Malware Analysis Report

2024-12-07 10:16

Sample ID 241112-w51xdaydml
Target RNSM00321.7z
SHA256 cf84b6904959baa0816cd0cb39f834844b61c03bd9fa6764b4938de38bca1285
Tags
credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cf84b6904959baa0816cd0cb39f834844b61c03bd9fa6764b4938de38bca1285

Threat Level: Known bad

The file RNSM00321.7z was found to be: Known bad.

Malicious Activity Summary

credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Renames multiple (284) files with added filename extension

Deletes shadow copies

Loads dropped DLL

Reads user/profile data of web browsers

Credentials from Password Stores: Windows Credential Manager

Executes dropped EXE

Drops startup file

Enumerates connected drives

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

NSIS installer

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Delays execution with timeout.exe

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 18:31

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 18:31

Reported

2024-11-12 18:32

Platform

win7-20240729-en

Max time kernel

51s

Max time network

34s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00321.7z"

Signatures

Deletes shadow copies

ransomware defense_evasion impact execution

Renames multiple (284) files with added filename extension

ransomware

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RESTORE-SIGRUN.txt C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RESTORE-SIGRUN.html C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\I0ZNEgzN8ZzXCe7nZ28zfw0laV84 = "C:\\Users\\Admin\\AppData\\Roaming\\Egsumpd8cBsvV7nPkX8JeZ3WFcIY.exe" C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\JoinConnect.ttc C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\SetCopy.M2T C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\TestUse.pub C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\RESTORE-SIGRUN.html C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RESTORE-SIGRUN.txt C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File created C:\Program Files\RESTORE-SIGRUN.txt C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\RESTORE-SIGRUN.txt C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\FormatMeasure.potx C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\UseInstall.avi C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RESTORE-SIGRUN.html C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\StopGet.pptx C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\RemoveExport.7z C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\SelectRemove.odt C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\UndoMount.snd C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\UnregisterDisable.ttf C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File created C:\Program Files (x86)\RESTORE-SIGRUN.txt C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\OutLock.wma C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\ClearDebug.dotx C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\LimitRegister.wm C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\MergeSplit.rar C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\SetSync.zip C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\BackupAssert.mov C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File created C:\Program Files (x86)\RESTORE-SIGRUN.html C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\ConvertFromDismount.easmx C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\ImportHide.m4v C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\MeasureRegister.mht C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\SendConvert.avi C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File opened for modification C:\Program Files\UpdateAdd.vbe C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RESTORE-SIGRUN.txt C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RESTORE-SIGRUN.html C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
File created C:\Program Files\RESTORE-SIGRUN.html C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\00321\HEUR-Trojan-Ransom.Win32.Generic-0f154672427b1c1193a76d3ee72a849b9adebcd9439958f88ae62135333a96ef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wbem\wmic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Office loads VBA resources, possible macro or embedded object present

