Analysis
-
max time kernel
56s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 22:16
General
-
Target
RNSM00370.7z
-
Size
10.2MB
-
MD5
51604e584ac02ba7cbc1e0b988f52ff3
-
SHA1
441570eb9cec860cfc71bff92458981757476aa8
-
SHA256
25092371bd630f24a8de44508fa5f2d45145eff4c3b069bdc91eabc34063153e
-
SHA512
a1cd0e949fcae04ca9ef215cd957181634b609272ebe3e99e6299e6572ca7fb2644aedbf9cb812c153fb27bd7302739a86ec8f723d244db5184040cfdbb97a44
-
SSDEEP
196608:ti28AfEg2eqkWvCGjcBBGIs2/f/WlXu479C+NsP5f7J+iGuaLNXgPPSxU+:uA8teqvDYBhnC7c+NsP5A0PYU+
Score
10/10
Malware Config
Extracted
Family
emotet
Botnet
Epoch1
C2
187.162.62.135:80
181.231.72.200:80
45.55.83.204:8080
104.236.217.164:8080
128.199.78.227:8080
46.101.123.139:8080
185.94.252.27:443
181.171.118.19:80
46.21.105.59:8080
105.224.171.102:80
86.6.188.121:80
190.246.146.101:80
200.80.198.34:80
200.58.171.51:80
109.104.79.48:8080
89.134.144.41:8080
159.65.241.220:8080
186.23.146.42:80
203.25.159.3:8080
190.1.37.125:443
rsa_pubkey.plain
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Extracted
Family
urelas
C2
1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
218.54.30.235
Extracted
Path
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\#DECRYPT_MY_FILES#.html
Ransom Note
<html>
<title>S A T U R N</title>
<center>
<body>
<h1>S A T U R N</h1>
<h4>Your documents, photos, databases, and other important files have been encrypted!</h4>
<br /> To Decrypt your files follow these instructions:
<br />
<div>
<h4>1. Download and Install Tor Browser from <a href=https://www.torproject.org/>https://www.torproject.org/</a></h4>
<br />
<h4>2. Run the browser</h4>
<br />
<h4>3. In the Tor Browser, open website:</h3>
<div style="background-color: #d9d9d9; margin-left: 20px; margin-right: 20px; padding-bottom: 8px; padding-left: 8px; padding-right: 8px; padding-top: 8px;">
</a><b>http://su34pwhpcafeiztt.onion</b><br/>
</div>
<h4>4. Follow the instructions at this website</h4>
</div>
</body>
</center>
</html>
<style>
html {
background-color: white;
font-family: Helvetica, sans-serif;
}
div {
background-color: #f2f2f2;
width: 80: %;
padding: 25px;
margin: 25px;
overflow:hidden;
}
</style>
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
Extracted
Family
darkcomet
Botnet
Travian
C2
google.serveftp.com:1515
Mutex
DC_MUTEX-542ZEJN
Attributes
-
gencode
jrjmU8cZXsP2
-
install
false
-
offline_keylogger
true
-
password
H91B4UD
-
persistence
false
Extracted
Path
C:\Users\357002-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 357002.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F78B3F7D6B6DB3E2
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.top/F78B3F7D6B6DB3E2
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
nrL0ucxgd9T2vE1sr6X+aDXJcaBH+O6Qg7JOK/KN68/UrYgXDmeg4CvZhI3ubSDK
gPvrYFgCAdi5Bnvs0eJeSuV76RY/lfwlJbJcWg6DE+5pRIlVDZwW+wgnOYwzl0B8
fS83aBmBg/rXj25X4An+IERqxdpIxa3+7821qOkUzr5436/4SQS3FEzilmyVopSS
mmMaV/Su+IB7U10z/m22uZwMpG+NepuIQizLLsw/I/Ikf9FsgrS0XGGBzlJeOnTb
H9PAW6SBGTuUIPH/1IEKucWCx9t2uu0gfClCc1rFG0YhsI3VjQxTLw3srqz92rX/
iq0hnJrcMRuhgjO4Z/iJP6ise25x3hmOsR9QsjoFMPd1DO0MERTH7tXF4rljO1Fu
+35FFR5i+WhoeUUqBgmGvbWWcUh7FFPVwavnfP3VHD/67q0Jy/QE6zhQeROO0zIy
kJO+aX9SQVNzRs+Z/qsYflycvb/yg9HrCiY86fKQRPqlq95viyejJxpmpXT2AXI5
CLx/V/bZ4G8sHYw0Y1/vU6ywFgPMfkv12YpzVIG0vbmd+aTEwnGL1JrH/1EMfFxB
C4k0F+pdhShpfEwgKkO7Kg9NtnfOENXT0hR4IIi6CIVx05MDmnEI6OyqLjBnCpTV
o4Rf/kY1SeeedCOpXIG+lK+cjUs4cTEKF9NBpFHS8eiQS9JOoBNN/Cj8hEvDfEeX
UFYwV1u5e7Y5Y8UaFkPre5DQGOMlgIEii9tQtXxqDLiM/6as9wN5gGKTTWGvag3O
75EeyatnQQYUa4Amf8OUH0eD45rYPbzCP55iTIGK9VIYWBS2AfXXFc+kOK3Gk59H
dRJjYchOOe/tPApcVh93KW09eVWzArxZebYghkx+PdkMPH1JqYwer/zZ8Y+M/IXH
