agenttesla | c019141bc3d483634d38672e50660478aa452db9066da062e72cd099a7d4937a

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

pid	Process
4384	bcdedit.exe
9344	bcdedit.exe

Contacts a large (1609) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
5180	wbadmin.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe

Executes dropped EXE 8 IoCs

pid	Process
808	HEUR-Trojan-Ransom.MSIL.Crypmod.gen-3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232.exe
4276	HEUR-Trojan-Ransom.MSIL.Crypren.gen-15856152e8961ae0ff0861f935cc21b930c9f1b1f5327e3d6d99dbe6902dee51.exe
812	HEUR-Trojan-Ransom.MSIL.Encoder.gen-a33dab6d7adb83691bd14c88d7ef47fa0e5417fec691c874e5dd3918f7629215.exe
1052	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe
5004	HEUR-Trojan-Ransom.Win32.Convagent.gen-a9d592579e11f43dd46c7132cede4802aeebae10bd367efd41d6c98a5f9e486c.exe
2376	HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe
3172	HEUR-Trojan-Ransom.Win32.Crypmod.gen-5cd3ee5cfb9241ad12e7dae0cd9c2764d91deee58e1a07bb37c544bc8eb57448.exe
4248	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine	HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
974	raw.githubusercontent.com
976	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	ip-api.com
46	ipinfo.io
47	ipinfo.io

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2820	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2376	HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1052 set thread context of 4248	1052	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe	115

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
7552	sc.exe
5940	sc.exe
1700	sc.exe
6504	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1352	3588	WerFault.exe	129
4864	2128	WerFault.exe	119
5380	3588	WerFault.exe	129
5544	3588	WerFault.exe	129
5724	3588	WerFault.exe	129
6040	3588	WerFault.exe	129
3664	4480	WerFault.exe	135
5472	3588	WerFault.exe	129
7896	3588	WerFault.exe	129
6168	3588	WerFault.exe	129
6332	3588	WerFault.exe	129
9324	3588	WerFault.exe	129
6788	7588	WerFault.exe	185
7720	3588	WerFault.exe	129
7044	3588	WerFault.exe	129
6944	5460	WerFault.exe	145
7080	3588	WerFault.exe	129
7728	3588	WerFault.exe	129
1116	3588	WerFault.exe	129
10020	3588	WerFault.exe	129
4164	3588	WerFault.exe	129
5724	3588	WerFault.exe	129
8468	3588	WerFault.exe	129
7744	3588	WerFault.exe	129
6280	3588	WerFault.exe	129
7496	3588	WerFault.exe	129
8832	3588	WerFault.exe	129
5012	3588	WerFault.exe	129
6020	3588	WerFault.exe	129
8804	3588	WerFault.exe	129
7624	3588	WerFault.exe	129
4724	3588	WerFault.exe	129
6836	3588	WerFault.exe	129
9392	3588	WerFault.exe	129
6120	3588	WerFault.exe	129
5060	3788	WerFault.exe	126
9936	3588	WerFault.exe	129
8104	3588	WerFault.exe	129
7136	3588	WerFault.exe	129
7572	3588	WerFault.exe	129
724	3588	WerFault.exe	129
3428	3588	WerFault.exe	129
7712	3588	WerFault.exe	129
4596	3588	WerFault.exe	129
9160	2304	WerFault.exe	127
4180	3588	WerFault.exe	129
6020	3588	WerFault.exe	129
7728	3588	WerFault.exe	129
10036	3588	WerFault.exe	129
7892	3588	WerFault.exe	129
4500	3588	WerFault.exe	129
6096	3588	WerFault.exe	129
8332	3588	WerFault.exe	129
5016	3588	WerFault.exe	129
9800	3588	WerFault.exe	129
10780	3588	WerFault.exe	129
8520	3588	WerFault.exe	129
7816	3588	WerFault.exe	129
7044	3588	WerFault.exe	129
12232	3588	WerFault.exe	129
10724	3588	WerFault.exe	129
11588	3588	WerFault.exe	129
11460	3588	WerFault.exe	129
7612	3588	WerFault.exe	129

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Convagent.gen-a9d592579e11f43dd46c7132cede4802aeebae10bd367efd41d6c98a5f9e486c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Crypmod.gen-3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Crypren.gen-15856152e8961ae0ff0861f935cc21b930c9f1b1f5327e3d6d99dbe6902dee51.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Encoder.gen-a33dab6d7adb83691bd14c88d7ef47fa0e5417fec691c874e5dd3918f7629215.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Interacts with shadow copies 3 TTPs 18 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
9064	vssadmin.exe
7312	vssadmin.exe
4272	vssadmin.exe
9928	vssadmin.exe
3200	vssadmin.exe
3332	vssadmin.exe
6008	vssadmin.exe
2452	vssadmin.exe
7200	vssadmin.exe
116	vssadmin.exe
7796	vssadmin.exe
2100	vssadmin.exe
6416	vssadmin.exe
6520	vssadmin.exe
2284	vssadmin.exe
7248	vssadmin.exe
8340	vssadmin.exe
5616	vssadmin.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
7392	taskkill.exe
6836	taskkill.exe
2864	taskkill.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3496	NOTEPAD.EXE
8904	notepad.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
4460	powershell.exe
4460	powershell.exe
4460	powershell.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
436	7zFM.exe
1840	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	436	7zFM.exe
Token: 35	436	7zFM.exe
Token: SeSecurityPrivilege	436	7zFM.exe
Token: SeDebugPrivilege	3080	taskmgr.exe
Token: SeSystemProfilePrivilege	3080	taskmgr.exe
Token: SeCreateGlobalPrivilege	3080	taskmgr.exe
Token: SeDebugPrivilege	1840	taskmgr.exe
Token: SeSystemProfilePrivilege	1840	taskmgr.exe
Token: SeCreateGlobalPrivilege	1840	taskmgr.exe
Token: 33	3080	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3080	taskmgr.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	812	HEUR-Trojan-Ransom.MSIL.Encoder.gen-a33dab6d7adb83691bd14c88d7ef47fa0e5417fec691c874e5dd3918f7629215.exe
Token: SeIncBasePriorityPrivilege	812	HEUR-Trojan-Ransom.MSIL.Encoder.gen-a33dab6d7adb83691bd14c88d7ef47fa0e5417fec691c874e5dd3918f7629215.exe
Token: SeDebugPrivilege	4276	HEUR-Trojan-Ransom.MSIL.Crypren.gen-15856152e8961ae0ff0861f935cc21b930c9f1b1f5327e3d6d99dbe6902dee51.exe
Token: SeDebugPrivilege	4248	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
436	7zFM.exe
436	7zFM.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
3080	taskmgr.exe
3080	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 1840	3080	taskmgr.exe	100
PID 3080 wrote to memory of 1840	3080	taskmgr.exe	100
PID 4460 wrote to memory of 632	4460	powershell.exe	105
PID 4460 wrote to memory of 632	4460	powershell.exe	105
PID 632 wrote to memory of 808	632	cmd.exe	108
PID 632 wrote to memory of 808	632	cmd.exe	108
PID 632 wrote to memory of 808	632	cmd.exe	108
PID 632 wrote to memory of 4276	632	cmd.exe	109
PID 632 wrote to memory of 4276	632	cmd.exe	109
PID 632 wrote to memory of 4276	632	cmd.exe	109
PID 632 wrote to memory of 812	632	cmd.exe	110
PID 632 wrote to memory of 812	632	cmd.exe	110
PID 632 wrote to memory of 812	632	cmd.exe	110
PID 632 wrote to memory of 1052	632	cmd.exe	111
PID 632 wrote to memory of 1052	632	cmd.exe	111
PID 632 wrote to memory of 1052	632	cmd.exe	111
PID 632 wrote to memory of 5004	632	cmd.exe	112
PID 632 wrote to memory of 5004	632	cmd.exe	112
PID 632 wrote to memory of 5004	632	cmd.exe	112
PID 632 wrote to memory of 2376	632	cmd.exe	113
PID 632 wrote to memory of 2376	632	cmd.exe	113
PID 632 wrote to memory of 2376	632	cmd.exe	113
PID 632 wrote to memory of 3172	632	cmd.exe	114
PID 632 wrote to memory of 3172	632	cmd.exe	114
PID 632 wrote to memory of 3172	632	cmd.exe	114
PID 1052 wrote to memory of 4248	1052	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe	115
PID 1052 wrote to memory of 4248	1052	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe	115
PID 1052 wrote to memory of 4248	1052	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe	115
PID 1052 wrote to memory of 4248	1052	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe	115
PID 1052 wrote to memory of 4248	1052	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe	115
PID 1052 wrote to memory of 4248	1052	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe	115
PID 1052 wrote to memory of 4248	1052	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe	115
PID 1052 wrote to memory of 4248	1052	HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe	115
PID 2376 wrote to memory of 3268	2376	HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe	116
PID 2376 wrote to memory of 3268	2376	HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe	116
PID 2376 wrote to memory of 3268	2376	HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe	116

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00380.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:436

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /1
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1840

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.MSIL.Crypmod.gen-3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232.exe
    HEUR-Trojan-Ransom.MSIL.Crypmod.gen-3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:808
  - - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.MSIL.Crypmod.gen-3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232.exe
      "HEUR-Trojan-Ransom.MSIL.Crypmod.gen-3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232.exe"
      4⤵
      PID:6260
    - - C:\Windows\SysWOW64\wbem\wmic.exe
        
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        5⤵
        
        PID:9336
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.MSIL.Crypren.gen-15856152e8961ae0ff0861f935cc21b930c9f1b1f5327e3d6d99dbe6902dee51.exe
    HEUR-Trojan-Ransom.MSIL.Crypren.gen-15856152e8961ae0ff0861f935cc21b930c9f1b1f5327e3d6d99dbe6902dee51.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.MSIL.Encoder.gen-a33dab6d7adb83691bd14c88d7ef47fa0e5417fec691c874e5dd3918f7629215.exe
    HEUR-Trojan-Ransom.MSIL.Encoder.gen-a33dab6d7adb83691bd14c88d7ef47fa0e5417fec691c874e5dd3918f7629215.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:812
  - - C:\Windows\SysWOW64\tasklist.exe
      "tasklist" /V /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2820
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe
    HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe
      "{path}"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4248
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Convagent.gen-a9d592579e11f43dd46c7132cede4802aeebae10bd367efd41d6c98a5f9e486c.exe
    HEUR-Trojan-Ransom.Win32.Convagent.gen-a9d592579e11f43dd46c7132cede4802aeebae10bd367efd41d6c98a5f9e486c.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5004
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe
    HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\abkrlnduo\fjchsuw.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3268
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4236
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir /a:-d /b /s ""c:"\*ledger*.txt" ""c:"\*trezor*.txt" ""c:"\coin*.txt" ""c:"\private*.txt" ""c:"\eth*.txt" ""c:"\jaxx*.txt" ""c:"\exodus*.txt" ""c:"\seed*.txt" ""c:"\mnemonic*.txt" ""c:"\*monero*.txt" ""c:"\crypt*.txt" ""c:"\wallet*.txt" ""c:"\electrum*.txt" ""c:"\xrp.txt" ""c:"\ripple.txt" ""c:"\btc*.txt" ""c:"\2fa*.txt" ""c:"\pass*.txt" ""c:"\*money*.txt" ""c:"\*ledger*.doc*" ""c:"\*trezor*.doc*" ""c:"\*coin*.doc*" ""c:"\private*.doc*" ""c:"\eth*.doc*" ""c:"\jaxx*.doc*" ""c:"\exodus*.doc*" ""c:"\seed*.doc*" ""c:"\mnemonic*.doc*" ""c:"\*monero*.doc*" ""c:"\*crypt*.doc*" ""c:"\wallet*.doc*" ""c:"\electrum*.doc*" ""c:"\xrp*.doc*" ""c:"\ripple*.doc*" ""c:"\btc*.doc*" ""c:"\2fa*.doc*" ""c:"\pass*.doc*" ""c:"\money*.doc*" ""c:"\*ledger*.xlsx" ""c:"\*trezor*.xlsx" ""c:"\coin*.xlsx" ""c:"\private*.xlsx" ""c:"\eth*.xlsx" ""c:"\jaxx*.xlsx" ""c:"\exodus*.xlsx" ""c:"\*seed*.xlsx" ""c:"\crypt*.xlsx" ""c:"\wallet*.xlsx" ""c:"\electrum*.xlsx" ""c:"\btc*.xlsx" ""c:"\2fa*.xlsx" ""c:"\pass*.xlsx" ""c:"\btc.jpg" ""c:"\2fa.jpg" ""c:"\coin.jpg" ""c:"\ether.jpg" ""c:"\seed.jpg" ""c:"\wallet.jpg"
        5⤵
        