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000277de52a65cf5a48afd0188bf53b01410000000002000000000010660000000100002000000026b7db37a772d9915331bd440645cf41c9f1177a80b9ec32bab38addf4e762ff000000000e8000000002000020000000050f4cdbe76031b81cb27bc97983905651ad6b97e69a629cb5f107e5c35a9de420000000f8069d07fb685856e9c19648fcaeeee6c6b986deacd1a4bcdef42d01e31bc861400000004c3b782211eb1a61853b9f335b0e4dcd3ab6467f90b6e2954a143009d6b828fe37b555d47a6cee6a5d7ca64df0c8f634ad99a3bb2e301156543a9fc6c753ca6f C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004582273135db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51BB1361-A124-11EF-B40C-C6FE053A976A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000277de52a65cf5a48afd0188bf53b01410000000002000000000010660000000100002000000069e826aa3d73fc1c8f97ee7c9ca12f9190c2f365d655335ab7397d504d4508dd000000000e800000000200002000000005c555d809db4093270668bbcb78543c558b8697326f264bb5280457e0fb8ae090000000df3066e6928c1114dfb5062c4cf38fe01bec63dcda5f7073c43f0e020f8da4a2c8c3f460bbcfdece61047b3dac8cb45ed6e642bda203c94e07c13e2f3c4ba4d8dc7a2f5612ecf139f6f79b9728761f1cd217b8846e9599aab79546a8dd5d7918a24084ab70e0af232c4f7c5ac859f3985844b874d8a8fb16066301c37c515d112d321bbf747643ab784df660cf1c679d40000000e532641c1ec90facc64f19a49ee525d80afa4a0f2902e52399d9449191664cd096e66bf76bcf401e6eb41898b8f78ccf439f941ef4cea74a1640bd2721a1c567 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\00321\HEUR-Trojan-Ransom.Win32.Generic-0f154672427b1c1193a76d3ee72a849b9adebcd9439958f88ae62135333a96ef.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2596 wrote to memory of 1772 N/A C:\Users\Admin\Desktop\00321\HEUR-Trojan-Ransom.Win32.Generic-0f154672427b1c1193a76d3ee72a849b9adebcd9439958f88ae62135333a96ef.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2596 wrote to memory of 1772 N/A C:\Users\Admin\Desktop\00321\HEUR-Trojan-Ransom.Win32.Generic-0f154672427b1c1193a76d3ee72a849b9adebcd9439958f88ae62135333a96ef.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2596 wrote to memory of 1772 N/A C:\Users\Admin\Desktop\00321\HEUR-Trojan-Ransom.Win32.Generic-0f154672427b1c1193a76d3ee72a849b9adebcd9439958f88ae62135333a96ef.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2596 wrote to memory of 1772 N/A C:\Users\Admin\Desktop\00321\HEUR-Trojan-Ransom.Win32.Generic-0f154672427b1c1193a76d3ee72a849b9adebcd9439958f88ae62135333a96ef.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1772 wrote to memory of 2852 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1772 wrote to memory of 2852 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1772 wrote to memory of 2852 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1772 wrote to memory of 2852 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2584 wrote to memory of 1760 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Windows\SysWOW64\wbem\wmic.exe
PID 2584 wrote to memory of 1760 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Windows\SysWOW64\wbem\wmic.exe
PID 2584 wrote to memory of 1760 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Windows\SysWOW64\wbem\wmic.exe
PID 2584 wrote to memory of 1760 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Windows\SysWOW64\wbem\wmic.exe
PID 2584 wrote to memory of 1428 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2584 wrote to memory of 1428 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2584 wrote to memory of 1428 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2584 wrote to memory of 1428 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2584 wrote to memory of 2460 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2460 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2460 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2460 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2460 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2460 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2460 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1428 wrote to memory of 1424 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1428 wrote to memory of 1424 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1428 wrote to memory of 1424 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1428 wrote to memory of 1424 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1616 wrote to memory of 832 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.MSIL.Ranion.e-c18c9cf30056d9ebfda69bb9869a38b5ab2d2e3d388a747d7ec8516e022aa7e9.exe C:\Windows\System32\cmd.exe
PID 1616 wrote to memory of 832 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.MSIL.Ranion.e-c18c9cf30056d9ebfda69bb9869a38b5ab2d2e3d388a747d7ec8516e022aa7e9.exe C:\Windows\System32\cmd.exe
PID 1616 wrote to memory of 832 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.MSIL.Ranion.e-c18c9cf30056d9ebfda69bb9869a38b5ab2d2e3d388a747d7ec8516e022aa7e9.exe C:\Windows\System32\cmd.exe
PID 832 wrote to memory of 836 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\choice.exe
PID 832 wrote to memory of 836 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\choice.exe
PID 832 wrote to memory of 836 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\choice.exe
PID 1632 wrote to memory of 1152 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe
PID 1632 wrote to memory of 1152 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe
PID 1632 wrote to memory of 1152 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe
PID 1632 wrote to memory of 1152 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe
PID 1632 wrote to memory of 1152 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe
PID 1152 wrote to memory of 1432 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe C:\Windows\SysWOW64\explorer.exe
PID 1152 wrote to memory of 1432 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe C:\Windows\SysWOW64\explorer.exe
PID 1152 wrote to memory of 1432 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe C:\Windows\SysWOW64\explorer.exe
PID 1152 wrote to memory of 1432 N/A C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe C:\Windows\SysWOW64\explorer.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00321.7z"

C:\Users\Admin\Desktop\00321\HEUR-Trojan-Ransom.Win32.Generic-0f154672427b1c1193a76d3ee72a849b9adebcd9439958f88ae62135333a96ef.exe

"C:\Users\Admin\Desktop\00321\HEUR-Trojan-Ransom.Win32.Generic-0f154672427b1c1193a76d3ee72a849b9adebcd9439958f88ae62135333a96ef.exe"