LSyuJQ1JUZXhby0Treni4moUbdtn3DsAoOcknY+kjxGtkBXcydTlP5LWMVgPP+IL
NfFgElveZmrD8pex5rAF89zVW6RpJOPQs24AJZIgB1O1opXUfY19qv6ShRwpv2l2
0XoOXnTTU6nez1LCUTHfPFZxd4l0iPoIVJo+KfLZTs8t9HWS7qoWcv3ryQZNKMyV
YDGnm4Cr7D56zKFg53DKXDmOwLDzknZug4igSqqEWfTnerwH5yaTySqTnK+FmRwS
EfLt5VqVAZdBZlf8hwQyv6lt1oP1fA+5XuiKQmhv2gufh41Of6NkTG8fB7CYEuKA
UZKNprrwJz3/WgABHxw=
Extension name:
357002
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
URLs
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F78B3F7D6B6DB3E2
http://decryptor.top/F78B3F7D6B6DB3E2
Signatures
-
Berbew
Berbew is a backdoor written in C++.
-
Berbew family
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet family
-
GandCrab payload 8 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
UAC bypass 3 TTPs 1 IoCs
-
Urelas
Urelas is a trojan targeting card games.
-
Urelas family
-
Windows security bypass 2 TTPs 6 IoCs
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Contacts a large (1416) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Disables RegEdit via registry modification 2 IoCs
-
Disables use of System Restore points 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 4 IoCs
-
Sets service image path in registry 2 TTPs 2 IoCs
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 35 IoCs
-
Loads dropped DLL 8 IoCs
-
Modifies system executable filetype association 2 TTPs 15 IoCs
-
Uses the VBS compiler for execution 1 TTPs
-
Windows security modification 2 TTPs 7 IoCs
-
Adds Run key to start application 2 TTPs 18 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Modifies WinLogon 2 TTPs 1 IoCs
-
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 13 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Control Panel 4 IoCs
-
Modifies registry class 26 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookAW 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 5 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00370.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00370\HEUR-Trojan-Ransom.MSIL.Blocker.gen-b73d301801366ecfe94c69957f2f1d6e05b2e092d248bb1eb47cb6452046ace8.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-b73d301801366ecfe94c69957f2f1d6e05b2e092d248bb1eb47cb6452046ace8.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00370\HEUR-Trojan-Ransom.MSIL.Blocker.gen-b73d301801366ecfe94c69957f2f1d6e05b2e092d248bb1eb47cb6452046ace8.exe"C:\Users\Admin\Desktop\00370\HEUR-Trojan-Ransom.MSIL.Blocker.gen-b73d301801366ecfe94c69957f2f1d6e05b2e092d248bb1eb47cb6452046ace8.exe"4⤵
-
-
-
C:\Users\Admin\Desktop\00370\HEUR-Trojan-Ransom.Win32.Cryptor.gen-a338308294c10121d1709842785f31a0d3a0ab0417543e57ace0c6ac90d6152b.exeHEUR-Trojan-Ransom.Win32.Cryptor.gen-a338308294c10121d1709842785f31a0d3a0ab0417543e57ace0c6ac90d6152b.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00370\HEUR-Trojan-Ransom.Win32.Cryptor.gen-a338308294c10121d1709842785f31a0d3a0ab0417543e57ace0c6ac90d6152b.exe--6738d7b74⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00370\HEUR-Trojan-Ransom.Win32.Encoder.gen-840140fa647a7476b4c7ff9ea92f4f70bb856aaa745bc8e3d962f03d9b48fd67.exeHEUR-Trojan-Ransom.Win32.Encoder.gen-840140fa647a7476b4c7ff9ea92f4f70bb856aaa745bc8e3d962f03d9b48fd67.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\y_installer.exeC:\Users\Admin\AppData\Local\Temp\y_installer.exe --partner 351634 --distr /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=666"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\drivers\spools.exe"C:\Windows\SysWow64\drivers\spools.exe" "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=666"5⤵
-