        PID:8064
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Crypmod.gen-5cd3ee5cfb9241ad12e7dae0cd9c2764d91deee58e1a07bb37c544bc8eb57448.exe
    HEUR-Trojan-Ransom.Win32.Crypmod.gen-5cd3ee5cfb9241ad12e7dae0cd9c2764d91deee58e1a07bb37c544bc8eb57448.exe
    3⤵
    - Executes dropped EXE
    PID:3172
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-8f7feaeb31f6c6b7056b05a252ac0531a8fbb7488fd26791d0aec433d21c07fd.exe
    HEUR-Trojan-Ransom.Win32.GandCrypt.gen-8f7feaeb31f6c6b7056b05a252ac0531a8fbb7488fd26791d0aec433d21c07fd.exe
    3⤵
    PID:2128
  - - C:\Windows\V49050494020\winsvcin32.exe
      C:\Windows\V49050494020\winsvcin32.exe
      4⤵
      PID:3168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 416
      4⤵
      Program crash
      PID:4864
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Generic-81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.exe
    HEUR-Trojan-Ransom.Win32.Generic-81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.exe
    3⤵
    PID:2064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      PID:2716
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" stop avpsus /y
      4⤵
      PID:2488
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop avpsus /y
        5⤵
        
        PID:8172
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" stop McAfeeDLPAgentService /y
      4⤵
      PID:8696
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
        5⤵
        
        PID:6040
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" stop mfewc /y
      4⤵
      PID:6960
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop mfewc /y
        5⤵
        
        PID:9512
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" stop BMR Boot Service /y
      4⤵
      PID:9380
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop BMR Boot Service /y
        5⤵
        
        PID:376
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" stop NetBackup BMR MTFTP Service /y
      4⤵
      PID:388
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
        5⤵
        
        PID:1436
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLTELEMETRY start= disabled
      4⤵
      Launches sc.exe
      PID:7552
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
      4⤵
      Launches sc.exe
      PID:5940
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLWriter start= disabled
      4⤵
      Launches sc.exe
      PID:1700
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SstpSvc start= disabled
      4⤵
      Launches sc.exe
      PID:6504
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mspub.exe /F
      4⤵
      Kills process with taskkill
      PID:6836
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mydesktopqos.exe /F
      4⤵
      Kills process with taskkill
      PID:2864
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mydesktopservice.exe /F
      4⤵
      Kills process with taskkill
      PID:7392
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" Delete Shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:6520
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:2452
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:6008
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:2284
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:7796
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:3332
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:7248
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:7200
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:8340
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:7312
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:4272
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:116
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:9928
  - - C:\Windows\SYSTEM32\vssadmin.exe
      "vssadmin.exe" Delete Shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:3200
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:8904
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Generic-81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.exe
      4⤵
      PID:9064
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:7744
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Gimemo.gen-09d0890a500d3840c71451ca07f120bbce4fb6eaf293cb805dcc5ecde0c4403c.exe
    HEUR-Trojan-Ransom.Win32.Gimemo.gen-09d0890a500d3840c71451ca07f120bbce4fb6eaf293cb805dcc5ecde0c4403c.exe
    3⤵
    PID:3788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 1488
      4⤵
      Program crash
      PID:5060
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.JSWorm.gen-71cafb0417b9467a91e7d710cf6b6fc4f5017fc666de154c34e61725fb21b1c0.exe
    HEUR-Trojan-Ransom.Win32.JSWorm.gen-71cafb0417b9467a91e7d710cf6b6fc4f5017fc666de154c34e61725fb21b1c0.exe
    3⤵
    PID:2304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 888
      4⤵
      Program crash
      PID:9160
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-a9022b4592e1f45576b35b0bec7a3756b27688295a3b8386094c0613f4e14314.exe
    HEUR-Trojan-Ransom.Win32.PolyRansom.gen-a9022b4592e1f45576b35b0bec7a3756b27688295a3b8386094c0613f4e14314.exe
    3⤵
    PID:1232
- - C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Rack.vho-947196ecb0723f7bfe47b7f01a761a0e9bfbe55ae1f23d787eed4727d1e057b9.exe
    HEUR-Trojan-Ransom.Win32.Rack.vho-947196ecb0723f7bfe47b7f01a761a0e9bfbe55ae1f23d787eed4727d1e057b9.exe
    3⤵
    PID:3588
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:4496
    - - C:\Windows\system32\mode.com
        
        mode con cp select=1251
        5⤵
        
        PID:5260
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 540
      4⤵
      Program crash
      PID:1352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 548
      4⤵
      Program crash
      PID:5380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 576
      4⤵
      Program crash
      PID:5544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 584
      4⤵
      Program crash
      PID:5724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 588
      4⤵
      Program crash
      PID:6040
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 672
      4⤵
      Program crash
      PID:5472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 664
      4⤵
      Program crash
      PID:7896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 688
      4⤵
      Program crash
      PID:6168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 540
      4⤵
      Program crash
      PID:6332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 800
      4⤵
      Program crash
      PID:9324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 796
      4⤵
      Program crash
      PID:7720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 804
      4⤵
      Program crash
      PID:7044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 836
      4⤵
      Program crash
      PID:7080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 812
      4⤵
      Program crash
      PID:7728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 856
      4⤵
      Program crash
      PID:1116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 856
      4⤵
      Program crash
      PID:10020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 880
      4⤵
      Program crash
      PID:4164
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 884
      4⤵
      Program crash
      PID:5724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 840
      4⤵
      Program crash
      PID:8468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 800
      4⤵
      Program crash
      PID:7744
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 828
      4⤵
      Program crash
      PID:6280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 800
      4⤵
      Program crash
      PID:7496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 804
      4⤵
      Program crash
      PID:8832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 888
      4⤵
      Program crash
      PID:5012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 852
      4⤵
      Program crash
      PID:6020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 816
      4⤵
      Program crash
      PID:8804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 800
      4⤵
      Program crash
      PID:7624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1068
      4⤵
      Program crash
      PID:4724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1440
      4⤵
      Program crash
      PID:6836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1444
      4⤵
      Program crash
      PID:9392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1440
      4⤵
      Program crash
      PID:6120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 860
      4⤵
      Program crash
      PID:9936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1456
      4⤵
      Program crash
      PID:8104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1464
      4⤵
      Program crash
      PID:7136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 660
      4⤵
      Program crash
      PID:7572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1456
      4⤵
      Program crash
      PID:724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1500
      4⤵
      Program crash
      PID:3428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1508
      4⤵
      Program crash
      PID:7712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1540
      4⤵
      Program crash
      PID:4596
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1520
      4⤵
      Program crash
      PID:4180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1552
      4⤵
      Program crash
      PID:6020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1500
      4⤵
      Program crash
      PID:7728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1568
      4⤵
      Program crash
      PID:10036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1556
      4⤵
      Program crash
      PID:7892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1564
      4⤵
      Program crash
      PID:4500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1576
      4⤵
      Program crash
      PID:6096
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1544
      4⤵
      Program crash
      PID:8332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1520
      4⤵
      Program crash
      PID:5016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1552
      4⤵
      Program crash
      PID:9800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1560
      4⤵
      Program crash
      PID:10780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1540
      4⤵
      Program crash
      PID:8520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1512
      4⤵
      Program crash
      PID:7816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1792
      4⤵
      Program crash
      PID:7044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1800
      4⤵
      Program crash
      PID:12232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1824
      4⤵
      Program crash
      PID:10724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1756
      4⤵
      Program crash
      PID:11588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1844
      4⤵
      Program crash
      PID:11460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1836
      4⤵
      Program crash
      PID:7612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1760
      4⤵
      PID:7612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1804
      4⤵
      PID:3996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1840
      4⤵
      PID:12420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1728
      4⤵
      PID:12468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1732
      4⤵
      PID:12736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1604
      4⤵
      PID:7020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1460
      4⤵
      PID:13832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1480
      4⤵
      PID:11052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1464
      4⤵
      PID:13388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1440
      4⤵
      PID:14124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1284
      4⤵
      PID:10980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1616
      4⤵
      PID:4704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1580
      4⤵
      PID:9232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1596
      4⤵
      PID:13556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1508
      4⤵
      PID:14152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1580
      4⤵
      PID:12732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1560
      4⤵
      PID:10636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1552
      4⤵
      PID:12544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1636
      4⤵
      PID:12456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1628
      4⤵
      PID:12844
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.cjtx-3917759ae65f10aec4f9d5e5628fead573d8f3b4bba59a8f1fcd6692ec563436.exe
    Trojan-Ransom.Win32.Blocker.cjtx-3917759ae65f10aec4f9d5e5628fead573d8f3b4bba59a8f1fcd6692ec563436.exe
    3⤵
    PID:3596
  - - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.cjtx-3917759ae65f10aec4f9d5e5628fead573d8f3b4bba59a8f1fcd6692ec563436.exe
      "C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.cjtx-3917759ae65f10aec4f9d5e5628fead573d8f3b4bba59a8f1fcd6692ec563436.exe"
      4⤵
      PID:1356
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp977cd165.bat"
        5⤵
        
        PID:6456
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.klrp-45167945141c95c5a012feeb0fcfc6667fc43e781cd9e43ab0be4bcc1b9ed6b2.exe
    Trojan-Ransom.Win32.Blocker.klrp-45167945141c95c5a012feeb0fcfc6667fc43e781cd9e43ab0be4bcc1b9ed6b2.exe
    3⤵
    PID:4480
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 240
      4⤵
      Program crash
      PID:3664
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.lckf-5140c53c5f3e25069731a723d05f52dd3b7e36437ab56c2456b751f229cf1491.exe
    Trojan-Ransom.Win32.Blocker.lckf-5140c53c5f3e25069731a723d05f52dd3b7e36437ab56c2456b751f229cf1491.exe
    3⤵
    PID:964
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.mbhj-a7ca204632f7c62e75b02978c62be386b47d4d0741f9bd7d826986cef7ca4304.exe
    Trojan-Ransom.Win32.Blocker.mbhj-a7ca204632f7c62e75b02978c62be386b47d4d0741f9bd7d826986cef7ca4304.exe
    3⤵
    PID:5460
  - - C:\Windows\1233994211794075\winrcfu.exe
      C:\Windows\1233994211794075\winrcfu.exe
      4⤵
      PID:7296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 572
      4⤵
      Program crash
      PID:6944
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Cortex.i-11f7bb37dd425150e6b095a8d1f3a347ee83e604302a4d9bb201900e74a81d73.exe
    Trojan-Ransom.Win32.Cortex.i-11f7bb37dd425150e6b095a8d1f3a347ee83e604302a4d9bb201900e74a81d73.exe
    3⤵
    PID:5608
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Crusis.drg-c12472bf9837449057268026463065fc9961ebbd3dc31d91d243392addfade9c.exe
    Trojan-Ransom.Win32.Crusis.drg-c12472bf9837449057268026463065fc9961ebbd3dc31d91d243392addfade9c.exe
    3⤵
    PID:5864
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Crypren.agpe-4eac200afdbf3ed368074c0a544bfdbbe0b33f9366905a2b0bd0a51aa1c65477.exe
    Trojan-Ransom.Win32.Crypren.agpe-4eac200afdbf3ed368074c0a544bfdbbe0b33f9366905a2b0bd0a51aa1c65477.exe
    3⤵
    PID:5176
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1360
    - - C:\Windows\system32\mode.com
        
        mode con cp select=1251
        5⤵
        
        PID:2272
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:2100
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:4508
    - - C:\Windows\system32\mode.com
        
        mode con cp select=1251
        5⤵
        
        PID:5996
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:6416
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
      4⤵
      PID:4716
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
      4⤵
      PID:744
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Cryptor.dhy-c89a16d617c7e36ceb6a42c306867b2464ede65f94e858484b8405b1497a2c72.exe
    Trojan-Ransom.Win32.Cryptor.dhy-c89a16d617c7e36ceb6a42c306867b2464ede65f94e858484b8405b1497a2c72.exe
    3⤵
    PID:6812
  - - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Cryptor.dhy-c89a16d617c7e36ceb6a42c306867b2464ede65f94e858484b8405b1497a2c72.exe
      "C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Cryptor.dhy-c89a16d617c7e36ceb6a42c306867b2464ede65f94e858484b8405b1497a2c72.exe" n6812
      4⤵
      PID:3520
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:6048
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:9064
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        
        PID:1140
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4384
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:9344
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        5⤵
        Deletes backup catalog
        
        PID:5180
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Encoder.cwz-591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
    Trojan-Ransom.Win32.Encoder.cwz-591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
    3⤵
    PID:7760
  - - C:\Windows\SysWOW64\mshta.exe
      mshta.exe C:\Users\Admin\AppData\Local\Temp\readme.hta
      4⤵
      PID:8184
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Foreign.nxyr-b6f9f9fa970bf7ec730e0944b1bb0ba8d17a3715de0730bc417aae149ae048dd.exe
    Trojan-Ransom.Win32.Foreign.nxyr-b6f9f9fa970bf7ec730e0944b1bb0ba8d17a3715de0730bc417aae149ae048dd.exe
    3⤵
    PID:8112
  - - C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe
      4⤵
      PID:7928
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Foreign.ojiw-46d4b4601a37c1ba3f7fa4d8bde1494d75bb28cbd2dc90b539a39e31aebac3dc.exe
    Trojan-Ransom.Win32.Foreign.ojiw-46d4b4601a37c1ba3f7fa4d8bde1494d75bb28cbd2dc90b539a39e31aebac3dc.exe
    3⤵
    PID:7588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7588 -s 2300
      4⤵
      Program crash
      PID:6788
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Foreign.okmc-23f63135c2789e7ef408e0184508a7340f673860f0fefc09dd705276d82d7787.exe
    Trojan-Ransom.Win32.Foreign.okmc-23f63135c2789e7ef408e0184508a7340f673860f0fefc09dd705276d82d7787.exe
    3⤵
    PID:1924
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.GandCrypt.hou-663588f9cb662b9c620e1a77728d424fcd91409e1546b50a8763f61c8a2ee776.exe
    Trojan-Ransom.Win32.GandCrypt.hou-663588f9cb662b9c620e1a77728d424fcd91409e1546b50a8763f61c8a2ee776.exe
    3⤵
    PID:9292
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Mailto.g-06b8638fdd478672cfe140221233cacfae6d2890446a5c57c8b1317a27d2a036.exe
    Trojan-Ransom.Win32.Mailto.g-06b8638fdd478672cfe140221233cacfae6d2890446a5c57c8b1317a27d2a036.exe
    3⤵
    PID:9716
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Maze.al-806fc33650b7ec35dd01a06be3037674ae3cc0db6ba1e3f690ee9ba9403c0627.exe
    Trojan-Ransom.Win32.Maze.al-806fc33650b7ec35dd01a06be3037674ae3cc0db6ba1e3f690ee9ba9403c0627.exe
    3⤵
    PID:6672
  - - C:\Windows\system32\wbem\wmic.exe
      "C:\ct\sgo\..\..\Windows\cegm\..\system32\p\venu\..\..\wbem\c\..\wmic.exe" shadowcopy delete
      4⤵
      PID:1200
  - - C:\Windows\system32\wbem\wmic.exe
      "C:\co\uki\..\..\Windows\flw\iuti\..\..\system32\hn\..\wbem\rmm\..\wmic.exe" shadowcopy delete
      4⤵
      PID:6096
- - C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Maze.ed-5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353.exe
    Trojan-Ransom.Win32.Maze.ed-5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353.exe
    3⤵
    PID:7364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3588 -ip 3588
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2128 -ip 2128
1⤵
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3588 -ip 3588
1⤵
PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3588 -ip 3588
1⤵
PID:5492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3588 -ip 3588
1⤵
PID:5672

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3588 -ip 3588
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4480 -ip 4480
1⤵
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3588 -ip 3588
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3588 -ip 3588
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3588 -ip 3588
1⤵
PID:5152

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.TXT
1⤵
- Opens file in notepad (likely ransom note)
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3588 -ip 3588
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3588 -ip 3588
1⤵
PID:5808