C:\Users\Admin\Desktop\00321\Trojan-Ransom.MSIL.Ranion.e-c18c9cf30056d9ebfda69bb9869a38b5ab2d2e3d388a747d7ec8516e022aa7e9.exe

"C:\Users\Admin\Desktop\00321\Trojan-Ransom.MSIL.Ranion.e-c18c9cf30056d9ebfda69bb9869a38b5ab2d2e3d388a747d7ec8516e022aa7e9.exe"

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\00321\~$MCV(1).doc"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe

"C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe"

C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe

"C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe"

C:\Windows\SysWOW64\wbem\wmic.exe

"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\00321\RESTORE-SIGRUN.html

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe" /f /q

C:\Windows\SysWOW64\timeout.exe

timeout -c 5

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1428 CREDAT:275457 /prefetch:2

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\00321\Trojan-Ransom.MSIL.Ranion.e-c18c9cf30056d9ebfda69bb9869a38b5ab2d2e3d388a747d7ec8516e022aa7e9.exe"

C:\Windows\system32\choice.exe

choice /C Y /N /D Y /T 3

C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe

"C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\system32\explorer.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\00321\RESTORE-SIGRUN.txt

Network

Country Destination Domain Proto
DE 5.189.134.216:5156 tcp

Files

C:\Users\Admin\Desktop\00321\HEUR-Trojan-Ransom.Win32.Generic-0f154672427b1c1193a76d3ee72a849b9adebcd9439958f88ae62135333a96ef.exe

MD5 ec013067a4328f5e2fabd1ba28413a1c
SHA1 87992cee865bed9581c3e501a36c39c621183a60
SHA256 0f154672427b1c1193a76d3ee72a849b9adebcd9439958f88ae62135333a96ef
SHA512 3f46a4a4b39914b2c60cff937dd67d022cfbe7cf721f40ad2224191096a17700df4e86515d97f30ff472bb5103474320bd68cd4bd53c7ccd14faa3da109da601

C:\Users\Admin\Desktop\00321\Trojan-Ransom.MSIL.Ranion.e-c18c9cf30056d9ebfda69bb9869a38b5ab2d2e3d388a747d7ec8516e022aa7e9.exe

MD5 861a95a838e0256df7d2d83bc87ab44a
SHA1 1b473296ab70eabf01018687e352c180c98e542a
SHA256 c18c9cf30056d9ebfda69bb9869a38b5ab2d2e3d388a747d7ec8516e022aa7e9
SHA512 e74ea639f6cdc59ef086b9f89cce0b704a0a74ff4117b4e915cda698134900581ff2d99dcff77bde63d12f6dbe2eee656ae6aa1286ac2df187005e1b970c3b16

memory/1772-16-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1616-17-0x0000000001360000-0x00000000013AA000-memory.dmp

C:\Users\Admin\Desktop\00321\~$MCV(1).doc

MD5 6047b85190451fef796931a788ff1582
SHA1 5ad1463e43fa99f4be5fa4dac337327b8a0e5cce
SHA256 320e98646c25e9d53fc7736433514231a6cc3a8285c280488b2e1cd9e41275f1
SHA512 2f1323523a4cfdb5d9663968f370d0235e531dd18c129907788e814f7f8e4d79b01fbb7198ddb8c090e36fd9c103a631021592e168eca0034aa13f309fce0322

memory/1616-19-0x00000000001D0000-0x00000000001D6000-memory.dmp

memory/1616-20-0x0000000000B80000-0x0000000000BDA000-memory.dmp

memory/1616-21-0x00000000001E0000-0x00000000001E6000-memory.dmp

C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Blocker.kyzq-cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28.exe

MD5 e72e0222e3cf9da4c4263d52a38e06d8
SHA1 194cbf40f140263fce4ad04045d763e72a9d462e
SHA256 cf9db12f75698a0b69f8a5b232166f85d71013d1557b342596d52b13f34e0e28
SHA512 4656bda5e4d1e3426e9fe8b8e9a15e27cf4e8a7e741b4a75fd3ed24da2b2b49df2a45481f2872b89d928af3f93e66e83556e4fae70b6ba00d1c82f40d8ecce55

memory/2584-36-0x00000000000D0000-0x00000000000E1000-memory.dmp

C:\Users\Admin\Desktop\00321\Trojan-Ransom.Win32.Cryptor.btm-650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91.exe

MD5 c772d0bea69c05e17e3bf2b0974757e6
SHA1 c3dd106778d168d6d065dec7ca2a73cd38929550
SHA256 650b1403bcd20a724261ecb656112ed5742610e41097d05d5eff160ce8fd0f91
SHA512 c01b32e88dd4eb7e648cfc9267b85b341db3d18ee4eb21614eb367d6e32df60bd29cfa3326ca74ac0a88845f1e04ee451f0ace903effc9920d12aa85aabb397c

\Users\Admin\AppData\Local\Temp\nse1F93.tmp\System.dll

MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

memory/2584-44-0x00000000000D0000-0x00000000000E1000-memory.dmp

C:\MSOCache\RESTORE-SIGRUN.html

MD5 dd1986e273161d694be355934e4fed11
SHA1 3498502e1b09c00028a7ad491d2ea9aa3b84e264
SHA256 ffff4e7ece98b1fea5f2385f913a441126e55f6a554d07257b70f447dd8fd971
SHA512 64fc7e9062c96e106e7cace4a16110e17c91fb8d5f95db10e4b8e8c3a0461ff80ec8c992efd70ead3352ae60a51e6436f0fab92a43f4807d62adf87bc1b79bd2

C:\MSOCache\RESTORE-SIGRUN.txt

MD5 a6b39339a917dbbc12df9759478e814d
SHA1 2670a4b6a047f1656a258d4726569a2aab52d57f
SHA256 ddf51fdcfc300fadfdbb1d25ba96228cb3f4a1f6ddbe39e9412eaa2d2999b2bb
SHA512 b060e989540ebb2dea8dd8c10fc711fa542fd89fb418d293217c5fc93dcb6b8d0f9d2fc19c6d80d10de1d9363099c46cdb7997ac81d5c5a963553ee5ce43d23b

C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx

MD5 1fae801ac384017dc7e88ceb704a4267
SHA1 4e7444c0d781adc715c7d27e1164ad2dbe48bfca
SHA256 6ac01372d7decae38e669b0ecc8fe80510523e115a238f09f61513291a0b475c
SHA512 6096d6f94cbddb6f9cd0269588da1e0898470811b6b062dec1683e8d3d8ec81e024f79f32595b3921f3b9a69c2a20a0e2c1e104a4836cf546649f1bde1791ce2

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\~$MCV(1).doc (2).LNK

MD5 04b30cf0cdd21f20e8eb04e88a477077
SHA1 ad7579be946a021954aef43efb919f2957d7827e
SHA256 78dce1c5c12a64bb2bd9f9b68afa59f608270b043607b25835a11cb9c50a1a3d
SHA512 b429809bce67b523b1375704ac0e67e20aecfcc084c5e0e0ae137bab80a7633f534b51c3d16476611951a3d9ab822fc94739091d8c2c08710765e35053f08a03

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 8fb7fffa3f277467ea865bf31e9ca45d
SHA1 9bd19dc892f335ab37bf0c0d3ddf3be63d75fb37
SHA256 35252cecf9ef57985d1d52892e83a071ee65a442e1d745cfe73291b2e0eb051d
SHA512 fa5adc1aef070c90fc4b324d7292ca1b36d6da3870255cc73099bceec1384285ca29813d4bd9be59f72d0496a2b07fab34fbd82282c0aea9d121ab5e3addb1b1

memory/2584-962-0x00000000000D0000-0x00000000000E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab4EEE.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar4FCB.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/1152-1011-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a0bbc75191444fde8142fe7f42e34144
SHA1 48d8a97e0f382d7255906e737343503221e174f2
SHA256 4ddcd00b824b10bfeec9eb44cd2b2f28477ee8a63b940b173da9869939c49067
SHA512 071715f239544c916ebf9152433e8625224bfd5ba9cdfdb6a3ffedba5b08aad6927dcfcb0f35b8aae7cfdae90e04cf62715fd1dbd8e95f2d627ae06530e7e5c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bb23acfbe6bbbabfcd01a7d19807c402
SHA1 402797f514e75ba3d606e66d2ef2a6311cea67e1
SHA256 b6dde3e24f9e5f922205558247bcf677e74cfd5402d87d47bd8f4ec1a1fa3b1d
SHA512 1da176f0efa03b68c2602dfe8a739f02120b9b9e69bdc90a0b3e6609ce12dacf8b6fd3957dc14f71ee80ce036b7c803156ddfff56ee91519523288469d56dcef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3009a75d157a85df8624656d4adea640
SHA1 8125c15adfe6e0125dc4877123ef617049abc7a0
SHA256 464ca1f679ef1170dc9eddf370cba3681620dfce0695f99bd52f712dd7eade4d
SHA512 8af35a19a748e06bc233226907edfaff4a38518a041028647e3996db662da8497bc64218533dca6eb1420bd4103bb4e8f8dffbf983d9bc5fa883fa61934cc9f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 390679b1047d680003650835008ba408
SHA1 7413995c9c6e7d412d282c534c1c217424fe1c27
SHA256 791d74192622c6192e8431a68959521f9648d6fc6743385ee5b0f4c454403b4b
SHA512 3d9cceb10807f64c0dd8a2761f8a98aa3af439c32d7c7a58590f57d1b5525bd6e74fff26db72853aec0ec37070af9e0290d8cbc9c4bda8caf678b5aa98266c98

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78372b0737c7b3329690bc4d53e236e9
SHA1 567861c17ac38da9e90f1fdb997d3bf2040f283b
SHA256 1ff97bc0327f37241ebe6fb823f4fbea12a8380e45579ee60edf15260b7fdc68
SHA512 f536219ff2f1a615616002d5bf0dc2661742b6956bf040b08c15352e34dd051e5a1e9114ac2daa52bcae7ae89031c5ff9e8a8967f3f5fbe2b40ded738cf151d3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2c64cc2b5c3f81b4f159e232ba3fed06
SHA1 a8d7f6105f79d10a442a6aac0b502496d100236d
SHA256 5cbed8f41eb3c0ade651043386b73c0290948b84001fbfdb69128dac4a3a7913
SHA512 0cda0bec2524fa370217be9cec5cb0ced33cb5ec505a8009b7b1eafab699a7510107dd798946f9a7a0cb12971b6d1ef066f364f7cc7b86ee9dc6cc00674bfc4c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3e3148e68f8e3c93989f7e6aa3c31a37
SHA1 b97f138c69349bed4349a97fed37f2e6b670fe87
SHA256 27aec1017fbbde860737a4713b559befb1e792665eb9583b82ba0035b723ea64
SHA512 0a7078a622154ee1d9ff7057f62febdc45c9a0930a24d47d2e5f56e8b1008709d0edc87583fc651b9db87479e2eebc1b695058f2eca0619157c4612d865b0b60

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 40202b162a9e395cc0e1aa8af67e11ca
SHA1 c7fac94da310e36b76b8b3c5889da55f56bf208b
SHA256 753b841dc0fc5544434c5cd816450cf9de8e97d2e305bb571c214c7492103dc8
SHA512 a1b27dbf02f4e8e12a605945d4cbb2d2fb90137c7946017dfbcc3d02627453042cba820c53ada764bf430e6d6f1b8d1c93cd6697ee2932fadc555f7f647d9866

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2f258b5765d921c8db0d9b59aecd79f1
SHA1 4514572ff03350f6d930e529bf7fabf7bcafa2b2
SHA256 45d8c42f9d49dcf094f687f49d2c73809ac86cabe5a7f8ee43fbf339f5e84b04
SHA512 35bf51db9598bde0d952b2d47d00288fc6ac160f727d40478c5542d2b4c3e0e03380e2fb8f198a69af75134b5f1e4cd4da0649459e1d23d6539c9ec397eeab5a

memory/1432-1373-0x0000000000080000-0x0000000000093000-memory.dmp

memory/1152-1402-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2596-1404-0x00000000046A0000-0x00000000046B3000-memory.dmp

memory/1432-1405-0x0000000000080000-0x0000000000093000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 e2ccb9d02290fe2f83e2f94b2daceb50
SHA1 447c78457b0bd3d40764dfdbe147df92a1de9b1a
SHA256 9da718bdbb2ce34ad87ba1d678a4753f31be82738ff9d3e23ee1633e75bb0b18
SHA512 0ef1ad53255da458c44edc9e11e5674ab5bc15976a3a1016387ec74df9409211085b27a17357adf4e7b0643839ea5eab23200634b3769aa13de610c56ace2b90

memory/1772-1418-0x000000005FFF0000-0x0000000060000000-memory.dmp