C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exeC:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe /quiet /msicl YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=6666⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\y_installer.exeC:\Users\Admin\AppData\Local\Temp\y_installer.exe --stat dwnldr/p=351634/cnt=0/dt=3/ct=4/rt=0 --dh 2352 --st 17308450525⤵
-
-
-
-
C:\Users\Admin\Desktop\00370\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-f168c9f053048caff9b1e3df0bb9407819af757e6ab376543feea16d40af1675.exeHEUR-Trojan-Ransom.Win32.GandCrypt.gen-f168c9f053048caff9b1e3df0bb9407819af757e6ab376543feea16d40af1675.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 4804⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Bitman.hob-358bd6bc6462b3c287452ccec7902a4166182d082cef008c04e1ee88e42632ad.exeTrojan-Ransom.Win32.Bitman.hob-358bd6bc6462b3c287452ccec7902a4166182d082cef008c04e1ee88e42632ad.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2844⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Bitman.qlg-e21f8248e401ffb67f8f883c6a43b5e7fdabde5b05673d937a47ad03fb1c7e10.exeTrojan-Ransom.Win32.Bitman.qlg-e21f8248e401ffb67f8f883c6a43b5e7fdabde5b05673d937a47ad03fb1c7e10.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 3164⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Bitman.qmf-006e647cde91bcef42389a3810eba495d8e4859a6ef1537e691a5644084e1310.exeTrojan-Ransom.Win32.Bitman.qmf-006e647cde91bcef42389a3810eba495d8e4859a6ef1537e691a5644084e1310.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 5164⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Blocker.gfhu-18ff4a191ff5a58d6ec4a4ace69e293fd7e9cff3b273d2ed849fb21386cd0e35.exeTrojan-Ransom.Win32.Blocker.gfhu-18ff4a191ff5a58d6ec4a4ace69e293fd7e9cff3b273d2ed849fb21386cd0e35.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- System policy modification
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Blocker.hvwp-9e5eca5bcfed0cb7732f4ab5fd72b22b33a078901f2283fb7dd36b10f66a9506.exeTrojan-Ransom.Win32.Blocker.hvwp-9e5eca5bcfed0cb7732f4ab5fd72b22b33a078901f2283fb7dd36b10f66a9506.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\adm\ssiinstall.exeC:\Users\Admin\AppData\Local\Temp\\adm\ssiinstall.exe /VERYSILENT /SUPPRESSMSGBOXES4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-O1M7O.tmp\ssiinstall.tmp"C:\Users\Admin\AppData\Local\Temp\is-O1M7O.tmp\ssiinstall.tmp" /SL5="$90110,238879,138240,C:\Users\Admin\AppData\Local\Temp\adm\ssiinstall.exe" /VERYSILENT /SUPPRESSMSGBOXES5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\SSI\SSIagent.exe"C:\Users\Admin\AppData\Local\SSI\SSIagent.exe" /install6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Blocker.itys-d5765213d47dacc709e27d25c05a1894f21392bdf282e1f17601e1fbeb76ccf8.exeTrojan-Ransom.Win32.Blocker.itys-d5765213d47dacc709e27d25c05a1894f21392bdf282e1f17601e1fbeb76ccf8.exe3⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f4⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Blocker.iwia-cd7cba96fb5cb9028ac7f08e365d05d828e323b5d09ca0c3ded9271b7535fc03.exeTrojan-Ransom.Win32.Blocker.iwia-cd7cba96fb5cb9028ac7f08e365d05d828e323b5d09ca0c3ded9271b7535fc03.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 2404⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Blocker.jaxq-bbe01b0ef6f8bebe716f520be741247ddd8b16498bdb4abcbf427a36268e1b0c.exeTrojan-Ransom.Win32.Blocker.jaxq-bbe01b0ef6f8bebe716f520be741247ddd8b16498bdb4abcbf427a36268e1b0c.exe3⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Blocker.jckm-45fe181de3e2fe7bfafc6a531c57a484cdd4cbc84794562bd356e45db9425b23.exeTrojan-Ransom.Win32.Blocker.jckm-45fe181de3e2fe7bfafc6a531c57a484cdd4cbc84794562bd356e45db9425b23.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\yhmbsqlpep.exeyhmbsqlpep.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wmdtskcl.exeC:\Windows\system32\wmdtskcl.exe5⤵
-
-
-
C:\Windows\SysWOW64\sxpjxbmwlkipuld.exesxpjxbmwlkipuld.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wmdtskcl.exewmdtskcl.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\ataidddsfmiiy.exeataidddsfmiiy.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""4⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Blocker.maou-1b0dbd1f90b5c8e98312061e166f656c60942694643b425de8ba4fc84ce76c61.exeTrojan-Ransom.Win32.Blocker.maou-1b0dbd1f90b5c8e98312061e166f656c60942694643b425de8ba4fc84ce76c61.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Blocker.mtgn-c27684f0b601e19655dd37b5de66d8dd26e38bbd9cafa947f67268044c82ba0f.exeTrojan-Ransom.Win32.Blocker.mtgn-c27684f0b601e19655dd37b5de66d8dd26e38bbd9cafa947f67268044c82ba0f.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\xk.exeC:\Windows\xk.exe4⤵
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"4⤵
-
-
C:\Windows\xk.exeC:\Windows\xk.exe4⤵
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"4⤵
-
-
C:\Windows\xk.exeC:\Windows\xk.exe4⤵
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"4⤵
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"4⤵
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Blocker.rtc-70750a30c80adb1dd1cb2d804e9f52ae9a710e66c37e1bfe93955a3defa5a5da.exeTrojan-Ransom.Win32.Blocker.rtc-70750a30c80adb1dd1cb2d804e9f52ae9a710e66c37e1bfe93955a3defa5a5da.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ucfbwyty.cmdline"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES61B3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc13997417357D4C17824CAEAC822397A.TMP"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\frs14kbb.cmdline"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES68C7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9CEC3983BD184A4CA31B285E3BF762.TMP"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe4⤵
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Crypmod.xrl-a03bb7d426f6291e8daa6e6f34a14b2e27183356ced4be45649f81f3965d854c.exeTrojan-Ransom.Win32.Crypmod.xrl-a03bb7d426f6291e8daa6e6f34a14b2e27183356ced4be45649f81f3965d854c.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\shell.exe"C:\Windows\system32\shell.exe" "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /Quiet /All4⤵
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Foreign.myji-bd99f98a715c23243f115c52078fcfa2a410772161af0a3400729955b17ec52f.exeTrojan-Ransom.Win32.Foreign.myji-bd99f98a715c23243f115c52078fcfa2a410772161af0a3400729955b17ec52f.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 4764⤵
- Program crash
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
-
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Foreign.naej-75a3b0f83b71a9c8470400b89b1c4dc18caca41de9a8c0dd31016f136cc4182b.exeTrojan-Ransom.Win32.Foreign.naej-75a3b0f83b71a9c8470400b89b1c4dc18caca41de9a8c0dd31016f136cc4182b.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.GandCrypt.bvu-850f4297f77ab27e0f36f843d42c9e80142847888739e816676a720a64cd0143.exeTrojan-Ransom.Win32.GandCrypt.bvu-850f4297f77ab27e0f36f843d42c9e80142847888739e816676a720a64cd0143.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 4764⤵
- Program crash
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.GandCrypt.cbc-3c30d6a831d7e0119da5f24fa42c26ad2c8882728429de2b07011b235b3273f8.exeTrojan-Ransom.Win32.GandCrypt.cbc-3c30d6a831d7e0119da5f24fa42c26ad2c8882728429de2b07011b235b3273f8.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookAW
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 5004⤵
- Program crash
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
-
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
-
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.GandCrypt.jhu-f2e4c6892704f1684806a033976a7a7c4e7a8dfc817054563795b325e4029c40.exeTrojan-Ransom.Win32.GandCrypt.jhu-f2e4c6892704f1684806a033976a7a7c4e7a8dfc817054563795b325e4029c40.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 4884⤵
- Program crash
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
-
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
-
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.GandCrypt.pf-fec7120fce467903fe6e63ecd387c9c7a0c8c8394b3d9313c150727b3688991b.exeTrojan-Ransom.Win32.GandCrypt.pf-fec7120fce467903fe6e63ecd387c9c7a0c8c8394b3d9313c150727b3688991b.exe3⤵
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.GandCrypt.vf-ce5c683bf1b861e9ad8bb61b78d2d1100dbcf54544c90066e5e91595a79701d0.exeTrojan-Ransom.Win32.GandCrypt.vf-ce5c683bf1b861e9ad8bb61b78d2d1100dbcf54544c90066e5e91595a79701d0.exe3⤵
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122884⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 344404⤵
- Program crash
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
-
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
-
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.GandCrypt.xf-da8e7cf550e8ffb226418a12f91e38361117c4b7ea84f83d18d2f71f90fdf3ae.exeTrojan-Ransom.Win32.GandCrypt.xf-da8e7cf550e8ffb226418a12f91e38361117c4b7ea84f83d18d2f71f90fdf3ae.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 4364⤵
- Program crash
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
-
-
C:\Windows\SysWOW64\Shell.exe"C:\Windows\system32\Shell.exe"5⤵
-
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Gen.kwn-096bb2bde62238273995a3a4446818a4b6b7df00fadb7ea3d068d88ca8e2798f.exeTrojan-Ransom.Win32.Gen.kwn-096bb2bde62238273995a3a4446818a4b6b7df00fadb7ea3d068d88ca8e2798f.exe3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\#DECRYPT_MY_FILES#.txt4⤵
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\#DECRYPT_MY_FILES#.vbs4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\#DECRYPT_MY_FILES#.html4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7fff6c5e46f8,0x7fff6c5e4708,0x7fff6c5e47185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17356470524381770705,16655809370429887538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,17356470524381770705,16655809370429887538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,17356470524381770705,16655809370429887538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17356470524381770705,16655809370429887538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17356470524381770705,16655809370429887538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17356470524381770705,16655809370429887538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17356470524381770705,16655809370429887538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:85⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Gen.kwn-096bb2bde62238273995a3a4446818a4b6b7df00fadb7ea3d068d88ca8e2798f.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.GenericCryptor.cys-65deb10e590983d9e8e09bba4fcec93b36987a54f09c0813eb644eb634ed7673.exeTrojan-Ransom.Win32.GenericCryptor.cys-65deb10e590983d9e8e09bba4fcec93b36987a54f09c0813eb644eb634ed7673.exe3⤵
-
C:\Windows\SysWOW64\drivers\spools.exe"C:\Windows\SysWow64\drivers\spools.exe" "C:\Users\Admin\AppData\Local\Temp\vizez.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\vizez.exeC:\Users\Admin\AppData\Local\Temp\vizez.exe5⤵
-
-
-
C:\Windows\SysWOW64\shell.exe"C:\Windows\system32\shell.exe" "C:\Users\Admin\AppData\Local\Temp\_uinsey.bat"4⤵
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.GenericCryptor.czx-dcb87bc736421f9f63203c74f9cd5548d1b5bfd47587d699915b528e38f4fffe.exeTrojan-Ransom.Win32.GenericCryptor.czx-dcb87bc736421f9f63203c74f9cd5548d1b5bfd47587d699915b528e38f4fffe.exe3⤵
-
C:\Windows\SysWOW64\drivers\spools.exe"C:\Windows\SysWow64\drivers\spools.exe" "C:\Users\Admin\AppData\Local\Temp\vizez.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\vizez.exeC:\Users\Admin\AppData\Local\Temp\vizez.exe5⤵
-
-
-
C:\Windows\SysWOW64\shell.exe"C:\Windows\system32\shell.exe" "C:\Users\Admin\AppData\Local\Temp\_uinsey.bat"4⤵
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Locky.a-2b311111abb8fbc0591807f4f50132f87554cf37ee6aebfe40fad8bc28a0a391.exeTrojan-Ransom.Win32.Locky.a-2b311111abb8fbc0591807f4f50132f87554cf37ee6aebfe40fad8bc28a0a391.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sys7A4C.tmp"4⤵
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Onion.vwm-24b8a7ea4f027adb28c00bc8b4cf46ae40dbc23d577ec829dad79106a252bb74.exeTrojan-Ransom.Win32.Onion.vwm-24b8a7ea4f027adb28c00bc8b4cf46ae40dbc23d577ec829dad79106a252bb74.exe3⤵
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.Onion.vwm-24b8a7ea4f027adb28c00bc8b4cf46ae40dbc23d577ec829dad79106a252bb74.exeTrojan-Ransom.Win32.Onion.vwm-24b8a7ea4f027adb28c00bc8b4cf46ae40dbc23d577ec829dad79106a252bb74.exe4⤵
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.PolyRansom.bix-20fc16ef4cbf2b2fa836f7676636a2f21e1e3fb3dc0a7e104c74eb948f0029d5.exeTrojan-Ransom.Win32.PolyRansom.bix-20fc16ef4cbf2b2fa836f7676636a2f21e1e3fb3dc0a7e104c74eb948f0029d5.exe3⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\system32\explorer.exe4⤵
-
-
C:\Windows\SysWOW64\windihallssvc.exe"C:\Windows\System32\windihallssvc.exe" /i4⤵
-
-
C:\Windows\SysWOW64\windihallssvc.exe"C:\Windows\System32\windihallssvc.exe" /start4⤵
-
-
C:\Program Files (x86)\ModinHalls\mdihallsymsvc.da.exe"C:\Program Files (x86)\ModinHalls\mdihallsymsvc.da.exe" /stop4⤵
-
-
C:\Program Files (x86)\ModinHalls\mdihallsymsvc.da.exe"C:\Program Files (x86)\ModinHalls\mdihallsymsvc.da.exe" /u4⤵
-
-
C:\Program Files (x86)\ModinHalls\mdihallsymsvc.exe"C:\Program Files (x86)\ModinHalls\mdihallsymsvc.exe" /i4⤵
-
-
C:\Program Files (x86)\ModinHalls\mdihallsymsvc.exe"C:\Program Files (x86)\ModinHalls\mdihallsymsvc.exe" /start4⤵
-
-
-
C:\Users\Admin\Desktop\00370\Trojan-Ransom.Win32.PornoAsset.cwjb-2edf4ecb1c75775c6e585b42746115f02523fedd65f92e23d74b7d8957e7292e.exeTrojan-Ransom.Win32.PornoAsset.cwjb-2edf4ecb1c75775c6e585b42746115f02523fedd65f92e23d74b7d8957e7292e.exe3⤵
-
C:\Windows\SysWOW64\Akfdcq32.exeC:\Windows\system32\Akfdcq32.exe4⤵
-
C:\Windows\SysWOW64\Adnilfnl.exeC:\Windows\system32\Adnilfnl.exe5⤵
-
C:\Windows\SysWOW64\Afnefieo.exeC:\Windows\system32\Afnefieo.exe6⤵
-
C:\Windows\SysWOW64\Aohfdnil.exeC:\Windows\system32\Aohfdnil.exe7⤵
-
C:\Windows\SysWOW64\Aeglbeea.exeC:\Windows\system32\Aeglbeea.exe8⤵
-
C:\Windows\SysWOW64\Bnbmqjjo.exeC:\Windows\system32\Bnbmqjjo.exe9⤵
-
C:\Windows\SysWOW64\Bflagg32.exeC:\Windows\system32\Bflagg32.exe10⤵
-
C:\Windows\SysWOW64\Bkhjpn32.exeC:\Windows\system32\Bkhjpn32.exe11⤵
-
C:\Windows\SysWOW64\Beaohcmf.exeC:\Windows\system32\Beaohcmf.exe12⤵
-
C:\Windows\SysWOW64\Cbglgg32.exeC:\Windows\system32\Cbglgg32.exe13⤵
-
C:\Windows\SysWOW64\Chfaenfb.exeC:\Windows\system32\Chfaenfb.exe14⤵
-
C:\Windows\SysWOW64\Cfgace32.exeC:\Windows\system32\Cfgace32.exe15⤵
-
C:\Windows\SysWOW64\Cnbfgh32.exeC:\Windows\system32\Cnbfgh32.exe16⤵
-
C:\Windows\SysWOW64\Cihjeq32.exeC:\Windows\system32\Cihjeq32.exe17⤵
-
C:\Windows\SysWOW64\Cfljnejl.exeC:\Windows\system32\Cfljnejl.exe18⤵
-
C:\Windows\SysWOW64\Dpdogj32.exeC:\Windows\system32\Dpdogj32.exe19⤵
-
C:\Windows\SysWOW64\Dojlhg32.exeC:\Windows\system32\Dojlhg32.exe20⤵
-
C:\Windows\SysWOW64\Diopep32.exeC:\Windows\system32\Diopep32.exe21⤵
-
C:\Windows\SysWOW64\Dfcqod32.exeC:\Windows\system32\Dfcqod32.exe22⤵
-
C:\Windows\SysWOW64\Donecfao.exeC:\Windows\system32\Donecfao.exe23⤵
-
C:\Windows\SysWOW64\Dehnpp32.exeC:\Windows\system32\Dehnpp32.exe24⤵
-
C:\Windows\SysWOW64\Doqbifpl.exeC:\Windows\system32\Doqbifpl.exe25⤵
-
C:\Windows\SysWOW64\Eldbbjof.exeC:\Windows\system32\Eldbbjof.exe26⤵
-
C:\Windows\SysWOW64\Elgohj32.exeC:\Windows\system32\Elgohj32.exe27⤵
-
C:\Windows\SysWOW64\Elilmi32.exeC:\Windows\system32\Elilmi32.exe28⤵
-
C:\Windows\SysWOW64\Eohhie32.exeC:\Windows\system32\Eohhie32.exe29⤵
-
C:\Windows\SysWOW64\Ebeapc32.exeC:\Windows\system32\Ebeapc32.exe30⤵
-
C:\Windows\SysWOW64\Ehbihj32.exeC:\Windows\system32\Ehbihj32.exe31⤵
-
C:\Windows\SysWOW64\Fgcjea32.exeC:\Windows\system32\Fgcjea32.exe32⤵
-
C:\Windows\SysWOW64\Flpbnh32.exeC:\Windows\system32\Flpbnh32.exe33⤵
-
C:\Windows\SysWOW64\Fgffka32.exeC:\Windows\system32\Fgffka32.exe34⤵
-
C:\Windows\SysWOW64\Foakpc32.exeC:\Windows\system32\Foakpc32.exe35⤵
-
C:\Windows\SysWOW64\Fifomlap.exeC:\Windows\system32\Fifomlap.exe36⤵
-
C:\Windows\SysWOW64\Fcodfa32.exeC:\Windows\system32\Fcodfa32.exe37⤵
-
C:\Windows\SysWOW64\Ggoiap32.exeC:\Windows\system32\Ggoiap32.exe38⤵
-
C:\Windows\SysWOW64\Gojnfb32.exeC:\Windows\system32\Gojnfb32.exe39⤵
-
C:\Windows\SysWOW64\Glnnofhi.exeC:\Windows\system32\Glnnofhi.exe40⤵
-
C:\Windows\SysWOW64\Giboijgb.exeC:\Windows\system32\Giboijgb.exe41⤵
-
C:\Windows\SysWOW64\Ggfobofl.exeC:\Windows\system32\Ggfobofl.exe42⤵
-
C:\Windows\SysWOW64\Ggilgn32.exeC:\Windows\system32\Ggilgn32.exe43⤵
-
C:\Windows\SysWOW64\Hjieii32.exeC:\Windows\system32\Hjieii32.exe44⤵
-
C:\Windows\SysWOW64\Hjnndime.exeC:\Windows\system32\Hjnndime.exe45⤵
-
C:\Windows\SysWOW64\Hfgloiqf.exeC:\Windows\system32\Hfgloiqf.exe46⤵
-
C:\Windows\SysWOW64\Imcqacfq.exeC:\Windows\system32\Imcqacfq.exe47⤵
-
C:\Windows\SysWOW64\Imfmgcdn.exeC:\Windows\system32\Imfmgcdn.exe48⤵
-
C:\Windows\SysWOW64\Ifqoehhl.exeC:\Windows\system32\Ifqoehhl.exe49⤵
-
C:\Windows\SysWOW64\Ioicnn32.exeC:\Windows\system32\Ioicnn32.exe50⤵
-
C:\Windows\SysWOW64\Jonlimkg.exeC:\Windows\system32\Jonlimkg.exe51⤵
-
C:\Windows\SysWOW64\Jginej32.exeC:\Windows\system32\Jginej32.exe52⤵
-
C:\Windows\SysWOW64\Kcbkpj32.exeC:\Windows\system32\Kcbkpj32.exe53⤵
-
C:\Windows\SysWOW64\Kgqdfi32.exeC:\Windows\system32\Kgqdfi32.exe54⤵
-
C:\Windows\SysWOW64\Kaihonhl.exeC:\Windows\system32\Kaihonhl.exe55⤵
-
C:\Windows\SysWOW64\Kpnepk32.exeC:\Windows\system32\Kpnepk32.exe56⤵
-
C:\Windows\SysWOW64\Kanbjn32.exeC:\Windows\system32\Kanbjn32.exe57⤵
-
C:\Windows\SysWOW64\Ljffccjh.exeC:\Windows\system32\Ljffccjh.exe58⤵
-
C:\Windows\SysWOW64\Lhopgg32.exeC:\Windows\system32\Lhopgg32.exe59⤵
-
C:\Windows\SysWOW64\Mhefhf32.exeC:\Windows\system32\Mhefhf32.exe60⤵
-
C:\Windows\SysWOW64\Mjfoja32.exeC:\Windows\system32\Mjfoja32.exe61⤵
-
C:\Windows\SysWOW64\Mdaqhf32.exeC:\Windows\system32\Mdaqhf32.exe62⤵
-
C:\Windows\SysWOW64\Nmnnlk32.exeC:\Windows\system32\Nmnnlk32.exe63⤵
-
C:\Windows\SysWOW64\Nhhldc32.exeC:\Windows\system32\Nhhldc32.exe64⤵
-
C:\Windows\SysWOW64\Niihlkdm.exeC:\Windows\system32\Niihlkdm.exe65⤵
-
C:\Windows\SysWOW64\Ohaokbfd.exeC:\Windows\system32\Ohaokbfd.exe66⤵
-
C:\Windows\SysWOW64\Pgihanii.exeC:\Windows\system32\Pgihanii.exe67⤵
-
C:\Windows\SysWOW64\Pdofpb32.exeC:\Windows\system32\Pdofpb32.exe68⤵
-
C:\Windows\SysWOW64\Phpklp32.exeC:\Windows\system32\Phpklp32.exe69⤵
-
C:\Windows\SysWOW64\Qpmmfbfl.exeC:\Windows\system32\Qpmmfbfl.exe70⤵
-
C:\Windows\SysWOW64\Akenij32.exeC:\Windows\system32\Akenij32.exe71⤵
-
C:\Windows\SysWOW64\Anhcpeon.exeC:\Windows\system32\Anhcpeon.exe72⤵
-
C:\Windows\SysWOW64\Akopoi32.exeC:\Windows\system32\Akopoi32.exe73⤵
-
C:\Windows\SysWOW64\Bkamdi32.exeC:\Windows\system32\Bkamdi32.exe74⤵
-
C:\Windows\SysWOW64\Bnaffdfc.exeC:\Windows\system32\Bnaffdfc.exe75⤵
-
C:\Windows\SysWOW64\Bkhceh32.exeC:\Windows\system32\Bkhceh32.exe76⤵
-
C:\Windows\SysWOW64\Bgodjiio.exeC:\Windows\system32\Bgodjiio.exe77⤵
-
C:\Windows\SysWOW64\Cebdcmhh.exeC:\Windows\system32\Cebdcmhh.exe78⤵
-
C:\Windows\SysWOW64\Ckmmpg32.exeC:\Windows\system32\Ckmmpg32.exe79⤵
-
C:\Windows\SysWOW64\Cqiehnml.exeC:\Windows\system32\Cqiehnml.exe80⤵
-
C:\Windows\SysWOW64\Cgcmeh32.exeC:\Windows\system32\Cgcmeh32.exe81⤵
-
C:\Windows\SysWOW64\Cgejkh32.exeC:\Windows\system32\Cgejkh32.exe82⤵
-
C:\Windows\SysWOW64\Cnpbgajc.exeC:\Windows\system32\Cnpbgajc.exe83⤵
-
C:\Windows\SysWOW64\Dndlba32.exeC:\Windows\system32\Dndlba32.exe84⤵
-
C:\Windows\SysWOW64\Dioiki32.exeC:\Windows\system32\Dioiki32.exe85⤵
-
C:\Windows\SysWOW64\Dalkek32.exeC:\Windows\system32\Dalkek32.exe86⤵
-
C:\Windows\SysWOW64\Eblgon32.exeC:\Windows\system32\Eblgon32.exe87⤵
-
C:\Windows\SysWOW64\Engaon32.exeC:\Windows\system32\Engaon32.exe88⤵
-
C:\Windows\SysWOW64\Eeailhme.exeC:\Windows\system32\Eeailhme.exe89⤵
-
C:\Windows\SysWOW64\Ebejem32.exeC:\Windows\system32\Ebejem32.exe90⤵
-
C:\Windows\SysWOW64\Fhbbmc32.exeC:\Windows\system32\Fhbbmc32.exe91⤵
-
C:\Windows\SysWOW64\Fbggkl32.exeC:\Windows\system32\Fbggkl32.exe92⤵
-
C:\Windows\SysWOW64\Falcli32.exeC:\Windows\system32\Falcli32.exe93⤵
-
C:\Windows\SysWOW64\Fkehdnee.exeC:\Windows\system32\Fkehdnee.exe94⤵
-
C:\Windows\SysWOW64\Faopah32.exeC:\Windows\system32\Faopah32.exe95⤵
-
C:\Windows\SysWOW64\Flddoa32.exeC:\Windows\system32\Flddoa32.exe96⤵
-
C:\Windows\SysWOW64\Focakm32.exeC:\Windows\system32\Focakm32.exe97⤵
-
C:\Windows\SysWOW64\Fkiapn32.exeC:\Windows\system32\Fkiapn32.exe98⤵
-
C:\Windows\SysWOW64\Ghmbib32.exeC:\Windows\system32\Ghmbib32.exe99⤵
-
C:\Windows\SysWOW64\Glkkop32.exeC:\Windows\system32\Glkkop32.exe100⤵
-
C:\Windows\SysWOW64\Ghbkdald.exeC:\Windows\system32\Ghbkdald.exe101⤵
-
C:\Windows\SysWOW64\Geflne32.exeC:\Windows\system32\Geflne32.exe102⤵
-
C:\Windows\SysWOW64\Gkeakl32.exeC:\Windows\system32\Gkeakl32.exe103⤵
-
C:\Windows\SysWOW64\Haafnf32.exeC:\Windows\system32\Haafnf32.exe104⤵
-
C:\Windows\SysWOW64\Hkjjfkcm.exeC:\Windows\system32\Hkjjfkcm.exe105⤵
-
C:\Windows\SysWOW64\Hikkdc32.exeC:\Windows\system32\Hikkdc32.exe106⤵
-
C:\Windows\SysWOW64\Hhpheo32.exeC:\Windows\system32\Hhpheo32.exe107⤵
-
C:\Windows\SysWOW64\Hipdpbgf.exeC:\Windows\system32\Hipdpbgf.exe108⤵
-
C:\Windows\SysWOW64\Iefedcmk.exeC:\Windows\system32\Iefedcmk.exe109⤵
-
C:\Windows\SysWOW64\Ikcmmjkb.exeC:\Windows\system32\Ikcmmjkb.exe110⤵
-
C:\Windows\SysWOW64\Lpdefc32.exeC:\Windows\system32\Lpdefc32.exe111⤵
-
C:\Windows\SysWOW64\Limioiia.exeC:\Windows\system32\Limioiia.exe112⤵
-
C:\Windows\SysWOW64\Llpofd32.exeC:\Windows\system32\Llpofd32.exe113⤵
-
C:\Windows\SysWOW64\Miflehaf.exeC:\Windows\system32\Miflehaf.exe114⤵
-
C:\Windows\SysWOW64\Mihikgod.exeC:\Windows\system32\Mihikgod.exe115⤵
-
C:\Windows\SysWOW64\Mpbaga32.exeC:\Windows\system32\Mpbaga32.exe116⤵
-
C:\Windows\SysWOW64\Mlialb32.exeC:\Windows\system32\Mlialb32.exe117⤵
-
C:\Windows\SysWOW64\Mjjbjjdd.exeC:\Windows\system32\Mjjbjjdd.exe118⤵
-
C:\Windows\SysWOW64\Nbhcdl32.exeC:\Windows\system32\Nbhcdl32.exe119⤵
-
C:\Windows\SysWOW64\Nbjpjl32.exeC:\Windows\system32\Nbjpjl32.exe120⤵
-
C:\Windows\SysWOW64\Ndjldo32.exeC:\Windows\system32\Ndjldo32.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-