Overview

overview

10

Static

static

3

2016-08-26...e2.exe

windows7-x64

10

2016-08-30...e2.exe

windows7-x64

10

2016-09-14...re.exe

windows7-x64

10

2016-09-16...e2.exe

windows7-x64

10

2016-09-19...e2.exe

windows7-x64

10

2016-09-21...om.exe

windows7-x64

10

2016-09-27...er.exe

windows7-x64

7

2016-09-28...om.exe

windows7-x64

10

2016-09-28...om.exe

windows7-x64

10

2016-09-29...e2.exe

windows7-x64

10

2016-09-29...e2.exe

windows7-x64

10

2016-10-04...er.exe

windows7-x64

7

2016-10-05...e2.exe

windows7-x64

10

2016-10-06...e2.exe

windows7-x64

10

2016-10-12...er.exe

windows7-x64

7

2016-10-14...er.exe

windows7-x64

7

2016-10-18...e2.exe

windows7-x64

10

2016-10-23...er.exe

windows7-x64

7

2016-10-28...e2.exe

windows7-x64

10

2016-11-07...e2.exe

windows7-x64

10

2016-11-08...e2.exe

windows7-x64

10

2016-11-09...e2.exe

windows7-x64

10

2016-11-15...e2.exe

windows7-x64

10

2016-11-16...e2.exe

windows7-x64

10

2016-11-21...e2.exe

windows7-x64

10

2017-03-15...si.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2018-01-28...re.exe

windows7-x64

10

Analysis

  • max time kernel
    1561s
  • max time network
    1562s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    11-11-2024 07:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2016-09-19-EITest-Rig-EK-payload-CryptFile2.exe

  • Size

    96KB

  • MD5

    df80cbaadb754de14c97dc05995fdc4a

  • SHA1

    6f9369c9d2f174b4abd642d4fb43cff690f364df

  • SHA256

    43fbc1ee5c4ef4a5bfdbbd67407c4364e6cf205475250f97138f55db4c77002c

  • SHA512

    cccf010d4344bd574dea5a254800207b8603b1ff2dcae8d4b341c4368976544ebee9fc68632701be3ab41098ab0c6b64f2b61f27063a068777e3bc440bac01d7

  • SSDEEP

    1536:umsz2jF1PzSg1dPVHT4MVyU3NJZfA1111111bilpPXvlMq12Kpuyjg1kFa:hdPV8uyU3zJA1111111bilpPX6q2y8kc

Score
10/10
defense_evasiondiscoveryexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-2048 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions: Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours. For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private softWare with a low price! E-MAIL1: [email protected] E-MAIL2: [email protected] Spare email: E-MAIL1: [email protected] E-MAIL2: [email protected]

Extracted

Path

C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-2048 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions: Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours. For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private softWare with a low price! E-MAIL1: [email protected] E-MAIL2: [email protected] Spare email: E-MAIL1: [email protected] E-MAIL2: [email protected] YOUR_ID: 8d2f77761c9b74ea

Extracted

Path

C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.HTML

Ransom Note
<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>HELP_DECRYPT_YOUR_FILES</title> <style> .text { text-align: center; } </style> </head> <body> <div class="text"> <strong>NOT YOUR LANGUAGE?</strong> USE <a href="https://translate.google.com">https://translate.google.com</a><br><br> <strong>What happened to your files ?</strong><br> All of your files were protected by a strong encryption with RSA-2048.<br> More information about the encryption keys using RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br><br> <strong>How did this happen ?</strong><br> !!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.<br> !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.<br> !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server <br><br> <strong>What do I do ?</strong><br> So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.<br> If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.<br><br> <strong>For more specific instructions:</strong><br> Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours. <br> For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. <br> Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private softWare with a low price! <br> <strong>E-MAIL1:</strong> [email protected]<br> <strong>E-MAIL2:</strong> [email protected]<br> Spare email if we do not respond within 24 hours:<br> <strong>E-MAIL1:</strong> [email protected]<br> <strong>E-MAIL2:</strong> [email protected]<br>

Extracted

Path

C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.HTML

Ransom Note
<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>HELP_DECRYPT_YOUR_FILES</title> <style> .text { text-align: center; } </style> </head> <body> <div class="text"> <strong>NOT YOUR LANGUAGE?</strong> USE <a href="https://translate.google.com">https://translate.google.com</a><br><br> <strong>What happened to your files ?</strong><br> All of your files were protected by a strong encryption with RSA-2048.<br> More information about the encryption keys using RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br><br> <strong>How did this happen ?</strong><br> !!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.<br> !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.<br> !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server <br><br> <strong>What do I do ?</strong><br> So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.<br> If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.<br><br> <strong>For more specific instructions:</strong><br> Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours. <br> For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. <br> Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private softWare with a low price! <br> <strong>E-MAIL1:</strong> [email protected]<br> <strong>E-MAIL2:</strong> [email protected]<br> Spare email if we do not respond within 24 hours:<br> <strong>E-MAIL1:</strong> [email protected]<br> <strong>E-MAIL2:</strong> [email protected]<br> <strong>YOUR_ID: 8d2f77761c9b74ea</strong> </div> </body> </html>

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 27 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2016-09-19-EITest-Rig-EK-payload-CryptFile2.exe
    "C:\Users\Admin\AppData\Local\Temp\2016-09-19-EITest-Rig-EK-payload-CryptFile2.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:912
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2144
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=Z: /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1676
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:344
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=Y: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:292
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=X: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2140
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:740
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=W: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:812
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2052
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=V: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1824
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2176
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=U: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2564
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2456
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=T: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2192
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1944
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=S: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1976
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:876
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=R: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1356
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2408
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=Q: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2636
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1704
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=P: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2240
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2372
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=O: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1144
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2660
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=N: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2520
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2924
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=M: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1340
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2648
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=L: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:316
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2396
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=K: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1192
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All /Quiet
      2⤵
        PID:868
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=J: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:1608
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1496
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=I: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:1028
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:236
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=H: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:3008
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2848
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=G: /All /Quiet
          3⤵
          • Interacts with shadow copies
          PID:2672
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2996
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=F: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:808
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All /Quiet
        2⤵
          PID:2168
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin Delete Shadows /For=E: /All /Quiet
            3⤵
            • System Location Discovery: System Language Discovery
            • Interacts with shadow copies
            PID:1736
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All /Quiet
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1484
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin Delete Shadows /For=D: /All /Quiet
            3⤵
            • System Location Discovery: System Language Discovery
            • Interacts with shadow copies
            PID:1980
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All /Quiet
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2056
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin Delete Shadows /For=C: /All /Quiet
            3⤵
            • System Location Discovery: System Language Discovery
            • Interacts with shadow copies
            PID:2688
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All /Quiet
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1528
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin Delete Shadows /For=B: /All /Quiet
            3⤵
            • System Location Discovery: System Language Discovery
            • Interacts with shadow copies
            PID:2172
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All /Quiet
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1820
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin Delete Shadows /For=A: /All /Quiet
            3⤵
            • Interacts with shadow copies
            PID:2840
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C net stop vss
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2992
          • C:\Windows\SysWOW64\net.exe
            net stop vss
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2108
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop vss
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1064
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1264
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1680
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" bcdedit /set {default} recoveryenabled No
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1156
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" bcdedit /set {default} bootstatuspolicy ignoreallfailures
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1148
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" bcdedit /set bootstatuspolicy ignoreallfailures
          2⤵
          • System Location Discovery: System Language Discovery
          PID:304
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set bootstatuspolicy ignoreallfailures
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2844
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" bcdedit /set recoveryenabled NO
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1480
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set recoveryenabled NO
          2⤵
            PID:1508
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            2⤵
            • System Location Discovery: System Language Discovery
            PID:904
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" wbadmin delete catalog -quiet
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2956
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Documents\HELP_DECRYPT_YOUR_FILES.HTML
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:2256
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
              3⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2636
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\HELP_DECRYPT_YOUR_FILES.TXT
            2⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:556
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2936
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "-1822762211-158416121773534858221467187870380233711238535671277788979385332675"
          1⤵
            PID:2192

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.HTML
            Filesize

            2KB

            MD5

            57822a64d552903475a93bfe2ec0dd52

            SHA1

            c8e9aa9103ce46820574517cf76f4a4712d833b1

            SHA256

            d6309e4da77dca5a4212383d7ef27cece1b5f936be48e834712aa53dab7f3067

            SHA512

            b7ce999a200c676ac2b7115196b55ca639bf60807bfa833f46e93532ff8c5b06e9d02f4d7bb46928e7c0777654ae7240b7ea8e2722988eb013d74feeeead3ff0

            Download Submit

          • C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.HTML
            Filesize

            2KB

            MD5

            9a64005b176a3edcf8c1c47e41afb7a1

            SHA1

            0459a9f760b603d2c50e8c2beef3c3b36419167d

            SHA256

            26221c67c79e42caff4541636a938a8d8a5dd1419ef12fbb21c99d51b46ecff5

            SHA512

            24dc81bfce6c2fb1a8feb2ad9282f5453e626eece05e709588b230da74dc291ffbeaa63511911822bd711ac05730932ab2e13bcddbcf4f98e6c1d8c59821d265

            Download Submit

          • C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT
            Filesize

            3KB

            MD5

            972f9c7ca92bdd403211c676f58ec04e

            SHA1

            5c55e21f43c2679723a8f12ccb62513d0de8e65c

            SHA256

            4cf3e907cfd20fa534421e0dc3ae894d24cae11051fe4281b9696bb91af00e58

            SHA512

            6d04a6b40a2d39a864200eb5a60813de0e11fb9aadbeecfbbbf98181fe5e7dc686d347f77e5464b9ead7b8f023431b59e2b5ed52b635ea66014241f1178a7170

            Download Submit

          • C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT
            Filesize

            3KB

            MD5

            b95ed4a8edef8ddea3f6cab2777cf821

            SHA1

            42c3d2b6f39779b372bd437cf3f47c10fb1c10e9

            SHA256

            7e271b1e1c810d49c214592db2f0cb40c2154af7d56ef326427d9cbfa0be236e

            SHA512

            c45baebb7c4636c341c1418267b7fe41b40cd7994719bee83f3d171d6dc69f11b311c1424135f6e7b12f0738faaa626fa86278814bac8c19e9fc844931914c9c

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
            Filesize

            914B

            MD5

            e4a68ac854ac5242460afd72481b2a44

            SHA1

            df3c24f9bfd666761b268073fe06d1cc8d4f82a4

            SHA256

            cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

            SHA512

            5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
            Filesize

            1KB

            MD5

            a266bb7dcc38a562631361bbf61dd11b

            SHA1

            3b1efd3a66ea28b16697394703a72ca340a05bd5

            SHA256

            df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

            SHA512

            0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
            Filesize

            252B

            MD5

            c453001e6bd7d85f5276186eb2e8f9d3

            SHA1

            5386b889ae12610f5fd82601db8c021c3028da4b

            SHA256

            780c327621c69e3cdbf5c35edb0498bf5321ba4622e101c929e5574bbd58b82b

            SHA512

            29334314643085ac6164f46b9f5ba74097659516c0c54f4719968a9f0207979ab744648b7c2d6a5dfe4988b3c8ad832199a590328c972f3b0433467871b79ed6

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            7a1dbbbbf06ae9de003432a032db4c54

            SHA1

            4ecad120ce5d230ace6afbb1be84846318f326cc

            SHA256

            84ab7f5fa9649ca8872e8f17987f7bbebed5815a71316602599e7890dbb59ef2

            SHA512

            59bfbee80d3696ebf31d05f4f14091bf18803e83d0f961f69397c6c87116e393556fec9fdd600309725786a9f081b7c3af4099725785d13089e729b8aeaa597b

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            745cb2d0a26f3bfc403ad52bdf38e96d

            SHA1

            9e9afff480e65cd4e9e04ce08af6aab53b43cfd4

            SHA256

            58a370b2be1d87b6ea0bce032124502a1177101df367fac2b87fa321241989d1

            SHA512

            392019fee9b89fea5ec0a2d7eee4ae555c52b7bc9a30179d80a8cd15d5ec0e2689d72e142b3589763ece9f2a1986b7d57a3fcc3ef5ae98d85bec92cb89700be4

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            2f1ab34ad23af73b34b9aeaafd37b20c

            SHA1

            7e6f1679cafbe7e512067ed1fc2179369f72383d

            SHA256

            67e0d37fdf883ac6365e1ca49cb9537ec5014a964fe021891309cd1a50e01891

            SHA512

            ef9870376c190f1ff4743ffdfc225be66ae435f3c4ad5c5cecee67846fc57b824f94eaf947dba1c82c12f92d8488f20b11e95b5154d81c39deba41b94526321d

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            f104573d4588257757a5c05c84947bc9

            SHA1

            08bdd86a5318bb51e3ed895c9b957680169b2075

            SHA256

            ea1ea2a37eb5be1539a53c075ee9dfee830c541e0f23d38d9807388f80ac4742

            SHA512

            f0d09f80cabf00fa67a7003f629af6d3d6ae51e6c7d63f3b28ce241aa85d7ca1ef616facd956a7c3edff401b3267e07f20f1b6cddf65eebbe6c8c3c63511487c

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            5219f41af5d8f11f861af16529510d05

            SHA1

            48f52a46a6b541eaadc79015a1f44faed1914708

            SHA256

            400a854dc68e3247820e2488522628c0368330823c62dd5d80b4db974c1afba4

            SHA512

            ce6fc066011e7b8e2ae904b4c3af9de63ad8687dde43c8f6cd5e78b03527d27e37d2c7590dcd00afed7726e9a027c8c43c3f66e82680be99ab0146f5d7f1cf7d

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            c71c00f61e36a6ecfeb19700f3373ec9

            SHA1

            8f1bec941ba3a0b744c52aa92e01230147233390

            SHA256

            feb94454d42489dd4b1799f9fb0a2979ca6ca06e11a01c2cb359871a44a164f6

            SHA512

            8c8d3b1c47e398ed38a269955bc189b53b6b9bf3cf717b6d45d5b86d9bf39337b6debd6a4728ce80b58796fd8911292c53cfcd90e40ad5d68dd2eb425d20a892

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            f1ad4162a2321cb44014352788783e34

            SHA1

            3f766dedd6fa2ab41bd8250c394c3d14ff19f021

            SHA256

            34394622bf0d78ff76dbffecac39c55a11c575ee4b36c0167f948317a048f565

            SHA512

            3869bad207c84db79359b2c99d63078f9e3711ff13c66087e725d0f030b0b97942f32026068592ac5d0b346ff612c3a0db86b2dd624ea9980d4d9d173fd16c1e

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            4b85daeb279dad6bd8601343da224a51

            SHA1

            0d000487a208e3c95ac81b488e04fbe91092e9d2

            SHA256

            e9fb8c3d069ef4d2c87270cbf019c75af5758f2db51aa72af7299c118fbc486d

            SHA512

            1fc72bf77203da6681847687d31097c685d74730e9d0497ed1cdf052f46e8e6091d5fdac2a72d1a6ccfd562c9aaadbe02455c8880c4a5108fc348d8078a71616

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            1de600ec133c3fdfc45bc7936055d05c

            SHA1

            af8b68434fc17c516d5b91729dd23225467671c7

            SHA256

            e509130e427e94ce9edda80d7ae614c888b8a0814830200d1d74bd94b636e122

            SHA512

            fdae0a34213302695d3421a3dbb0744819931ee0668a90099948193cc5fc484c9b8db2a325f2e8013c1f70e272b2712fea20057f2e222dd28120d4c26a0d2139

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            9951d7e6c604102ec5bcc01c1c1e5188

            SHA1

            9a5498cf882ba4d88ae49ffd02a90cb341fdef43

            SHA256

            339efd7ef387e77387fe8f8832d459f67dc190fed98cfd95cd165b6466186c9b

            SHA512

            c215741fddc50cc8379d2518844cd467e0851432fb698f53e164eac51fe0a3883a3d6f31f45300b9906cd4fd26578ff533a125c968b966072a8db435299d8cd4

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            7a755ce271a06b08dccfc88cc1cc11a1

            SHA1

            49ce9ee825b11422a933438498a9f0255b2d5146

            SHA256

            10a6d157acf744cc2e18213d94b34be966a877c4db75931515bd1a4af5a29ebc

            SHA512

            73375ddd8dec66ead06f57dd8f4d5daf8fc3d69bf2735684127ffa04cb4f127a79a5621d68adbdd5148cad076513209f1e6cc0b5ec07e15eb1df3a6dc07aa364

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
            Filesize

            242B

            MD5

            d90247f6b9d50fda13b57596de3e5380

            SHA1

            28e260651fffe51eaea47bbf1fa74c5191a7607d

            SHA256

            e9b984031b4f6f8c87f239f7ab06e6c12980635d1387b54c88b716e0d72f6f2c

            SHA512

            1510b9e23f752f28b043de408ee740232cf711ff23618d4e0c3ca54f47e861717201d69366de280b3c98696d242ac5d2af22a4df891b8f5f10a9ac6a01f324bb

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\CabFF38.tmp
            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\TarFF6A.tmp
            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

            Download Submit

          • memory/956-0-0x0000000000090000-0x000000000009B000-memory.dmp

            Filesize

            44KB

            Download