445 tcp
N/A 10.127.0.85:445 tcp
N/A 10.127.0.86:445 tcp
N/A 10.127.0.90:445 tcp
N/A 10.127.0.91:445 tcp
N/A 10.127.0.94:445 tcp
N/A 10.127.0.92:445 tcp
N/A 10.127.0.74:445 tcp
N/A 10.127.0.79:445 tcp
N/A 10.127.0.4:445 tcp
N/A 10.127.0.123:445 tcp
N/A 10.127.0.149:445 tcp
N/A 10.127.0.247:445 tcp
N/A 10.127.0.28:139 tcp
N/A 10.127.0.62:139 tcp
N/A 10.127.0.21:139 tcp
N/A 10.127.0.26:139 tcp
N/A 10.127.0.11:139 tcp
N/A 10.127.0.32:139 tcp
N/A 10.127.0.13:139 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 10.127.0.72:445 tcp
N/A 10.127.0.77:445 tcp
N/A 10.127.0.69:445 tcp
N/A 10.127.0.67:445 tcp
N/A 10.127.0.66:445 tcp
N/A 10.127.0.98:445 tcp
N/A 10.127.0.97:445 tcp
N/A 10.127.0.96:445 tcp
N/A 10.127.0.93:445 tcp
N/A 10.127.0.88:445 tcp
N/A 10.127.0.89:445 tcp
N/A 10.127.0.99:445 tcp
N/A 10.127.0.87:445 tcp
N/A 10.127.0.119:445 tcp
N/A 10.127.0.120:445 tcp
N/A 10.127.0.84:445 tcp
N/A 10.127.0.118:445 tcp
N/A 10.127.0.117:445 tcp
N/A 10.127.0.104:445 tcp
N/A 10.127.0.107:445 tcp
N/A 10.127.0.105:445 tcp
N/A 10.127.0.112:445 tcp
N/A 10.127.0.115:445 tcp
N/A 10.127.0.106:445 tcp
N/A 10.127.0.116:445 tcp
N/A 10.127.0.121:445 tcp
N/A 10.127.0.122:445 tcp
N/A 10.127.0.12:139 tcp
N/A 10.127.0.14:139 tcp
N/A 10.127.0.61:139 tcp
N/A 10.127.0.15:139 tcp
N/A 10.127.0.9:139 tcp
N/A 10.127.0.17:139 tcp
N/A 10.127.0.16:139 tcp
N/A 10.127.0.0:139 tcp
N/A 10.127.0.19:139 tcp
N/A 10.127.0.20:139 tcp
N/A 10.127.0.18:139 tcp
N/A 10.127.0.23:139 tcp
N/A 10.127.0.25:139 tcp
N/A 10.127.0.22:139 tcp
N/A 10.127.0.29:139 tcp
N/A 10.127.0.27:139 tcp
N/A 10.127.0.30:139 tcp
N/A 10.127.0.31:139 tcp
N/A 10.127.0.33:139 tcp
N/A 10.127.0.24:139 tcp
N/A 10.127.0.34:139 tcp
N/A 10.127.0.35:139 tcp
N/A 10.127.0.36:139 tcp
N/A 10.127.0.37:139 tcp
N/A 10.127.0.38:139 tcp
N/A 10.127.0.10:139 tcp
N/A 10.127.0.5:139 tcp
N/A 10.127.0.8:139 tcp
N/A 10.127.0.6:139 tcp
N/A 10.127.0.39:139 tcp
N/A 10.127.0.7:139 tcp
N/A 10.127.0.3:139 tcp
N/A 10.127.0.78:139 tcp
N/A 10.127.0.41:139 tcp
N/A 10.127.0.42:139 tcp
N/A 10.127.0.43:139 tcp
N/A 10.127.0.44:139 tcp
N/A 10.127.0.48:139 tcp
N/A 10.127.0.46:139 tcp
N/A 10.127.0.45:139 tcp
N/A 10.127.0.47:139 tcp
N/A 10.127.0.49:139 tcp
N/A 10.127.0.51:139 tcp
N/A 10.127.0.52:139 tcp
N/A 10.127.0.50:139 tcp
N/A 10.127.0.55:139 tcp
N/A 10.127.0.53:139 tcp
N/A 10.127.0.58:139 tcp
N/A 10.127.0.54:139 tcp
N/A 10.127.0.60:139 tcp
N/A 10.127.0.56:139 tcp
N/A 10.127.0.63:139 tcp
N/A 10.127.0.64:139 tcp
N/A 10.127.0.59:139 tcp
N/A 10.127.0.68:139 tcp
N/A 10.127.0.65:139 tcp
N/A 10.127.0.4:139 tcp
N/A 10.127.0.71:139 tcp
N/A 10.127.0.75:139 tcp
N/A 10.127.0.76:139 tcp
N/A 10.127.0.70:139 tcp
N/A 10.127.0.73:139 tcp
N/A 10.127.0.80:139 tcp
N/A 10.127.0.57:139 tcp
N/A 10.127.0.2:139 tcp
N/A 10.127.0.108:139 tcp
N/A 10.127.0.95:139 tcp
N/A 10.127.0.110:139 tcp
N/A 10.127.0.109:139 tcp
N/A 10.127.0.114:139 tcp
N/A 10.127.0.111:139 tcp
N/A 10.127.0.113:139 tcp
N/A 10.127.0.103:139 tcp
N/A 10.127.0.100:139 tcp
N/A 10.127.0.82:139 tcp
N/A 10.127.0.74:139 tcp
N/A 10.127.0.102:139 tcp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
N/A 10.127.0.101:139 tcp
N/A 10.127.0.83:139 tcp
N/A 10.127.0.85:139 tcp
N/A 10.127.0.81:139 tcp
N/A 10.127.0.86:139 tcp
N/A 10.127.0.91:139 tcp
N/A 10.127.0.149:139 tcp
N/A 10.127.0.94:139 tcp
N/A 10.127.0.90:139 tcp
N/A 10.127.0.92:139 tcp
N/A 10.127.0.79:139 tcp
N/A 10.127.0.123:139 tcp
N/A 10.127.0.247:139 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
N/A 10.127.0.66:139 tcp
N/A 10.127.0.69:139 tcp
N/A 10.127.0.72:139 tcp
N/A 10.127.0.77:139 tcp
N/A 10.127.0.67:139 tcp
N/A 10.127.0.88:139 tcp
N/A 10.127.0.87:139 tcp
N/A 10.127.0.98:139 tcp
N/A 10.127.0.96:139 tcp
N/A 10.127.0.84:139 tcp
N/A 10.127.0.97:139 tcp
N/A 10.127.0.93:139 tcp
N/A 10.127.0.120:139 tcp
N/A 10.127.0.89:139 tcp
N/A 10.127.0.118:139 tcp
N/A 10.127.0.119:139 tcp
N/A 10.127.0.99:139 tcp
N/A 10.127.0.121:139 tcp
N/A 10.127.0.112:139 tcp
N/A 10.127.0.105:139 tcp
N/A 10.127.0.104:139 tcp
N/A 10.127.0.116:139 tcp
N/A 10.127.0.106:139 tcp
N/A 10.127.0.117:139 tcp
N/A 10.127.0.115:139 tcp
N/A 10.127.0.122:139 tcp
N/A 10.127.0.107:139 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 62.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 40.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 11.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 13.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 26.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 32.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 28.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 21.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 14.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 12.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 9.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 19.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 61.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 16.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 30.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 34.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 36.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 18.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 15.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 25.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 0.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 20.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 22.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 10.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 29.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 39.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 3.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 41.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 43.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 33.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 48.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 49.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 52.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 17.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 58.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 23.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 60.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 63.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 27.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 31.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 24.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 35.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 37.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 38.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 8.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 45.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 55.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 5.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 78.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 7.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 42.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 46.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 51.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 54.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 65.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 64.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 59.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 75.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 2.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 111.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 103.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 82.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 102.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 83.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 68.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 71.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 76.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 73.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 114.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 74.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 85.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 92.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 123.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 149.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 6.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 44.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 47.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 50.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 53.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 56.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 4.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 70.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 80.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 95.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 57.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 109.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 108.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 110.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 113.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 100.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 101.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 81.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 91.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 94.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 86.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 90.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 247.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 79.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 69.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 66.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 loki-locker.one udp
US 8.8.8.8:53 72.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 77.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 67.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 98.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 84.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 88.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 93.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 89.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 119.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 97.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 120.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 121.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 112.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 106.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 104.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 115.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 87.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 107.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 116.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 96.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 117.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 118.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 99.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 105.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 122.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 104.155.138.21:80 loki-locker.one tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 21.138.155.104.in-addr.arpa udp
US 104.155.138.21:80 loki-locker.one tcp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 104.155.138.21:80 loki-locker.one tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

memory/2128-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

memory/2128-1-0x0000000000B30000-0x0000000000BB8000-memory.dmp

memory/2128-2-0x0000000005550000-0x00000000055E2000-memory.dmp

memory/2128-3-0x00000000055F0000-0x0000000005656000-memory.dmp

memory/2128-4-0x0000000005770000-0x00000000057E6000-memory.dmp

memory/2128-5-0x0000000005500000-0x0000000005522000-memory.dmp

memory/2128-6-0x0000000074A00000-0x00000000751B0000-memory.dmp

memory/2128-7-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

memory/2128-8-0x0000000074A00000-0x00000000751B0000-memory.dmp

C:\Users\Admin\Desktop\Cpriv.Loki

MD5 d4091fcabf754815f654ea52de30231b
SHA1 0e844be856f3a6b82dbe7e05d4c2dfb340631c4b
SHA256 cc14b935ce8724fe2f01933e8727e813bd54cf70f1f0c845b9ec413901c91dd9
SHA512 cd4f4983161818b6cfd30e5ce488bfdf86f6c411698c93bae35623362093767eca96b432a16fe2ad100978ee6bc86c6a564e8cbd3d331a5e425622ba4398ba04

C:\ProgramData\winlogon.exe

MD5 d7d28006e0679b1f2ea0a87ba94f4af0
SHA1 675f7b9185ccc3241650ff2fd96f5e1a0bbf63ee
SHA256 e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3
SHA512 b3f9257825850e4f2920d05f45eece26323d81d06a761fa2e5b2d154535d45f996a316e238f2d29fb82081a133dfd5ad304835317e65fa72f9fc2e1acbfce03a

\??\c:\Users\Admin\AppData\Local\Temp\y2ckrffq\y2ckrffq.cmdline

MD5 84e055377be82abb58026b55e1f4bfb7
SHA1 bf54ea5e74d23763c019f956f4246768c5ca0184
SHA256 685e6f3f8d58bf68824739dedd8bc000688c25b6a96e9019be72f5867550e7b3
SHA512 0f557598ce20bd5982ba2ce3e366c992651a6bcc2da99dd84d49b293df1a9bbf273cd0e5fcf19868abe7c5166b237e29113a1ea27cb51c556a68b4ed5a202e97

\??\c:\Users\Admin\AppData\Local\Temp\y2ckrffq\y2ckrffq.0.cs

MD5 c613631bdd33f586082cd9fa5c31a399
SHA1 f629d338ddcb32039b87831e640f07ca443a2d31
SHA256 8e19800612f096b7f53f5aa023babe7aeee3a8aaf6f7421063ed245ebea1a70a
SHA512 1ac9a6b54fe6360cab5514ea5f9084c78cf0235a31f26705e3829b95554651c2718ea2eaeacbc2f5a77671fa587955cb1ec6d4c5016096c1a72be29bacc13de8

\??\c:\Users\Admin\AppData\Local\Temp\rv3yc3xz.ico

MD5 dbc49b5f7714255217080c2e81f05a99
SHA1 4de2ef415d66d2bb8b389ba140a468b125388e19
SHA256 6d2f1f6164cbd331b9dc43b37948372e21b2ee45407aa99e199693835cded09c
SHA512 29a65eb7403bfc220fd057c2e6ea11b29bff545dfce2d3370ad462c66b03ae7f648efd480305423a49440de199a2a94c41214877b226a42dc2d1650683d149bb

\??\c:\ProgramData\CSC3EFA743BADC04205A98E14F5CAC9A499.TMP

MD5 ef314b2832f08be28a768647b672f4ff
SHA1 a43b602f1453f25da6c5267e2becd098836a48ad
SHA256 a4803bed4ac93466c2f3fa08cd166869da1d2585bb3a927f2c7a43ac94675cae
SHA512 4781ab5643834af818785950ff876d44f3be03d08312a2792fdb939257c341925a7ce2024a45eb374b41798cd1fea318f93a6105f1672fcb9778163c221a6c75

C:\Users\Admin\AppData\Local\Temp\RES319A.tmp

MD5 52e12418bf2ae2d7d69d77c5953b9e78
SHA1 2b344064a73780c794f950e2bec48ad315edf896
SHA256 302d108b502dd6255061c0822bae01eb230f52c8274c30a8f71d033333525112
SHA512 6adb8ff2f81f25ccc12ce6c68310f4c66f26cdd3a729239448d353ded7a455561bec28e625f6d47006df5aaf9301f7179175b1561d8bbfc42a402488536de9a7

C:\ProgramData\5ha2hibk.exe

MD5 134f012757195ef52eb253201be7ff38
SHA1 12fb8b3f0cd1638f9f06e67fcc062e76fd4286d9
SHA256 570e693a8625978a46c7970009f328b395782089c0401f49e1482da07303f76b
SHA512 edb002183f061cf4ddb5d4a696b74908fa66b7e56233901d1a1d10f57f427044f3e84a5950ee2dc0f16f4ce6fbc33720d55484df5e47a52ba88f280fc5db3257

C:\Users\Admin\Documents\Restore-My-Files.txt

MD5 4619f9eed707de724ceb97b506d7b6fe
SHA1 6868619ecca7303fcbc9a3d440dddb7f50775e0a
SHA256 00e261865614395f37891df8baaf63c09bf2c67b99bbb7951f633824c95b0e52
SHA512 5a63a7e0393127414806a83a695e1d63bf97c376e2c43e410b46e4acca5ee1ea0bbcd30ac45e2f517550c9c20ed43d11960b41beae90bb4b3665548af6728b50

C:\Users\Admin\AppData\Local\Temp\info.hta

MD5 80bb4c4a3a988d7eab8240e85e07401f
SHA1 9424a3587e8b77866fd5dc598715a8569a0aedac
SHA256 f0922c59720b8590b821573435e08523734c3c17258adc280ed7b33bbcb75c7b
SHA512 6aab15dc2f69cefb6c23b6e123cce02cb22ccac79e94729f2c828a4ace56cf9c94878869c95ad6ab80cf3dd31f834c53f2230118a27ab035ab917c832e655f71

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-18 02:56

Reported

2024-10-18 02:59

Platform

win7-20240903-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Deletes shadow copies

ransomware defense_evasion impact execution

Disables Task Manager via registry modification

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.bat C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Michael Gillespie = "C:\\ProgramData\\winlogon.exe" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Michael Gillespie = "C:\\Windows\\winlogon.exe" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqwcfnl1.Loki" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21321_.GIF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBTRAP.DLL C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\settings.css C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\eo.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\WISC30.DLL C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01074_.WMF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00608_.WMF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105588.WMF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLINACC.DPV C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Urban.eftx C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18237_.WMF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382926.JPG C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR5B.GIF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\es-ES\Sidebar.exe.mui C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\3082\MSO.ACL C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\IPDSINTL.DLL C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01852_.WMF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGZIP.DPV C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\CT_ROOTS.XML C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00223_.WMF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\it-IT\TableTextService.dll.mui C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02361_.WMF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CGMIMP32.HLP C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\INVITE.DPV C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\picturePuzzle.js C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00437_.WMF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152556.WMF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00042_.WMF C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ast.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\Restore-My-Files.txt C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winlogon.exe C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
File opened for modification C:\Windows\winlogon.exe C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\vssadmin.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\WallpaperStyle = "2" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Loki\shell\open\command\ = "C:\\ProgramData\\z1fvzqe1.exe \"%l\" " C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Loki C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Loki\ = "Loki" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Loki\shell\open\command C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Loki C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Loki\shell C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Loki\shell\open C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2276 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 604 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 604 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 604 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 604 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2276 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2276 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2276 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2276 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1132 wrote to memory of 2952 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1132 wrote to memory of 2952 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1132 wrote to memory of 2952 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1132 wrote to memory of 2952 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2276 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2132 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2132 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2132 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2132 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2744 wrote to memory of 940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2744 wrote to memory of 940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2744 wrote to memory of 940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2288 wrote to memory of 1312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2288 wrote to memory of 1312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2288 wrote to memory of 1312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2288 wrote to memory of 1312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2060 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2060 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2060 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2060 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Encrypted by Loki locker" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your files have been encrypted due to a security problem with your computer\r\nIf you want to restore them, write us to the e-mail: [email protected]\r\nWrite this ID in the title of your message: DEC82EC4\r\nIn case of no answer in 24 hours write us to this e-mail: [email protected]" C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe

"C:\Users\Admin\AppData\Local\Temp\e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bkklml2u\bkklml2u.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB01D.tmp" "c:\ProgramData\CSCA8564EA948F8445EAA807B5911DE5E8E.TMP"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet

C:\Windows\SysWOW64\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\SysWOW64\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"

Network

Country Destination Domain Proto
US 8.8.8.8:53 loki-locker.one udp
US 34.70.133.246:80 loki-locker.one tcp
US 34.70.133.246:80 loki-locker.one tcp
US 34.70.133.246:80 loki-locker.one tcp

Files

memory/2276-0-0x00000000747EE000-0x00000000747EF000-memory.dmp

memory/2276-1-0x0000000001200000-0x0000000001288000-memory.dmp

memory/2276-2-0x00000000747E0000-0x0000000074ECE000-memory.dmp

C:\Users\Admin\Desktop\Cpriv.Loki

MD5 d420ce360228ea95b9fb80ede089fb63
SHA1 5b4e6f9a7e77708587b4db824d8a96977d425cd1
SHA256 d762fefcbd1e6906b6336509c871d7873cd5cad5fb32eefee233317f07ee4dbd
SHA512 afc58b9249f603b3f48cf25e3fe6d050c3d9d1a5bb5cc45916244c6aefa0f32d35ce6d76b13a1e53adc6a8f2d9f88f40679240b16fa759a94cb0763928ec3664

C:\ProgramData\winlogon.exe

MD5 d7d28006e0679b1f2ea0a87ba94f4af0
SHA1 675f7b9185ccc3241650ff2fd96f5e1a0bbf63ee
SHA256 e28b0a93649010788bbeda883a08254fefe3710700fc2c5a8dea94ec39402ec3
SHA512 b3f9257825850e4f2920d05f45eece26323d81d06a761fa2e5b2d154535d45f996a316e238f2d29fb82081a133dfd5ad304835317e65fa72f9fc2e1acbfce03a

\??\c:\Users\Admin\AppData\Local\Temp\bkklml2u\bkklml2u.cmdline

MD5 da32d83d7deb6222711162bfa352c686
SHA1 817380a84a7845606dce5f56114869bae3f26683
SHA256 804a3d16333aad6a1130cdcb37038aa9fc2ef8a82ccd682142daf8b220abad22
SHA512 88719dfe9720b747c94ef6dd024cf129c727d2f048ec9e9f6348eb06b992efd5d9d7a77c4e09870c3ae8ac71c7f71af92eb5d7665ea8041fd3ea781f91e3c36c

\??\c:\Users\Admin\AppData\Local\Temp\bkklml2u\bkklml2u.0.cs

MD5 367f1bb91576f965028702350adb0f41
SHA1 ed9b257229e29681d74489c6a4031d62cca0b707
SHA256 f646f16ea464b07a0514c1eebc8f3637caf5e9f7f4800e74d79d7ebe271848be
SHA512 b30ea2df60051d5835307febba64d364ae8c4439a6e14f3ec6abe9a442e5e3955963a1626dfb28517e3570e5188b4278cdd903eff6f9fdf957ded7ca0efb7c96

\??\c:\Users\Admin\AppData\Local\Temp\cslzjr1v.ico

MD5 dbc49b5f7714255217080c2e81f05a99
SHA1 4de2ef415d66d2bb8b389ba140a468b125388e19
SHA256 6d2f1f6164cbd331b9dc43b37948372e21b2ee45407aa99e199693835cded09c
SHA512 29a65eb7403bfc220fd057c2e6ea11b29bff545dfce2d3370ad462c66b03ae7f648efd480305423a49440de199a2a94c41214877b226a42dc2d1650683d149bb

\??\c:\ProgramData\CSCA8564EA948F8445EAA807B5911DE5E8E.TMP

MD5 85b4eedd9538a088879e8377faf5f005
SHA1 d29163688133d9c571dd2dce5c2b6dbc2d36bfa0
SHA256 6affe7f82f5cd2aff9e3ee8a27e39d679232cb92f2be52e87649a3d563eea3d6
SHA512 6c3aec7055331b11862f791e60623a064629b08a3a2d33a18becd15a790c8b7481b438ddbb0c3369157b7b4deeacd756cacf6fe310c0724d1dccd9f6ba47f9bd

C:\Users\Admin\AppData\Local\Temp\RESB01D.tmp

MD5 f494a0b5dfcda36abbaf74da6ff4556b
SHA1 d70b88648ba5621291c59108e3338b4bac0e33d8
SHA256 210ac4218da41134729fd9b1abd2004315cab62cfa7279dec50b5aa8384c2fba
SHA512 8152df2603969d27ec9accf091402475062449fd4373022a8b5c69ff968e964e3d639f71a69036bd0df70e73a85164d8cec5ed9766bb42c4ab7b34e68dfd0f98

C:\ProgramData\z1fvzqe1.exe

MD5 3a9cd8235f191454aefed23ce8f9e8cb
SHA1 f58b8f51666065a296206a1344c82c522cac2b8a
SHA256 f59f4c8140c0f2f5d24b5f63154b6b8f29d27bdaf1824f06d9bea01428bfb8ce
SHA512 4de7950023a75dcd6020937f4e18334f66dc8e1dec6ca43a7e044210e306204801b84341776633fd2efdfc3737c0b15cf59729c47fded8dde3913ea34c00dfc2

memory/2276-189-0x00000000747EE000-0x00000000747EF000-memory.dmp

C:\Users\Admin\Downloads\Restore-My-Files.txt

MD5 c0c4880253b7cb1e6f9481b057241a79
SHA1 81ae354ce1e3900ac2cd3127885930401786b079
SHA256 731792b5598d446dbc65d6c83200273eff2f510ad9e64863597e0175e8531d6b
SHA512 e3d4b0d6be946eac6ae3ae3cb7c235760ac65c656112b6feb02b6ede3b5520f917f38e0761d1b705a32aa74f4caa3bc539128b25a8d90622a5b0f70731deb755

memory/2276-604-0x00000000747E0000-0x0000000074ECE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\info.hta

MD5 0736088cc01aede2a20d6b07e6569618
SHA1 c4db66300cc98bf61e71b4020e3bcab5f0b4312b
SHA256 ab5df89adf589db0987901e765588fa194615a0f8689fb3538e4fb06cf0baf4f
SHA512 ff920b835e6497c039a43f31305c9c6a1176ae57c9e965deab18b4c48aa006dccb08ab802a962a03227a3555bdcf411f35a853a6807f34059ebc317bbe1535df