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YIPBAPHO-DECRYPT.txt
1⤵
PID:6800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3588 -ip 3588
1⤵
PID:8832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 7588 -ip 7588
1⤵
PID:6560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3588 -ip 3588
1⤵
PID:8520

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\cb00a7bea4f84eeba8ac52e4f5a3ca66 /t 6768 /p 8184
1⤵
PID:8356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3588 -ip 3588
1⤵
PID:8344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5460 -ip 5460
1⤵
PID:7780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3588 -ip 3588
1⤵
PID:9112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3588 -ip 3588
1⤵
PID:9676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3588 -ip 3588
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3588 -ip 3588
1⤵
PID:7532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3588 -ip 3588
1⤵
PID:7152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3588 -ip 3588
1⤵
PID:4380

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\39ba3c47979e496fbb574dc194870cc5 /t 7736 /p 744
1⤵
PID:9844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3588 -ip 3588
1⤵
PID:6640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3588 -ip 3588
1⤵
PID:9836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3588 -ip 3588
1⤵
PID:2284

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\d362aa5553394fe5ac2c3e7fae2df041 /t 6896 /p 4716
1⤵
PID:8568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3588 -ip 3588
1⤵
PID:9696

C:\ProgramData\oubgh\drgtuj.exe
C:\ProgramData\oubgh\drgtuj.exe start2
1⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 3588 -ip 3588
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 3588 -ip 3588
1⤵
PID:9140

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DECRYPT-FILES.txt
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3588 -ip 3588
1⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3588 -ip 3588
1⤵
PID:9464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3588 -ip 3588
1⤵
PID:9792

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x4d0
1⤵
PID:9996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3588 -ip 3588
1⤵
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3588 -ip 3588
1⤵
PID:6504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3588 -ip 3588
1⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3588 -ip 3588
1⤵
PID:8632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3788 -ip 3788
1⤵
PID:7208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 3588 -ip 3588
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 3588 -ip 3588
1⤵
PID:10224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3588 -ip 3588
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3588 -ip 3588
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3588 -ip 3588
1⤵
PID:2356

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:8536

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:9460

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:9728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3588 -ip 3588
1⤵
PID:8992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 3588 -ip 3588
1⤵
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 3588 -ip 3588
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2304 -ip 2304
1⤵
PID:7592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3588 -ip 3588
1⤵
PID:8104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3588 -ip 3588
1⤵
PID:6632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3588 -ip 3588
1⤵
PID:7248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3588 -ip 3588
1⤵
PID:7812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 3588 -ip 3588
1⤵
PID:8728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 3588 -ip 3588
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 3588 -ip 3588
1⤵
PID:6308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 3588 -ip 3588
1⤵
PID:6788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 3588 -ip 3588
1⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3588 -ip 3588
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 3588 -ip 3588
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3588 -ip 3588
1⤵
PID:11024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 3588 -ip 3588
1⤵
PID:10428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 3588 -ip 3588
1⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 3588 -ip 3588
1⤵
PID:9304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3588 -ip 3588
1⤵
PID:10572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3588 -ip 3588
1⤵
PID:8852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 3588 -ip 3588
1⤵
PID:6504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3588 -ip 3588
1⤵
PID:11908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 3588 -ip 3588
1⤵
PID:10272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3588 -ip 3588
1⤵
PID:10856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3588 -ip 3588
1⤵
PID:11252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 3588 -ip 3588
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3588 -ip 3588
1⤵
PID:7020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 3588 -ip 3588
1⤵
PID:12056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3588 -ip 3588
1⤵
PID:8892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3588 -ip 3588
1⤵
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 3588 -ip 3588
1⤵
PID:11496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3588 -ip 3588
1⤵
PID:12264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3588 -ip 3588
1⤵
PID:11448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 3588 -ip 3588
1⤵
PID:11948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3588 -ip 3588
1⤵
PID:11336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 3588 -ip 3588
1⤵
PID:10248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3588 -ip 3588
1⤵
PID:13648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 3588 -ip 3588
1⤵
PID:13824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 3588 -ip 3588
1⤵
PID:13820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 3588 -ip 3588
1⤵
PID:13428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3588 -ip 3588
1⤵
PID:11624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3588 -ip 3588
1⤵
PID:12760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Virtualization/Sandbox Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery