clop | 4c659f57dcbdbcffb9c0d0d06b2d02a74ee2d306c52300a3892e4418c0d1c863

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty"	HEUR-Trojan-Ransom.MSIL.Encoder.gen-84c06f4b2fd1ebc6a931f112520fb13300f3b36c45cacb956f6045e6f388e5fb.exe

Modiloader family
modiloader
clop
Ransomware discovered in early 2019 which has been actively developed since release.
ransomware clop

Clears Windows event logs 1 TTPs 64 IoCs

evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
7192	wevtutil.exe
7752	wevtutil.exe
8080	wevtutil.exe
4892	wevtutil.exe
4892	wevtutil.exe
7236	wevtutil.exe
7920	wevtutil.exe
7872	wevtutil.exe
15412	wevtutil.exe
8708	wevtutil.exe
8252	wevtutil.exe
5920	wevtutil.exe
7128	wevtutil.exe
7192	wevtutil.exe
7356	wevtutil.exe
9656	wevtutil.exe
9160	wevtutil.exe
6640	wevtutil.exe
6320	wevtutil.exe
7344	wevtutil.exe
8120	wevtutil.exe
4000	wevtutil.exe
5400	wevtutil.exe
7460	wevtutil.exe
9860	wevtutil.exe
5288	wevtutil.exe
8540	wevtutil.exe
9328	wevtutil.exe
6528	wevtutil.exe
5564	wevtutil.exe
6892	wevtutil.exe
8840	wevtutil.exe
11408	wevtutil.exe
7120	wevtutil.exe
2940	wevtutil.exe
5740	wevtutil.exe
5208	wevtutil.exe
11292	wevtutil.exe
6484	wevtutil.exe
9500	wevtutil.exe
9932	wevtutil.exe
8340	wevtutil.exe
8804	wevtutil.exe
5740	wevtutil.exe
6828	wevtutil.exe
8300	wevtutil.exe
7120	wevtutil.exe
7676	wevtutil.exe
17240	wevtutil.exe
7156	wevtutil.exe
5460	wevtutil.exe
6296	wevtutil.exe
12804	wevtutil.exe
5844	wevtutil.exe
7636	wevtutil.exe
9200	wevtutil.exe
7584	wevtutil.exe
7472	wevtutil.exe
8332	wevtutil.exe
9476	wevtutil.exe
6512	wevtutil.exe
5516	wevtutil.exe
6480	wevtutil.exe
8020	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	HEUR-Trojan-Ransom.Win32.Blocker.gen-91010c517fd39ec1273ca6d4dc8143e3cacead93d9a897e73ab1c2c62565544c.exe

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b9c-317.dat	modiloader_stage2

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

pid	Process
13892	bcdedit.exe
1320	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
11368	wbadmin.exe

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
10708	netsh.exe
1464	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HEUR-Trojan-Ransom.Win32.Blocker.gen-91010c517fd39ec1273ca6d4dc8143e3cacead93d9a897e73ab1c2c62565544c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	HEUR-Trojan-Ransom.Win32.Blocker.gen-91010c517fd39ec1273ca6d4dc8143e3cacead93d9a897e73ab1c2c62565544c.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 13 IoCs

pid	Process
4444	HEUR-Trojan-Ransom.MSIL.Agent.gen-4bf8dae17c6df636b4a077e4cfb9f19944de098e0ea552c8cdd582437824d5ba.exe
3260	HEUR-Trojan-Ransom.MSIL.Blocker.gen-f736e177111036ad57bcc6df830b5c4b03b0356623a30006fea1edd6b4a026c1.exe
4744	HEUR-Trojan-Ransom.MSIL.Encoder.gen-84c06f4b2fd1ebc6a931f112520fb13300f3b36c45cacb956f6045e6f388e5fb.exe
612	HEUR-Trojan-Ransom.MSIL.Foreign.gen-5dcb736bf556729b30654fe97da034c1ccd7471f7587cb82dc33f4aef2248b9c.exe
1592	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe
2448	HEUR-Trojan-Ransom.Win32.Blocker.gen-91010c517fd39ec1273ca6d4dc8143e3cacead93d9a897e73ab1c2c62565544c.exe
4056	HEUR-Trojan-Ransom.Win32.Conti.gen-f7b83f07f6fec1df0fa73c935c96dc2ec8fbe0de3b17bb56f9963c92c22715c3.exe
1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe
1600	HEUR-Trojan-Ransom.Win32.Encoder.gen-ac978f6aaf36d1d90c35e6dc7ae010a19082794d3391ea0111112aed7507f708.exe
2424	HEUR-Trojan-Ransom.Win32.Encoder.gen-e395e96b17910ca97a5e2246829ff18d5c617b3cf8f9fe1672da6d580ece3e61.exe
1480	HEUR-Trojan-Ransom.Win32.Encoder.gen-ea72ff69831e59139d6fc341f6274e738351f539db20ac0c7d461cddea440245.exe
2444	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-517b9d1b3a1f758db6c45fd6d3b6d508c5e26690e7391f23798151d81db471f6.exe
2028	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	HEUR-Trojan-Ransom.Win32.Blocker.gen-91010c517fd39ec1273ca6d4dc8143e3cacead93d9a897e73ab1c2c62565544c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\open = "\"C:\\ReadMe.hta\""	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
61	api.ipify.org

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\Wallpaper	HEUR-Trojan-Ransom.MSIL.Encoder.gen-84c06f4b2fd1ebc6a931f112520fb13300f3b36c45cacb956f6045e6f388e5fb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1892 set thread context of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1592-133-0x0000000140000000-0x00000001402F7000-memory.dmp	upx
behavioral1/files/0x000a000000023b8f-129.dat	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\windows\utox.exe	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe
File created	C:\Windows\pghdn.txt	svchost.exe
File created	C:\Windows\rwjfk.bat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4444	2444	WerFault.exe	121
8296	4080	WerFault.exe	333
10984	4080	WerFault.exe	333

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Blocker.gen-91010c517fd39ec1273ca6d4dc8143e3cacead93d9a897e73ab1c2c62565544c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Conti.gen-f7b83f07f6fec1df0fa73c935c96dc2ec8fbe0de3b17bb56f9963c92c22715c3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Encoder.gen-ac978f6aaf36d1d90c35e6dc7ae010a19082794d3391ea0111112aed7507f708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Encoder.gen-e395e96b17910ca97a5e2246829ff18d5c617b3cf8f9fe1672da6d580ece3e61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-517b9d1b3a1f758db6c45fd6d3b6d508c5e26690e7391f23798151d81db471f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Encoder.gen-ea72ff69831e59139d6fc341f6274e738351f539db20ac0c7d461cddea440245.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
12348	vssadmin.exe
1700	vssadmin.exe
3676	vssadmin.exe

Kills process with taskkill 41 IoCs

pid	Process
852	taskkill.exe
6408	taskkill.exe
12236	taskkill.exe
9928	taskkill.exe
11336	taskkill.exe
10940	taskkill.exe
10848	taskkill.exe
3756	taskkill.exe
11464	taskkill.exe
5708	taskkill.exe
10124	taskkill.exe
12912	taskkill.exe
13176	taskkill.exe
11504	taskkill.exe
12740	taskkill.exe
12380	taskkill.exe
6680	taskkill.exe
10096	taskkill.exe
11076	taskkill.exe
11632	taskkill.exe
5680	taskkill.exe
9304	taskkill.exe
1304	taskkill.exe
4152	taskkill.exe
628	taskkill.exe
9424	taskkill.exe
7272	taskkill.exe
9540	taskkill.exe
8828	taskkill.exe
6416	taskkill.exe
8048	taskkill.exe
9904	taskkill.exe
11588	taskkill.exe
11468	taskkill.exe
8624	taskkill.exe
11772	taskkill.exe
12076	taskkill.exe
10852	taskkill.exe
7600	taskkill.exe
13228	taskkill.exe
11380	taskkill.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell\open\command	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell\open	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell\open\command\en = 0602000000a400005253413100080000010001000d82427af99fcd1aabfc421815cc77ce4a7516e3b4fe5ff493f376b8253ec63ed88e95ef1f06a042d3829d4d3b4fbd957791630f64140021004b5f40d55ed6a5c46af83da932a3ae4913d8a21cd28fcb2ba33796738c65da60b62b38cbd7bfbbab49bfb4ef1d9cbe6219f1f86c8323e09049ce071eb87a94c33e2ac5a72931e9efe08d0a9d14150ddd7cceedbac8d02b98ace13e00ca06c0b8697747187543943ecef01824a28039a6a9d7f3c88080df4535ac241ad0e2b53bb9c5d0fe51b3fe0300012a21b4e50f6f8db40f4784032834b91a1ef574c0137b2a63a19554472a6c3165e4866840ac8119429d0c53d2cea06e157d2e5e80944c5a1e438fabf5e6	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell\open\command\n = 027608aea52fbb9fd963014ed97bd936adac5bea4f42626fb223b497d93b7f3482b90e563e61964ec13ca7ad829323c382dbb9e478017b59b3e2a48e1a013a7e649415f8e1fbb0317d8011b322f4fe92ded4f5404449cc5ac195fa53fe1ced6b36ccdaddb612e0910883f57eb8146e6f4fa9466fa21011b9fd99ecda036718013899cd890b61dc684b708824bea1d0b9578c6b01595fb98b53b40db0431482ccd07d96a8d86c5c09f8c797744f0b2b0608dce9e7d777c22a338d66c35135bb8eed4891aab8d4971601cf8d92df0ff06ec26f398cf3231b3e12f293769c38670fc853155637bde1fe4c9f552b23dcaf8f7989dda42531df10dfb1ee1f7af4e2b44c560bdd6bb6130bb2731bed74444903224ddd24b4d6ff724a513c68bbeb2a1df6b699acad2aa9897400faa1d91318356970d8f4fbbc78c8dd84220d314133ba7d4ea0ec4aa22dbc6abf8db59875dfa35a6ab2325467bbaf6f28aaa1d5028fdc712020ed220d9f4abbe58c8172ff101724da462d942cfb6953ece75af9a027f82a792763c3209d37d05c9b4e1f1449ee4b1d2365708d2573ad31a771e726ecaf022692809177b16367312821c52653dacf3c1a8da7e7209e935d7b04d52944cd1bab9c9d6544b51eb7fef3397d056440554d83581c0ec69a75d55db1e2bbfadf28b22d0a5598a96497046cb83b00e6577602963078ba03875fcc6330ff4d039b304ba2cf3eee6f90f348eac26114c53ac13442ebef08035cbbe596b9234435ce19f178e1869db7cb9e5715e4b7c31795589f0a44ac4d6d14c7dd613f9a7aee1dad94235be9077f63591cb5f18143c6151fe5b56a849a83cc1e221b219fc6c3316b33cd887ae251d41758ba35752f5ab529608ccbbe481d3c876c21ab08f8bc5d701b71b9b76e81159f4d7e7e5f1370e14f50e24ed82fcb60e5a32046bdd26f2cff5b82a6aeec100cd8b16cba91952f5be695e75443340881d4c60a1d6c3629e7d4cbe223bda21ecf0d0b4cb2341aae6d137223d6828411313806871ccc69b27ff9da3c578dadfeec98034d17bd3a3f1b217886fa7e6d9d14dcc04167c731f1b7abcf24aa6709e9b38ab8d4d607c31378d442bf4a7f7f58da8255d0f565ec21bbd54084e0187e9aabf04e69d63086eced6d5e223b1a9ab9bbb76ab916aee26488bf8d8fc27ad4a00eabb3e973bf5dfcd08552e26f9b2f785c0689586a89ef03cce010b218e3034bdf0ec92ce086859bdde94d5cd8d3a6c165e31dabedf5872a67482c7120ff4c88c52bdccfaa387cb272a6208383c5a81ccd7dbaf63dc5ee2e106f52f2a85a208c1941a18140bdf1357ca930a4709c647b9025908101835b206ccf65ef33e983f5a083b9787e580d44005f51d4ef7429743ada882aa34e6ab8ac8bda4ed3f392d57a4e2bbd7aa4a129fd39d2c6e1c7e28ef31c0ce05c75921b2baacdf965dd3bc1d933fcb3be5c5e525ba974bbfeaec461451a5b65517b9e4e518bc69a84de0b42952407041395cb643feb40e3bcc41e9d48034c1b9a1aef32037a1efc0d2527f276157a982ae1f08ae1c1705b1b3a4aeb3ed5228630db1faac2febdd4b23e7801bbc5dd3cf647b9088489c476de0a9367d052b12e1138f975c6436945ce8f084ab0f2cc5c31c2d956051ee19ad5b8e40aa99ac18d4d46c07eb32b4e7bb8185bc29d3bd2c78eeeee5981483281dbcc183faca0ebd0723bc275868d8586f5c76a3fcd1f8f1b37b49f9bb0c68e54e30acd78be1f0b846276ec9436ae9a70f1c9c914c2d8a048fc29d119299d98d53c01662c95778f6b3a987a0283	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell\open\command\ = "C:\\Windows\\System32\\mshta.exe \"C:\\ReadMe.hta\""	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3844	7zFM.exe
4492	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeRestorePrivilege	3844	7zFM.exe
Token: 35	3844	7zFM.exe
Token: SeSecurityPrivilege	3844	7zFM.exe
Token: SeDebugPrivilege	4152	taskmgr.exe
Token: SeSystemProfilePrivilege	4152	taskmgr.exe
Token: SeCreateGlobalPrivilege	4152	taskmgr.exe
Token: SeDebugPrivilege	4492	taskmgr.exe
Token: SeSystemProfilePrivilege	4492	taskmgr.exe
Token: SeCreateGlobalPrivilege	4492	taskmgr.exe
Token: 33	4152	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4152	taskmgr.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	1592	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe
Token: SeDebugPrivilege	788	svchost.exe
Token: SeDebugPrivilege	4744	HEUR-Trojan-Ransom.MSIL.Encoder.gen-84c06f4b2fd1ebc6a931f112520fb13300f3b36c45cacb956f6045e6f388e5fb.exe
Token: SeDebugPrivilege	3260	HEUR-Trojan-Ransom.MSIL.Blocker.gen-f736e177111036ad57bcc6df830b5c4b03b0356623a30006fea1edd6b4a026c1.exe
Token: SeBackupPrivilege	3100	vssvc.exe
Token: SeRestorePrivilege	3100	vssvc.exe
Token: SeAuditPrivilege	3100	vssvc.exe
Token: SeDebugPrivilege	1600	HEUR-Trojan-Ransom.Win32.Encoder.gen-ac978f6aaf36d1d90c35e6dc7ae010a19082794d3391ea0111112aed7507f708.exe
Token: SeIncreaseQuotaPrivilege	2228	WMIC.exe
Token: SeSecurityPrivilege	2228	WMIC.exe
Token: SeTakeOwnershipPrivilege	2228	WMIC.exe
Token: SeLoadDriverPrivilege	2228	WMIC.exe
Token: SeSystemProfilePrivilege	2228	WMIC.exe
Token: SeSystemtimePrivilege	2228	WMIC.exe
Token: SeProfSingleProcessPrivilege	2228	WMIC.exe
Token: SeIncBasePriorityPrivilege	2228	WMIC.exe
Token: SeCreatePagefilePrivilege	2228	WMIC.exe
Token: SeBackupPrivilege	2228	WMIC.exe
Token: SeRestorePrivilege	2228	WMIC.exe
Token: SeShutdownPrivilege	2228	WMIC.exe
Token: SeDebugPrivilege	2228	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2228	WMIC.exe
Token: SeRemoteShutdownPrivilege	2228	WMIC.exe
Token: SeUndockPrivilege	2228	WMIC.exe
Token: SeManageVolumePrivilege	2228	WMIC.exe
Token: 33	2228	WMIC.exe
Token: 34	2228	WMIC.exe
Token: 35	2228	WMIC.exe
Token: 36	2228	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2228	WMIC.exe
Token: SeSecurityPrivilege	2228	WMIC.exe
Token: SeTakeOwnershipPrivilege	2228	WMIC.exe
Token: SeLoadDriverPrivilege	2228	WMIC.exe
Token: SeSystemProfilePrivilege	2228	WMIC.exe
Token: SeSystemtimePrivilege	2228	WMIC.exe
Token: SeProfSingleProcessPrivilege	2228	WMIC.exe
Token: SeIncBasePriorityPrivilege	2228	WMIC.exe
Token: SeCreatePagefilePrivilege	2228	WMIC.exe
Token: SeBackupPrivilege	2228	WMIC.exe
Token: SeRestorePrivilege	2228	WMIC.exe
Token: SeShutdownPrivilege	2228	WMIC.exe
Token: SeDebugPrivilege	2228	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2228	WMIC.exe
Token: SeRemoteShutdownPrivilege	2228	WMIC.exe
Token: SeUndockPrivilege	2228	WMIC.exe
Token: SeManageVolumePrivilege	2228	WMIC.exe
Token: 33	2228	WMIC.exe
Token: 34	2228	WMIC.exe
Token: 35	2228	WMIC.exe
Token: 36	2228	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3844	7zFM.exe
3844	7zFM.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4152	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe
4492	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1480	HEUR-Trojan-Ransom.Win32.Encoder.gen-ea72ff69831e59139d6fc341f6274e738351f539db20ac0c7d461cddea440245.exe
1480	HEUR-Trojan-Ransom.Win32.Encoder.gen-ea72ff69831e59139d6fc341f6274e738351f539db20ac0c7d461cddea440245.exe
468	cmd.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 4492	4152	taskmgr.exe	97
PID 4152 wrote to memory of 4492	4152	taskmgr.exe	97
PID 2044 wrote to memory of 468	2044	powershell.exe	103
PID 2044 wrote to memory of 468	2044	powershell.exe	103
PID 468 wrote to memory of 4444	468	cmd.exe	104
PID 468 wrote to memory of 4444	468	cmd.exe	104
PID 468 wrote to memory of 3260	468	cmd.exe	105
PID 468 wrote to memory of 3260	468	cmd.exe	105
PID 468 wrote to memory of 4744	468	cmd.exe	106
PID 468 wrote to memory of 4744	468	cmd.exe	106
PID 468 wrote to memory of 612	468	cmd.exe	107
PID 468 wrote to memory of 612	468	cmd.exe	107
PID 468 wrote to memory of 1592	468	cmd.exe	108
PID 468 wrote to memory of 1592	468	cmd.exe	108
PID 468 wrote to memory of 2448	468	cmd.exe	109
PID 468 wrote to memory of 2448	468	cmd.exe	109
PID 468 wrote to memory of 2448	468	cmd.exe	109
PID 1592 wrote to memory of 788	1592	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe	10
PID 1592 wrote to memory of 788	1592	HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe	10
PID 468 wrote to memory of 4056	468	cmd.exe	110
PID 468 wrote to memory of 4056	468	cmd.exe	110
PID 468 wrote to memory of 4056	468	cmd.exe	110
PID 468 wrote to memory of 1892	468	cmd.exe	112
PID 468 wrote to memory of 1892	468	cmd.exe	112
PID 468 wrote to memory of 1892	468	cmd.exe	112
PID 4056 wrote to memory of 4172	4056	HEUR-Trojan-Ransom.Win32.Conti.gen-f7b83f07f6fec1df0fa73c935c96dc2ec8fbe0de3b17bb56f9963c92c22715c3.exe	114
PID 4056 wrote to memory of 4172	4056	HEUR-Trojan-Ransom.Win32.Conti.gen-f7b83f07f6fec1df0fa73c935c96dc2ec8fbe0de3b17bb56f9963c92c22715c3.exe	114
PID 788 wrote to memory of 1432	788	svchost.exe	116
PID 788 wrote to memory of 1432	788	svchost.exe	116
PID 468 wrote to memory of 1600	468	cmd.exe	117
PID 468 wrote to memory of 1600	468	cmd.exe	117
PID 468 wrote to memory of 1600	468	cmd.exe	117
PID 4172 wrote to memory of 2228	4172	cmd.exe	118
PID 4172 wrote to memory of 2228	4172	cmd.exe	118
PID 468 wrote to memory of 2424	468	cmd.exe	119
PID 468 wrote to memory of 2424	468	cmd.exe	119
PID 468 wrote to memory of 2424	468	cmd.exe	119
PID 468 wrote to memory of 1480	468	cmd.exe	120
PID 468 wrote to memory of 1480	468	cmd.exe	120
PID 468 wrote to memory of 1480	468	cmd.exe	120
PID 468 wrote to memory of 2444	468	cmd.exe	121
PID 468 wrote to memory of 2444	468	cmd.exe	121
PID 468 wrote to memory of 2444	468	cmd.exe	121
PID 2424 wrote to memory of 4392	2424	HEUR-Trojan-Ransom.Win32.Encoder.gen-e395e96b17910ca97a5e2246829ff18d5c617b3cf8f9fe1672da6d580ece3e61.exe	125
PID 2424 wrote to memory of 4392	2424	HEUR-Trojan-Ransom.Win32.Encoder.gen-e395e96b17910ca97a5e2246829ff18d5c617b3cf8f9fe1672da6d580ece3e61.exe	125
PID 2424 wrote to memory of 4392	2424	HEUR-Trojan-Ransom.Win32.Encoder.gen-e395e96b17910ca97a5e2246829ff18d5c617b3cf8f9fe1672da6d580ece3e61.exe	125
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 1892 wrote to memory of 2028	1892	HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe	126
PID 788 wrote to memory of 1592	788	svchost.exe	127
PID 788 wrote to memory of 1592	788	svchost.exe	127
PID 788 wrote to memory of 408	788	svchost.exe	14

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:1432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\rwjfk.bat" "
  2⤵
  PID:1592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wevtutil.exe el
    3⤵
    PID:4768
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe el
      4⤵
      PID:5160
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "AMSI/Debug"
    3⤵
    - Clears Windows event logs
    PID:5564
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "AirSpaceChannel"
    3⤵
    - Clears Windows event logs
    PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Analytic"
    3⤵
    - Clears Windows event logs
    PID:5920
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Application"
    3⤵
    PID:6064
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "DirectShowFilterGraph"
    3⤵
    PID:5264
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "DirectShowPluginControl"
    3⤵
    PID:5468
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Els_Hyphenation/Analytic"
    3⤵
    - Clears Windows event logs
    PID:5516
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "EndpointMapper"
    3⤵
    - Clears Windows event logs
    PID:5844
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "FirstUXPerf-Analytic"
    3⤵
    - Clears Windows event logs
    PID:6480
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "ForwardedEvents"
    3⤵
    PID:6548
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "General Logging"
    3⤵
    PID:6732
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "HardwareEvents"
    3⤵
    PID:6812
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "IHM_DebugChannel"
    3⤵
    - Clears Windows event logs
    PID:6892
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
    3⤵
    PID:6936
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
    3⤵
    PID:6984
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
    3⤵
    - Clears Windows event logs
    PID:7156
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
    3⤵
    - Clears Windows event logs
    PID:6484
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"
    3⤵
    PID:6816
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"
    3⤵
    - Clears Windows event logs
    PID:7128
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Internet Explorer"
    3⤵
    - Clears Windows event logs
    PID:6320
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Key Management Service"
    3⤵
    - Clears Windows event logs
    PID:6828
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MF_MediaFoundationDeviceMFT"
    3⤵
    - Clears Windows event logs
    PID:7120
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MF_MediaFoundationDeviceProxy"
    3⤵
    - Clears Windows event logs
    PID:7192
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MF_MediaFoundationFrameServer"
    3⤵
    - Clears Windows event logs
    PID:7236
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MedaFoundationVideoProc"
    3⤵
    PID:7288
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MedaFoundationVideoProcD3D"
    3⤵
    - Clears Windows event logs
    PID:7344
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationAsyncWrapper"
    3⤵
    PID:7400
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationContentProtection"
    3⤵
    - Clears Windows event logs
    PID:7460
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationDS"
    3⤵
    PID:7548
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationDeviceProxy"
    3⤵
    - Clears Windows event logs
    PID:7636
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationMP4"
    3⤵
    PID:7744
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationMediaEngine"
    3⤵
    PID:7844
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPerformance"
    3⤵
    - Clears Windows event logs
    PID:7920
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPerformanceCore"
    3⤵
    - Clears Windows event logs
    PID:8020
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPipeline"
    3⤵
    - Clears Windows event logs
    PID:8120
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPlatform"
    3⤵
    PID:7424
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationSrcPrefetch"
    3⤵
    - Clears Windows event logs
    PID:7584
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client-Streamingux/Debug"
    3⤵
    PID:7668
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Admin"
    3⤵
    - Clears Windows event logs
    PID:7872
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Debug"
    3⤵
    PID:8164
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Operational"
    3⤵
    - Clears Windows event logs
    PID:7192
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Virtual Applications"
    3⤵
    PID:7856
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-SharedPerformance/Analytic"
    3⤵
    - Clears Windows event logs
    PID:7752
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Admin"
    3⤵
    PID:7236
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Debug"
    3⤵
    - Clears Windows event logs
    PID:8840
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Diagnostic"
    3⤵
    PID:8948
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-IE/Diagnostic"
    3⤵
    PID:9072
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:9200
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:8080
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-OneCore-Setup/Analytic"
    3⤵
    - Clears Windows event logs
    PID:8300
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:8540
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:8708
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-Admin/Debug"
    3⤵
    - Clears Windows event logs
    PID:7472
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
    3⤵
    - Clears Windows event logs
    PID:8252
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
    3⤵
    - Clears Windows event logs
    PID:8340
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
    3⤵
    - Clears Windows event logs
    PID:9500
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Debug"
    3⤵
    - Clears Windows event logs
    PID:9860
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Operational"
    3⤵
    - Clears Windows event logs
    PID:9932
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-IPC/Operational"
    3⤵
    - Clears Windows event logs
    PID:8332
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
    3⤵
    - Clears Windows event logs
    PID:9328
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
    3⤵
    - Clears Windows event logs
    PID:4892
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
    3⤵
    - Clears Windows event logs
    PID:2940
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AAD/Analytic"
    3⤵
    PID:3524
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AAD/Operational"
    3⤵
    PID:5204
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ADSI/Debug"
    3⤵
    - Clears Windows event logs
    PID:5288
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ASN1/Operational"
    3⤵
    - Clears Windows event logs
    PID:5460
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ATAPort/General"
    3⤵
    PID:5620
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"
    3⤵
    - Clears Windows event logs
    PID:6296
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"
    3⤵
    - Clears Windows event logs
    PID:7356
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-All-User-Install-Agent/Admin"
    3⤵
    - Clears Windows event logs
    PID:9476
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AllJoyn/Debug"
    3⤵
    - Clears Windows event logs
    PID:4892
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AllJoyn/Operational"
    3⤵
    - Clears Windows event logs
    PID:6512
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/Admin"
    3⤵
    - Clears Windows event logs
    PID:8804
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/ApplicationTracing"
    3⤵
    PID:10052
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5208
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/Internal"
    3⤵
    - Clears Windows event logs
    PID:7120
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppID/Operational"
    3⤵
    PID:9896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"
    3⤵
    - Clears Windows event logs
    PID:6528
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"
    3⤵
    - Clears Windows event logs
    PID:7676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
    3⤵
    - Clears Windows event logs
    PID:9656
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
    3⤵
    - Clears Windows event logs
    PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Admin"
    3⤵
    PID:908
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Analytic"
    3⤵
    - Clears Windows event logs
    PID:9160
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Debug"
    3⤵
    PID:5912
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"
    3⤵
    PID:5552
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-State/Debug"
    3⤵
    - Clears Windows event logs
    PID:12804
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-State/Diagnostic"
    3⤵
    PID:6052
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppReadiness/Admin"
    3⤵
    PID:11448
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppReadiness/Debug"
    3⤵
    PID:10476
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppReadiness/Operational"
    3⤵
    - Clears Windows event logs
    PID:6640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppSruProv"
    3⤵
    - Clears Windows event logs
    PID:4000
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:11408
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Operational"
    3⤵
    - Clears Windows event logs
    PID:11292
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Debug"
    3⤵
    PID:11684
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:17240
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Operational"
    3⤵
    PID:6696
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Restricted"
    3⤵
    - Clears Windows event logs
    PID:5400
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Analytic"
    3⤵
    PID:13436
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Operational"
    3⤵
    PID:3652
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"
    3⤵
    - Clears Windows event logs
    PID:15412
- C:\Windows\system32\OpenWith.exe
  C:\Windows\system32\OpenWith.exe -Embedding
  2⤵
  PID:5580
- C:\Windows\System32\rundll32.exe
  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
  2⤵
  PID:3916
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
  2⤵
  PID:10176
- C:\Windows\System32\rundll32.exe
  C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
  2⤵
  PID:10836
- C:\Windows\System32\rundll32.exe
  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
  2⤵
  PID:15760
- C:\Windows\System32\vdsldr.exe
  C:\Windows\System32\vdsldr.exe -Embedding
  2⤵
  PID:16304
- C:\Windows\System32\rundll32.exe
  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
  2⤵
  PID:8940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:408

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00430.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3844

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /1
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4492
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:13824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.MSIL.Agent.gen-4bf8dae17c6df636b4a077e4cfb9f19944de098e0ea552c8cdd582437824d5ba.exe
    HEUR-Trojan-Ransom.MSIL.Agent.gen-4bf8dae17c6df636b4a077e4cfb9f19944de098e0ea552c8cdd582437824d5ba.exe
    3⤵
    - Executes dropped EXE
    PID:4444
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.MSIL.Blocker.gen-f736e177111036ad57bcc6df830b5c4b03b0356623a30006fea1edd6b4a026c1.exe
    HEUR-Trojan-Ransom.MSIL.Blocker.gen-f736e177111036ad57bcc6df830b5c4b03b0356623a30006fea1edd6b4a026c1.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.MSIL.Encoder.gen-84c06f4b2fd1ebc6a931f112520fb13300f3b36c45cacb956f6045e6f388e5fb.exe
    HEUR-Trojan-Ransom.MSIL.Encoder.gen-84c06f4b2fd1ebc6a931f112520fb13300f3b36c45cacb956f6045e6f388e5fb.exe
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.MSIL.Foreign.gen-5dcb736bf556729b30654fe97da034c1ccd7471f7587cb82dc33f4aef2248b9c.exe
    HEUR-Trojan-Ransom.MSIL.Foreign.gen-5dcb736bf556729b30654fe97da034c1ccd7471f7587cb82dc33f4aef2248b9c.exe
    3⤵
    - Executes dropped EXE
    PID:612
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe
    HEUR-Trojan-Ransom.Win32.Agent.vho-32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1592
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.Win32.Blocker.gen-91010c517fd39ec1273ca6d4dc8143e3cacead93d9a897e73ab1c2c62565544c.exe
    HEUR-Trojan-Ransom.Win32.Blocker.gen-91010c517fd39ec1273ca6d4dc8143e3cacead93d9a897e73ab1c2c62565544c.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - System Location Discovery: System Language Discovery
    PID:2448
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.Win32.Conti.gen-f7b83f07f6fec1df0fa73c935c96dc2ec8fbe0de3b17bb56f9963c92c22715c3.exe
    HEUR-Trojan-Ransom.Win32.Conti.gen-f7b83f07f6fec1df0fa73c935c96dc2ec8fbe0de3b17bb56f9963c92c22715c3.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{59C6D001-2A1D-495D-B41C-13CF70E22926}'" delete
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4172
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{59C6D001-2A1D-495D-B41C-13CF70E22926}'" delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe
    HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe
      HEUR-Trojan-Ransom.Win32.Crypmod.gen-45ed95c173fd2df5f05f42c2121698db4484f032344c874e552cf1592d2a88ca.exe
      4⤵
      Executes dropped EXE
      PID:2028
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.Win32.Encoder.gen-ac978f6aaf36d1d90c35e6dc7ae010a19082794d3391ea0111112aed7507f708.exe
    HEUR-Trojan-Ransom.Win32.Encoder.gen-ac978f6aaf36d1d90c35e6dc7ae010a19082794d3391ea0111112aed7507f708.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.Win32.Encoder.gen-e395e96b17910ca97a5e2246829ff18d5c617b3cf8f9fe1672da6d580ece3e61.exe
    HEUR-Trojan-Ransom.Win32.Encoder.gen-e395e96b17910ca97a5e2246829ff18d5c617b3cf8f9fe1672da6d580ece3e61.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\SysWOW64\grpconv.exe
      C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.Win32.Encoder.gen-e395e96b17910ca97a5e2246829ff18d5c617b3cf8f9fe1672da6d580ece3e61.exe
      4⤵
      PID:4392
    - - C:\Windows\SysWOW64\iexpress.exe
        
        /cfg "C:\Users\Admin\AppData\Local\Temp\880B.tmp" /crypt "*"
        5⤵
        
        PID:5868
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.Win32.Encoder.gen-ea72ff69831e59139d6fc341f6274e738351f539db20ac0c7d461cddea440245.exe
    HEUR-Trojan-Ransom.Win32.Encoder.gen-ea72ff69831e59139d6fc341f6274e738351f539db20ac0c7d461cddea440245.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1480
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-517b9d1b3a1f758db6c45fd6d3b6d508c5e26690e7391f23798151d81db471f6.exe
    HEUR-Trojan-Ransom.Win32.GandCrypt.gen-517b9d1b3a1f758db6c45fd6d3b6d508c5e26690e7391f23798151d81db471f6.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 484
      4⤵
      Program crash
      PID:4444
- - C:\Users\Admin\Desktop\00430\HEUR-Trojan-Ransom.Win32.Generic-4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    HEUR-Trojan-Ransom.Win32.Generic-4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    3⤵
    PID:7788
- - C:\Users\Admin\Desktop\00430\Trojan-Ransom.Win32.Agent.aztk-430039aeee4362784600b6b6994b72395c2666aa6d1ad30e6cbf1ed89ecbeaa9.exe
    Trojan-Ransom.Win32.Agent.aztk-430039aeee4362784600b6b6994b72395c2666aa6d1ad30e6cbf1ed89ecbeaa9.exe
    3⤵
    PID:1504
  - - C:\Windows\SysWOW64\mode.com
      mode con cp select=125 vssadmin delete shadows /all
      4⤵
      PID:1492
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im msaccess.exe
      4⤵
      Kills process with taskkill
      PID:5680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im sqlagent.exe
      4⤵
      Kills process with taskkill
      PID:10852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im mspub.exe
      4⤵
      Kills process with taskkill
      PID:12076
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im ocssd.exe
      4⤵
      Kills process with taskkill
      PID:11588
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im tbirdconfig.exe
      4⤵
      Kills process with taskkill
      PID:6680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im sqlbrowser.exe
      4⤵
      Kills process with taskkill
      PID:10940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im mydesktopqos.exe
      4⤵
      Kills process with taskkill
      PID:13176
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im dbsnmp.exe
      4⤵
      Kills process with taskkill
      PID:11772
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im thebat64.exe
      4⤵
      Kills process with taskkill
      PID:12912
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im thunderdird.exe
      4⤵
      Kills process with taskkill
      PID:9904
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im sqbcoreservice.exe
      4⤵
      Kills process with taskkill
      PID:12380
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im encsvc.exe
      4⤵
      Kills process with taskkill
      PID:7600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im winword.exe
      4⤵
      Kills process with taskkill
      PID:628
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im dbeng50.exe
      4⤵
      Kills process with taskkill
      PID:11336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im ocomm.exe
      4⤵
      Kills process with taskkill
      PID:9928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im ocautoupds.exe
      4⤵
      Kills process with taskkill
      PID:10124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im visio.exe
      4⤵
      Kills process with taskkill
      PID:11468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im firefoxconfig.exe
      4⤵
      Kills process with taskkill
      PID:9304
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im sqlservr.exe
      4⤵
      Kills process with taskkill
      PID:11632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im infopath.exe
      4⤵
      Kills process with taskkill
      PID:12740
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im thebat.exe
      4⤵
      Kills process with taskkill
      PID:9540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im excel.exe
      4⤵
      Kills process with taskkill
      PID:8048
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im outlook.exe
      4⤵
      Kills process with taskkill
      PID:11076
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im mysqld.exe
      4⤵
      Kills process with taskkill
      PID:12236
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im notepad.exe
      4⤵
      Kills process with taskkill
      PID:5708
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im sqlserver.exe
      4⤵
      Kills process with taskkill
      PID:6416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im powerpnt.exe
      4⤵
      Kills process with taskkill
      PID:11380
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im msftesql.exe
      4⤵
      Kills process with taskkill
      PID:6408
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im xfsssvccon.exe
      4⤵
      Kills process with taskkill
      PID:7272
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im onenote.exe
      4⤵
      Kills process with taskkill
      PID:4152
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im notepad++.exe
      4⤵
      Kills process with taskkill
      PID:8828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im synctime.exe
      4⤵
      Kills process with taskkill
      PID:10096
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im agntsvc.exe
      4⤵
      Kills process with taskkill
      PID:1304
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im sqlwriter.exe
      4⤵
      Kills process with taskkill
      PID:11504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im mysql-nt.exe
      4⤵
      Kills process with taskkill
      PID:852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im wordpad.exe
      4⤵
      Kills process with taskkill
      PID:10848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im isqlplussvc.exe
      4⤵
      Kills process with taskkill
      PID:9424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im mydesktopservice.exe
      4⤵
      Kills process with taskkill
      PID:11464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im oracle.exe
      4⤵
      Kills process with taskkill
      PID:13228
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im steam.exe
      4⤵
      Kills process with taskkill
      PID:8624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /f /im mysql-opt.exe
      4⤵
      Kills process with taskkill
      PID:3756
  - - C:\Windows\SysWOW64\mode.com
      mode con cp select=125 vssadmin delete shadows /all
      4⤵
      PID:14960
- - C:\Users\Admin\Desktop\00430\Trojan-Ransom.Win32.Babuk.a-f1719415abe4dcba0daef0a1e5c8994d1d3c0c659d3e0a11b34f307370dd8683.exe
    Trojan-Ransom.Win32.Babuk.a-f1719415abe4dcba0daef0a1e5c8994d1d3c0c659d3e0a11b34f307370dd8683.exe
    3⤵
    PID:4036
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      4⤵
      PID:12908
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin.exe delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:12348
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      4⤵
      PID:4208
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin.exe delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:3676
- - C:\Users\Admin\Desktop\00430\Trojan-Ransom.Win32.Blocker.goxb-cb1b3b9b288a43eb267a75615da401aa7aef23624aeab21757707a7aea461728.exe
    Trojan-Ransom.Win32.Blocker.goxb-cb1b3b9b288a43eb267a75615da401aa7aef23624aeab21757707a7aea461728.exe
    3⤵
    PID:11420
- - C:\Users\Admin\Desktop\00430\Trojan-Ransom.Win32.Blocker.jzec-6899e9866a8eda5acdde73e19d84777379922c4fcdc63d1d2b800f93f5684b8f.exe
    Trojan-Ransom.Win32.Blocker.jzec-6899e9866a8eda5acdde73e19d84777379922c4fcdc63d1d2b800f93f5684b8f.exe
    3⤵
    PID:7472
- - C:\Users\Admin\Desktop\00430\Trojan-Ransom.Win32.Blocker.lckf-6d516f7d8af7bd535416236e60299dbcaad38f490716de3eae65c641f08b941b.exe
    Trojan-Ransom.Win32.Blocker.lckf-6d516f7d8af7bd535416236e60299dbcaad38f490716de3eae65c641f08b941b.exe
    3⤵
    PID:4176
- - C:\Users\Admin\Desktop\00430\Trojan-Ransom.Win32.Blocker.mwcs-97c559034eff5287d2a74db45e5e3d9014d322697729504960b313531727cd5e.exe
    Trojan-Ransom.Win32.Blocker.mwcs-97c559034eff5287d2a74db45e5e3d9014d322697729504960b313531727cd5e.exe
    3⤵
    PID:7128
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:3872
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:1700
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        
        PID:1676
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:13892
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1320
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        5⤵
        Deletes backup catalog
        
        PID:11368
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:4764
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set currentprofile state off
        5⤵
        Modifies Windows Firewall
        
        PID:10708
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall set opmode mode=disable
        5⤵
        Modifies Windows Firewall
        
        PID:1464
- - C:\Users\Admin\Desktop\00430\Trojan-Ransom.Win32.DoppelPaymer.bo-dada1919d1be39ad2a5edaa90e0ae2b45aa9550cd705628e30314d71cb3525d9.exe
    Trojan-Ransom.Win32.DoppelPaymer.bo-dada1919d1be39ad2a5edaa90e0ae2b45aa9550cd705628e30314d71cb3525d9.exe
    3⤵
    PID:4080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 152
      4⤵
      Program crash
      PID:8296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 152
      4⤵
      Program crash
      PID:10984
- - C:\Users\Admin\Desktop\00430\Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe
    Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe
    3⤵
    PID:1740
- - C:\Users\Admin\Desktop\00430\Trojan-Ransom.Win32.Encoder.qfn-8f3ce22b16c07fff1a586feb9eea8ccb5aa06e918657a0ae4a3f41b14de83995.exe
    Trojan-Ransom.Win32.Encoder.qfn-8f3ce22b16c07fff1a586feb9eea8ccb5aa06e918657a0ae4a3f41b14de83995.exe
    3⤵
    PID:3444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:7728

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2444 -ip 2444
1⤵
PID:4460

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\8c7d1a4dee1642599ba3b43bb8d92150 /t 2208 /p 1480
1⤵
PID:8080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:10320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4080 -ip 4080
1⤵
PID:10980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:15692

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:9684

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:6140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery