gandcrab | a0704c171355f07d5ba80fcc0358f13757734f688cd397622a26fe152dd15952

Analysis

max time kernel
173s
max time network
177s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RNSM00315.7z
Size

14.8MB
MD5

9596ff4b5a2a0f67eaab05606e342437
SHA1

12fecb35983d2051f8012b9169bf455950913766
SHA256

a0704c171355f07d5ba80fcc0358f13757734f688cd397622a26fe152dd15952
SHA512

cb70cd3f5e683499ba9ccf8ffa897af36978ea409d98097b4f0048011171cc1d7d05262148effec7e7116e21ed58bff96c2c5959b2bd98611463784f4af2a364
SSDEEP

393216:/OfnLbyqnje5BSP5Dr2tVmTvicXVNeNr5d9kT:/Ofnvjdv2UvhNAr5X4

Score

10^/10

gandcrab troldesh backdoor defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan upx

Malware Config

Extracted

Path

C:\Users\Admin\Music\!HELP_SOS.hta

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; } h2 { color: #555; text-align: center; } ol li { padding-bottom: 13pt; } .container { background-color: #EEE; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .filecontainer{ padding: 5% 10%; display: none; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .key{ background-color: #A1D490; border: 1px solid #506A48; display: block; text-align: center; margin: 0.5em 0; padding: 1em 1.5em; word-wrap: break-word; } .keys{ margin: 3em 0; } .filename{ border: 3px solid #AAA; display: block; text-align: center; margin: 0.5em 0em; padding: 1em 1.5em; background-color: #DCC; } .us{ text-decoration: strong; color: #333; } .info{ background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text{ text-align: justify; } #file{ background-color: #FCC; } .lsb{ display: none; margin: 3%; text-align: center; } .ls{ border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 1em 0.1em; } .ls:hover{ background-color: #D0D0D0; } .l{ display:none; } </style> <script language="vbscript"> Function GetCmd GetCmd = App.commandLine End Function </script> <script language="javascript"> function openlink(url){ new ActiveXObject("WScript.Shell").Run(url); return false; } function aIndexOf(arr, v){ for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i; return -1; } function tweakClass(cl, f){ var els; if(document.getElementByClassName != null){ els = document.getElementsByClassName(cl); } else{ els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++){ var c = tmp[i].className; if( (c == cl) || ((c != '') && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]); } } for(var i = 0; i < els.length; i++) f(els[i]); } var langs = ["en","de","it","pt","es","fr","kr","nl","ar","fa","zh"]; function setLang(lang){ if(aIndexOf(langs, lang) == -1) lang = langs[0]; for(var i = 0; i < langs.length; i++){ var clang = langs[i]; tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; }); tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; }); } } function onPageLoaded(){ try{ tweakClass('lsb', function(el){ el.style.display = 'block'; }); }catch(e){} try{ setLang(en); }catch(e){} try{ var args = GetCmd().match(/"[^"]+"|[^ ]+/g); if(args.length > 1){ var file = args[args.length-1]; if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2); document.getElementById('filename').innerHTML = file; document.getElementById('file').style.display = 'block'; document.title = 'File is encrypted'; } }catch(e){} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> <span class='ls ls-en' onclick="javascript:return setLang('en')">English</span> <span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span> <span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span> <span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span> <span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span> <span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span> <span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span> <span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span> <span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span> <span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span> <span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span> </div> <div id='file' class='container filecontainer'> <div class='filename'> <div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div> <div> <h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2> <h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2> <h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2> <h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2> <h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2> <h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2> <h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2> <h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2> <h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2> <h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2> <h2 class='l l-zh' >文件已被加密，但是可以解密</h2> <p><span id='filename'></span></p> </div> </div> <h2>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.0 Ransomware".</h2> <h2>Action required to restore your files.</h2> </div> <div class='container'> <div class="text l l-en" style='display:block'> <h1>File recovery instructions</h2> <p>You probably noticed that you can not open your files and that some software stopped working correctly.</p> <p>This is expected. Your files content is still there, but it was encrypted by <span class='us'>"SAGE 2.0 Ransomware"</span>.</p> <p>Your files are not lost, it is possible to revert them back to normal state by decrypting.</p> <p>The only way you can do that is by getting <span class='us'>"SAGE Decrypter"</span> software and your personal decryption key.</p> <div class='info'> <p>Using any other software which claims to be able to restore your files will result in files being damaged or destroyed.</p> </div> <p>You can purchase <span class='us'>"SAGE Decrypter"</span> software and your decryption key at your personal page you can access by following links:</p> <div class='keys'> <div class='key'> <a href="http://7gie6ffnkrjykggd.op7su2.com/login/AWLuRCaH58mvI0MzbPx-Dc3MvbrvIlrMLjpEsiviz7Xz9VA8HIm5ZXTA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.op7su2.com/</a> </div> <div class='key'> <a href="http://7gie6ffnkrjykggd.pe6zawc.com/login/AWLuRCaH58mvI0MzbPx-Dc3MvbrvIlrMLjpEsiviz7Xz9VA8HIm5ZXTA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.pe6zawc.com/</a> </div> </div> <p>If you are asked for your personal key, copy it to the form on the site. This is your personal key:</p> <div class='keys'> <div class='key'> AWLuRCaH58mvI0MzbPx-Dc3MvbrvIlrMLjpEsiviz7Xz9VA8HIm5ZXTA </div> </div> <p>You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files</p> <div class='info'> <p>If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser".</p> <p>In order to do that you need to:</p> <ol> <li>open Internet Explorer or any other internet browser;</li> <li>copy the address <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> into address bar and press "Enter";</li> <li>once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions;</li> <li>once installation is finished, open the newly installed Tor Browser and press the "Connect" button (button can be named differently if you installed non-English version);</li> <li>Tor Browser will establish connection and open a normal browser window;</li> <li>copy the address <div class='key'>http://7gie6ffnkrjykggd.onion/login/AWLuRCaH58mvI0MzbPx-Dc3MvbrvIlrMLjpEsiviz7Xz9VA8HIm5ZXTA</div> into this browser address bar and press "Enter";</li> <li>your personal page should be opened now; if it didn't then wait for a bit and try again.</li> </ol> <p>If you can not perform this steps then check your internet connection and try again. If it still doesn't work, try asking some computer guy for help in performing this steps for you or look for some video guides on <a href='https://www.youtube.com/results?search_query=tor+browser+install' onclick='javascript:return openlink(this.href)'>YouTube</a>.</p> </div> <div class='info'> <p>You can find a copy of this instruction in files named "!HELP_SOS" stored next to your encrypted files.</p> </div> </div> <div class="text l l-de" > <h1>Anleitung zur Dateiwiederherstellung</h2> <p>Sie haben sicherlich gemerkt, dass Sie Ihre Daten nicht öffnen können und dass Programme nicht mehr ordnungsgemäß funktionieren.</p> <p>Dies ist zu erwarten. Die Dateiinhalte existieren noch, aber wurden mit {us_enc}} verschlüsselt.</p> <p>Ihre Daten sind nicht verloren. Es ist möglich, sie mit Hilfe von Entschlüsselung in ihren Originalzustand zurückzuversetzen.</p> <p>Die einzige Möglichkeit das zu tun, ist die Verwendung von <span class='us'>"SAGE Decrypter"</span> Software und Ihr persönlicher Entschlüsselungskey.</p> <div class='info'> <p>Das Verwenden von anderer Software, die angeblich ihre Daten wiederherstellen kann, wird dazu führen, dass Ihre Daten beschädigt oder zerstört werden.</p> </div> <p>Sie können die <span class='us'>"SAGE Decrypter"</span> Software und Ihren Entschlüsselungskey auf Ihrer persönlichen Seite erwerben, indem Sie diesen Links folgen:</p> <div class='keys'> <div class='key'> <a href="http://7gie6ffnkrjykggd.op7su2.com/login/AWLuRCaH58mvI0MzbPx-Dc3MvbrvIlrMLjpEsiviz7Xz9VA8HIm5ZXTA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.op7su2.com/</a> </div> <div class='key'> <a href="http://7gie6ffnkrjykggd.pe6zawc.com/login/AWLuRCaH58mvI0MzbPx-Dc3MvbrvIlrMLjpEsiviz7Xz9VA8HIm5ZXTA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.pe6zawc.com/</a> </div> </div> <p>Falls Sie nach ihrem persönlichen Key gefragt werden, kopieren Sie ihn in das Formular auf dieser Seite. Dies ist Ihr persönlicher Key:</p> <div class='keys'> <div class='key'> AWLuRCaH58mvI0MzbPx-Dc3MvbrvIlrMLjpEsiviz7Xz9VA8HIm5ZXTA </div> </div> <p>Sie können eine Datei gratis entschlüssen, um sicher zu sein, dass die "SAGE Decrypter" Software ihre Daten wiederherstellen kann</p> <div class='info'> <p>Falls keine dieser Links über einen längeren Zeitraum funktionieren sollten oder Sie Ihre Daten so schnell wie möglich wiederherstellen müssen, können Sie Ihre persönliche Seite mit Hilfe des "Tor Browser" aufrufen.</p> <p>Dazu benötigen Sie:</p> <ol> <li>Öffnen Sie den Internet Explorer oder einen anderen Internetbrowser;</li> <li>Kopieren Sie diese Adresse <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> in die Adressleiste und drücken Sie "Enter";</li> <li>So bald sich die Seite öffnet, wird Ihnen der Download des Tor Browser angeboten. Laden Sie ihn herunter und führen Sie die Installation aus, indem Sie den Installationsanweisungen folgen;</li> <li>Wenn die Installation abgeschlossen ist, öffnen Sie den soeben installierten Tor Browser und drücken Sie den "Connect" Knopf (Der Namen kann abweichen, falls Sie eine nicht-englische Version installiert haben);</li> <li>Tor Browser wird eine Verbindung herstellen und ein normales Browserfenster öffnen;</li> <li>Kopieren Sie die Adresse <div class='key'>http://7gie6ffnkrjykggd.onion/login/AWLuRCaH58mvI0MzbPx-Dc3MvbrvIlrMLjpEsiviz7Xz9VA8HIm5ZXTA</div> in die Browseradressleiste und drücken Sie "Enter";</li> <li>Ihre persönliche Seite sollte sich nun geöffnet haben; falls nicht: Warten Sie eine Weile und versuchen Sie es erneut.</li> </ol> <p>Falls Sie nicht in der Lage sind, diese Schritte durchzuführen, überprüfen Sie Ihre Internetverbindung. Wenn es noch immer nicht funktioniert, fragen Sie jemanden, der sich mit Computern auskennt, um diese Schritte durchzuführen oder schauen Sie sich einige Videoanleitungen auf {a_youtube}} an.</p> </div> <div class='info'> <p>Sie finden eine Kopie dieser Anleitung in einer Datei namens "!HELP_SOS" neben Ihren verschlüsselten Daten.</p> </div> </div> <div class="text l l-it" > <h1>Istruzioni per il recupero dei file</h2> <p>Probabilmente hai notato che non puoi più aprire i tuoi file e alcuni software hanno smesso di funzionare correttamente.</p> <p>Questo era previsto. I tuoi file si trovano ancora al loro posto, ma sono stati crittografati da <span class='us'>"SAGE 2.0 Ransomware"</span>.</p> <p>I tuoi file non sono persi, è possibile farli tornare al loro stato normale eseguendo una decrittazione.</p> <p>L'unico modo in cui è possibile f

Signatures

GandCrab payload 3 IoCs

resource	yara_rule
behavioral1/memory/2412-163-0x0000000000400000-0x0000000000A4D000-memory.dmp	family_gandcrab
behavioral1/memory/2412-164-0x0000000000270000-0x0000000000287000-memory.dmp	family_gandcrab
behavioral1/memory/2412-211-0x0000000000400000-0x0000000000A4D000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Gandcrab family
gandcrab

Modifies firewall policy service 3 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe

Troldesh family
troldesh
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe

Contacts a large (7707) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DaumCleanerUpdater.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 21 IoCs

pid	Process
3044	HEUR-Trojan-Ransom.Win32.Generic-d23e3a5220ab529d7df6d295167db6774e8d77c106ae26b0c210fbabcffc84c7.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
1036	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
1404	Trojan-Ransom.Win32.Blocker.dmbt-5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553.exe
1352	Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe
2412	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
2652	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
1108	Trojan-Ransom.Win32.Foreign.nzti-9b3af0dd248f86114a0c042e4385649ff294707479a85006a7dd384071213890.exe
1724	Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe
2484	DaumCleanerUpdater.exe
1068	shopbacon.exe
888	BBLiveSvc.exe
2292	BBLiveAid.exe
2860	BBLiveAid.exe
2340	Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe
956	2nozbiCW.exe
2120	2nozbiCW.exe
664	5A44C40223.exe
492	shopbacon.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	DaumCleanerUpdater.exe

Loads dropped DLL 36 IoCs

pid	Process
2728	cmd.exe
2596	taskmgr.exe
2596	taskmgr.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
888	BBLiveSvc.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
744	regsvr32.exe
972	regsvr32.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
1724	Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe
1724	Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe
2296	WerFault.exe
2296	WerFault.exe
2296	WerFault.exe
2296	WerFault.exe
956	2nozbiCW.exe
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1496	WerFault.exe
1496	WerFault.exe
1496	WerFault.exe
1496	WerFault.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DaumCleanerUpdater = "C:\\Users\\Admin\\AppData\\Roaming\\DaumCleanerUpdater.exe"	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\5A44C40223 = "C:\\Users\\Admin\\AppData\\Roaming\\5A44C40223.exe"	Trojan-Ransom.Win32.Blocker.dmbt-5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\5A44C40223 = "C:\\Users\\Admin\\AppData\\Roaming\\5A44C40223.exe"	5A44C40223.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	Trojan-Ransom.Win32.Foreign.nzti-9b3af0dd248f86114a0c042e4385649ff294707479a85006a7dd384071213890.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Audio DG System = "C:\\Users\\Admin\\AppData\\Roaming\\yYs2GtkQ5PbJfUOddXfBCGk3KTYK.exe"	Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Updater = "C:\\Users\\Admin\\Desktop\\00315\\Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe"	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "C:\\Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe"	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\PrintCenter = "c:\\\\Users\\Admin\\ImageScanner.exe"	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\usctojilxyr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\fnnnpt.exe\""	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*5A44C40223 = "C:\\Users\\Admin\\AppData\\Roaming\\5A44C40223.exe"	Trojan-Ransom.Win32.Blocker.dmbt-5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*5A44C40223 = "C:\\Users\\Admin\\AppData\\Roaming\\5A44C40223.exe"	5A44C40223.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Trojan-Ransom = "C:\\Users\\Admin\\Desktop\\00315\\Trojan-Ransom.Win32.Foreign.nzti-9b3af0dd248f86114a0c042e4385649ff294707479a85006a7dd384071213890.exe"	Trojan-Ransom.Win32.Foreign.nzti-9b3af0dd248f86114a0c042e4385649ff294707479a85006a7dd384071213890.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DaumCleanerUpdater.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\t:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\H:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\O:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\P:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\U:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\Y:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\Z:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\B:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\E:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\q:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\e:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\l:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\w:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\x:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\G:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\b:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\W:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\a:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\k:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\n:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\o:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\s:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\I:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\L:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\T:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\h:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\j:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\r:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\J:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\M:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\i:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\N:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\V:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\X:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\g:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\m:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\p:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\u:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\y:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\A:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\S:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\v:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\z:	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
File opened (read-only)	\??\K:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
File opened (read-only)	\??\Q:	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2580-130-0x0000000000400000-0x00000000004C2000-memory.dmp	autoit_exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop\Wallpaper	2nozbiCW.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x2G.bmp"	2nozbiCW.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2484	DaumCleanerUpdater.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 2652	3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe	46
PID 1352 set thread context of 1988	1352	Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe	47

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000016de4-37.dat	upx
behavioral1/memory/2580-44-0x0000000000400000-0x00000000004C2000-memory.dmp	upx
behavioral1/memory/2580-130-0x0000000000400000-0x00000000004C2000-memory.dmp	upx
behavioral1/memory/1108-507-0x0000000000400000-0x0000000000606000-memory.dmp	upx
behavioral1/memory/1108-550-0x0000000000400000-0x0000000000606000-memory.dmp	upx
behavioral1/memory/1108-554-0x0000000000400000-0x0000000000606000-memory.dmp	upx
behavioral1/memory/1108-558-0x0000000000400000-0x0000000000606000-memory.dmp	upx
behavioral1/memory/1108-989-0x0000000000400000-0x0000000000606000-memory.dmp	upx
behavioral1/memory/1108-993-0x0000000000400000-0x0000000000606000-memory.dmp	upx
behavioral1/memory/1108-998-0x0000000000400000-0x0000000000606000-memory.dmp	upx
behavioral1/memory/1108-1001-0x0000000000400000-0x0000000000606000-memory.dmp	upx
behavioral1/memory/1108-1004-0x0000000000400000-0x0000000000606000-memory.dmp	upx
behavioral1/memory/1108-1007-0x0000000000400000-0x0000000000606000-memory.dmp	upx

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BBLiveZip\BBLiveZip.exe	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
File created	C:\Program Files (x86)\BBLiveZip\BBLiveExt32.dll	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
File created	C:\Program Files (x86)\BBLiveZip\splan.bmp	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
File created	C:\Program Files (x86)\BBLiveZip\BBLiveExt64.dll	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
File created	C:\Program Files (x86)\BBLiveZip\zlib.dll	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
File created	C:\Program Files (x86)\BBLiveZip\BBLiveAid.exe	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
File created	C:\Program Files (x86)\BBLiveZip\BBLiveSvc.exe	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
File created	C:\Program Files (x86)\BBLiveZip\BBLiveUpdate.exe	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
File created	C:\Program Files (x86)\BBLiveZip\uninst.exe	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
File created	C:\Program Files (x86)\BBLiveZip\7z.dll	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
File created	C:\Program Files (x86)\BBLiveZip\BBCoreLayer.dll	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
File created	C:\Program Files (x86)\BBLiveZip\version.dat	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2296	1068	WerFault.exe	49
1496	492	WerFault.exe	284

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBLiveSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DaumCleanerUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shopbacon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBLiveAid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shopbacon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
952	PING.EXE
2096	PING.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2984	vssadmin.exe
492	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1720	taskkill.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop	2nozbiCW.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA2AD1B1-A12A-11EF-B38B-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437600876"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT	2nozbiCW.exe
Key created	\REGISTRY\USER\S-1-5-19	2nozbiCW.exe
Key created	\REGISTRY\USER\S-1-5-20	2nozbiCW.exe
Key created	\REGISTRY\USER\S-1-5-18	2nozbiCW.exe

Modifies registry class 56 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzma	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "BBLiveZipfile"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}\InprocServer32\ = "C:\\Program Files (x86)\\BBLiveZip\\BBLiveExt64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\BBLiveZip Shell Extension\ = "{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\htafile\DefaultIcon	2nozbiCW.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "BBLiveZipfile"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gzip\ = "BBLiveZipfile"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\BBLiveZip Shell Extension\ = "{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ace	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\shell\open\command	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\htafile	2nozbiCW.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\sage.notice\FriendlyTypeName\ = "encrypted by SAGE"	2nozbiCW.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\BBLiveZip Shell Extension	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\BBLiveZip Shell Extension	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\sage.notice\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,47"	2nozbiCW.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\shell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\sage.notice\DefaultIcon	2nozbiCW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\DefaultIcon\ = "C:\\Program Files (x86)\\BBLiveZip\\BBLiveExt64.dll,0"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\htafile\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,44"	2nozbiCW.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\BBLiveZip Shell Extension\ = "{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.sage	2nozbiCW.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\sage.notice\shell	2nozbiCW.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\""	2nozbiCW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\shell\open\command\ = "\"C:\\Program Files (x86)\\BBLiveZip\\BBLiveZip.exe\" \"%1\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "BBLiveZipfile"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\sage.notice\shell\open\command	2nozbiCW.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gzip	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\sage.notice	2nozbiCW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}\ = "BBLiveZip Shell Extension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\DefaultIcon	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\shell\open	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzma\ = "BBLiveZipfile"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\sage.notice\FriendlyTypeName	2nozbiCW.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\sage.notice\shell\open	2nozbiCW.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar2	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\BBLiveZip Shell Extension	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.sage\ = "sage.notice"	2nozbiCW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar2\ = "BBLiveZipfile"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ace\ = "BBLiveZipfile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	regsvr32.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2096	PING.EXE
952	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1828	schtasks.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 8 IoCs

pid	Process
3044	HEUR-Trojan-Ransom.Win32.Generic-d23e3a5220ab529d7df6d295167db6774e8d77c106ae26b0c210fbabcffc84c7.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
1352	Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe
1108	Trojan-Ransom.Win32.Foreign.nzti-9b3af0dd248f86114a0c042e4385649ff294707479a85006a7dd384071213890.exe
2412	Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
1724	Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
2596	taskmgr.exe
2596	taskmgr.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
2596	taskmgr.exe
2596	taskmgr.exe
2484	DaumCleanerUpdater.exe
2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2596	taskmgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1352	Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeRestorePrivilege	3000	7zFM.exe
Token: 35	3000	7zFM.exe
Token: SeSecurityPrivilege	3000	7zFM.exe
Token: SeDebugPrivilege	2596	taskmgr.exe
Token: SeTakeOwnershipPrivilege	2120	HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
Token: SeTakeOwnershipPrivilege	972	regsvr32.exe
Token: SeTakeOwnershipPrivilege	1724	Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe
Token: SeDebugPrivilege	1988	explorer.exe
Token: SeDebugPrivilege	1404	Trojan-Ransom.Win32.Blocker.dmbt-5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553.exe
Token: SeDebugPrivilege	1720	taskkill.exe
Token: SeDebugPrivilege	664	5A44C40223.exe
Token: SeBackupPrivilege	2896	vssvc.exe
Token: SeRestorePrivilege	2896	vssvc.exe
Token: SeAuditPrivilege	2896	vssvc.exe
Token: 33	2244	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2244	AUDIODG.EXE
Token: 33	2244	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2244	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3000	7zFM.exe
3000	7zFM.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
1036	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
1036	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
2596	taskmgr.exe
2596	taskmgr.exe
1288	iexplore.exe
2596	taskmgr.exe
1724	Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe
2596	taskmgr.exe
2596	taskmgr.exe
1288	iexplore.exe
2340	Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe
1036	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
1036	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
1288	iexplore.exe
956	2nozbiCW.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
1036	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
1036	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
1036	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
1036	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
1108	Trojan-Ransom.Win32.Foreign.nzti-9b3af0dd248f86114a0c042e4385649ff294707479a85006a7dd384071213890.exe
1288	iexplore.exe
1288	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
1288	iexplore.exe
1288	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
1288	iexplore.exe
1288	iexplore.exe
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE
1288	iexplore.exe
1288	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 3044	2728	cmd.exe	36
PID 2728 wrote to memory of 3044	2728	cmd.exe	36
PID 2728 wrote to memory of 3044	2728	cmd.exe	36
PID 2728 wrote to memory of 3044	2728	cmd.exe	36
PID 2728 wrote to memory of 3048	2728	cmd.exe	37
PID 2728 wrote to memory of 3048	2728	cmd.exe	37
PID 2728 wrote to memory of 3048	2728	cmd.exe	37
PID 2728 wrote to memory of 3048	2728	cmd.exe	37
PID 2728 wrote to memory of 2120	2728	cmd.exe	38
PID 2728 wrote to memory of 2120	2728	cmd.exe	38
PID 2728 wrote to memory of 2120	2728	cmd.exe	38
PID 2728 wrote to memory of 2120	2728	cmd.exe	38
PID 2728 wrote to memory of 2120	2728	cmd.exe	38
PID 2728 wrote to memory of 2120	2728	cmd.exe	38
PID 2728 wrote to memory of 2120	2728	cmd.exe	38
PID 2728 wrote to memory of 2580	2728	cmd.exe	39
PID 2728 wrote to memory of 2580	2728	cmd.exe	39
PID 2728 wrote to memory of 2580	2728	cmd.exe	39
PID 2728 wrote to memory of 2580	2728	cmd.exe	39
PID 2728 wrote to memory of 1404	2728	cmd.exe	40
PID 2728 wrote to memory of 1404	2728	cmd.exe	40
PID 2728 wrote to memory of 1404	2728	cmd.exe	40
PID 2728 wrote to memory of 1036	2728	cmd.exe	41
PID 2728 wrote to memory of 1036	2728	cmd.exe	41
PID 2728 wrote to memory of 1036	2728	cmd.exe	41
PID 2728 wrote to memory of 1352	2728	cmd.exe	42
PID 2728 wrote to memory of 1352	2728	cmd.exe	42
PID 2728 wrote to memory of 1352	2728	cmd.exe	42
PID 2728 wrote to memory of 1352	2728	cmd.exe	42
PID 2728 wrote to memory of 1108	2728	cmd.exe	43
PID 2728 wrote to memory of 1108	2728	cmd.exe	43
PID 2728 wrote to memory of 1108	2728	cmd.exe	43
PID 2728 wrote to memory of 1108	2728	cmd.exe	43
PID 2728 wrote to memory of 2412	2728	cmd.exe	44
PID 2728 wrote to memory of 2412	2728	cmd.exe	44
PID 2728 wrote to memory of 2412	2728	cmd.exe	44
PID 2728 wrote to memory of 2412	2728	cmd.exe	44
PID 2728 wrote to memory of 1724	2728	cmd.exe	45
PID 2728 wrote to memory of 1724	2728	cmd.exe	45
PID 2728 wrote to memory of 1724	2728	cmd.exe	45
PID 2728 wrote to memory of 1724	2728	cmd.exe	45
PID 3048 wrote to memory of 2652	3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe	46
PID 3048 wrote to memory of 2652	3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe	46
PID 3048 wrote to memory of 2652	3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe	46
PID 3048 wrote to memory of 2652	3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe	46
PID 3048 wrote to memory of 2652	3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe	46
PID 3048 wrote to memory of 2652	3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe	46
PID 3048 wrote to memory of 2652	3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe	46
PID 3048 wrote to memory of 2652	3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe	46
PID 3048 wrote to memory of 2652	3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe	46
PID 3048 wrote to memory of 2652	3048	HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe	46
PID 1352 wrote to memory of 1988	1352	Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe	47
PID 1352 wrote to memory of 1988	1352	Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe	47
PID 1352 wrote to memory of 1988	1352	Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe	47
PID 1352 wrote to memory of 1988	1352	Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe	47
PID 2580 wrote to memory of 2484	2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe	48
PID 2580 wrote to memory of 2484	2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe	48
PID 2580 wrote to memory of 2484	2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe	48
PID 2580 wrote to memory of 2484	2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe	48
PID 2580 wrote to memory of 2484	2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe	48
PID 2580 wrote to memory of 2484	2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe	48
PID 2580 wrote to memory of 2484	2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe	48
PID 2580 wrote to memory of 1068	2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe	49
PID 2580 wrote to memory of 1068	2580	Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe	49

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\LockTaskbar = "1"	Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00315.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\Desktop\00315\HEUR-Trojan-Ransom.Win32.Generic-d23e3a5220ab529d7df6d295167db6774e8d77c106ae26b0c210fbabcffc84c7.exe
  HEUR-Trojan-Ransom.Win32.Generic-d23e3a5220ab529d7df6d295167db6774e8d77c106ae26b0c210fbabcffc84c7.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3044
- C:\Users\Admin\Desktop\00315\HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
  HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Users\Admin\Desktop\00315\HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
    HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe
    3⤵
    - Executes dropped EXE
    PID:2652
- C:\Users\Admin\Desktop\00315\HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
  HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2120
- - C:\Program Files (x86)\BBLiveZip\BBLiveSvc.exe
    "C:\Program Files (x86)\BBLiveZip\BBLiveSvc.exe" -i
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:888
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\BBLiveZip\BBLiveExt64.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:744
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\BBLiveZip\BBLiveExt64.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:972
- - C:\Program Files (x86)\BBLiveZip\BBLiveAid.exe
    "C:\Program Files (x86)\BBLiveZip\BBLiveAid.exe" install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2292
- - C:\Program Files (x86)\BBLiveZip\BBLiveAid.exe
    "C:\Program Files (x86)\BBLiveZip\BBLiveAid.exe" ext_svc
    3⤵
    - Executes dropped EXE
    PID:2860
- C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
  Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Users\Admin\AppData\Roaming\DaumCleanerUpdater.exe
    C:\Users\Admin\AppData\Roaming\DaumCleanerUpdater.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2484
- - C:\Users\Admin\AppData\Roaming\shopbacon.exe
    C:\Users\Admin\AppData\Roaming\shopbacon.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 824
      4⤵
      Loads dropped DLL
      Program crash
      PID:2296
- C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.Blocker.dmbt-5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553.exe
  Trojan-Ransom.Win32.Blocker.dmbt-5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- - C:\Users\Admin\AppData\Roaming\5A44C40223.exe
    "C:\Users\Admin\AppData\Roaming\5A44C40223.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:664
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM Trojan-Ransom.Win32.Blocker.dmbt-5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
  Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - System policy modification
  PID:1036
- C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe
  Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\system32\explorer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.Foreign.nzti-9b3af0dd248f86114a0c042e4385649ff294707479a85006a7dd384071213890.exe
  Trojan-Ransom.Win32.Foreign.nzti-9b3af0dd248f86114a0c042e4385649ff294707479a85006a7dd384071213890.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:1108
- C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
  Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2412
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:848
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1888
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1644
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3044
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:704
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:1084
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2212
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    PID:628
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2456
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2124
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1944
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:568
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:988
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2752
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:340
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2012
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1396
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2684
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:924
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    PID:824
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1848
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:956
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:2152
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2136
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1864
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:1740
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1732
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1852
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    PID:952
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2876
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:768
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2392
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    PID:872
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1936
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:972
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2892
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1764
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:2532
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2040
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2192
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:740
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2044
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2988
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:156
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1344
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:1400
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2144
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1144
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    PID:444
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:1036
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3012
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2352
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    PID:1316
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:896
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    PID:2944
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    PID:584
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2428
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2556
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2540
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.corp-servers.ru
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns2.corp-servers.ru
    3⤵
    PID:1896
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2668
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup zonealarm.bit ns1.corp-servers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3060
- C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe
  Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1724
- - C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe
    "C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe" g
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:2340
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /TN "dwYws7kc" /TR "C:\Users\Admin\AppData\Roaming\2nozbiCW.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1828
- - C:\Users\Admin\AppData\Roaming\2nozbiCW.exe
    "C:\Users\Admin\AppData\Roaming\2nozbiCW.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Sets desktop wallpaper using registry
    - Modifies Control Panel
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:956
  - - C:\Users\Admin\AppData\Roaming\2nozbiCW.exe
      "C:\Users\Admin\AppData\Roaming\2nozbiCW.exe" g
      4⤵
      Executes dropped EXE
      PID:2120
  - - C:\Windows\SysWOW64\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      System Location Discovery: System Language Discovery
      Interacts with shadow copies
      PID:2984
  - - C:\Windows\SysWOW64\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      System Location Discovery: System Language Discovery
      Interacts with shadow copies
      PID:492
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:1720
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /DELETE /TN /F "dwYws7kc"
      4⤵
      PID:2972
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config16184093.bat"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1584
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2096
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config252888.bat"
    3⤵
    PID:1784
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:952

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2596

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275461 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:406536 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:668680 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:1532

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x538
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Users\Admin\AppData\Roaming\shopbacon.exe
"C:\Users\Admin\AppData\Roaming\shopbacon.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 760
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BBLiveZip\version.dat

Filesize
38B

MD5
918384107260b069f64b09e6518c2fb5

SHA1
d989ddbad97166c85ce60ce54875a06038c48b9d

SHA256
ba69a940e0eface653ce15e9a371ba36fc0c25fd25c618095041ff7147db3eaf

SHA512
123ae67f23c12077c0a3055fd2902134b78611cc08793128a1f66c3df09c063f94fee3e7a1d16b8b878978e87a44793aafecbdb96c7b1213846a6c44231c33af

Download Submit
C:\ProgramData\Microsoft\Network\Connections\Pbk\rasphone.pbk

Filesize
1KB

MD5
59ee24ae11f7ce6414c066edb6d8a8e0

SHA1
17c6ece2c774e65064e6e1e20a8e25d7b5b257c1

SHA256
b40b6f2acd9b4a0a91ec95fc4fa609aa5d065d945eba8c85b006d7f36f10fe5e

SHA512
cec2eab47bb447741fd07e069757ddd8703374c028ae57735289965b450647ec3964addacf6f56c134c19fa16279b8db31cbcb772c4340345dad0e5c95476280

Download Submit
C:\ProgramData\Microsoft\Network\Connections\Pbk\rasphone.pbk

Filesize
1KB

MD5
b3f97fab075dbc8d670c0a5a538bb1b2

SHA1
20c7c2745c26d4f1dcb9067e9233ccdac31c89cb

SHA256
114320c0a18ff6a87781fdb245cdf8335c2c27e81e9d17a1daae618915c8224f

SHA512
86ddadb621a8df3acaa58aae86593b1737b9f04f1fa341828bd8cb2fc93904a7c10c0966fcfdda10f4ab3a42e331dc836db41babd625e548204891960f343915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57a0a9767af218f2f51544878c8acc32

SHA1
0b5995f8c6094fd2192ab41438144952cf5fe7e8

SHA256
fec00d7e5e2c63f648dd93c2a869e8654f5813c88fdaa8e4b8634121c45eca15

SHA512
efc25bf54680f922429006812c35e5b2dceb92880691a640ea5a59776d20ab576cba4b5910984e2952f12b00d43389269956810b91bbd0abef20a46e78552ccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e152bc9c052cc874f37f02b95a886de8

SHA1
22a766aa0bf16b86619b1ba11642249146f5269e

SHA256
42420394ee50c50f1a63c4c309af87b8b709adeb77018e16907677af74930b6e

SHA512
457e4c0f02c6320feb56cf54088449f0a2dddc9a9c5f10e37bbccc61118c85950c2ede6a0d339704036c0808f4cfcae58d4461277fdb7755c209954489a66f2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82cb0655a2de6e3861cb9d8959980d69

SHA1
3b9f6c3f311fdb6416c070b809385f2cb162fab9

SHA256
f072f00cee24872b218898ba68164780e016cc84f100b3f5706a3534710f42d8

SHA512
aad702d35972278efc79f8f0eb3b74fe045f3fdbdf235043d9a27c297341e3751ca15d8b49366588b8d195ec9b18628dede5a97de66433f000045c8dc473518e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eba8318b7839952d30cffb9d051a6f9e

SHA1
a4065261964d7f9c65113ee09ffa2368fbbe5767

SHA256
1664a0d02b8f6d46c41569e626fe0a2ef8381038ece219ad3e603ae42a8a95b5

SHA512
e265253b775674ea0b026254650274daece850cc322aaa767cc738a1dc7cdec7300db4fc1a90c53cbff1d95b29a7ab962385adb76535702cc5cda0aa161caec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92299a4e7c25f6e68d3e7ce2187ea448

SHA1
05c1d6f216c26f010df07c747156f238b7999de4

SHA256
da33e19833fe62a3bb9ef89c39909e230202780dca20d3d6b1233f28e473af24

SHA512
90e170d87549b22fa86b0643480313dfe67a71d62761fad652b82d7a8548f2ddf03904a4d676b5c647a506b4d6bf552c1d629850faab7602597d4fed1d3c90f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c4db3821881edcbe15f117e545e5894

SHA1
dd8e419fb30e53ba81ad5b3e846bd6b151144c8b

SHA256
de655f99240886f12335105d3d2621508f9dc680f335494690d9bfad95bfddd5

SHA512
21c909e4b041f95382829b12947b10d31ec8065e33373dda9bbb584a456708b679a46cdf7cafddce16cbafb586556e50170e040f10fec3c271246d704ad6e8ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c0729a6d3e403c15d6b61751450f9d0

SHA1
181bd18c5b86d2192ed4c7e31c37539ca5c31c70

SHA256
c84dcd6d4ad23d4e962e8ad0b560fe5cb1485ea6c90ef4f836d90456bb60fd8c

SHA512
4de2b5c0dceab1fcf555d4f786f5b54d3a33aca4273ddac2db27a2fa9561ac72c7e0c535217d09c9590b832fb9bc5e2c865e2efa9de903445ec91653b38d0778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
605447358562bc69bd3961564284afb5

SHA1
0ed8dcceabf168728ef856843e43d51308aa1929

SHA256
d243a2e8156c0d72cfb4f132771468de65d8901636baa29ee0844fc004a66b0b

SHA512
bbfe9e357e3e0208107b7c117c6019f81c6d4d1a3ba49f1b0bc1b33cd51bf4aa837d4cc48e04f7216dba132cb115ce76c3999a8c613517c1aecbc6e6e4ca1048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
267c4efd90319a944f45ca4a96606674

SHA1
94414a5cdbcfdee9aa17aeb152fec4c0c741faa4

SHA256
14b4173b907fa05ab7d54667d00843a4213d606eec900269ff8908bbf1b96745

SHA512
4a793a708a3d4f4da868710bb55d28b3a477021886ba532b90a0cc987d239e8466359a93935ff7ace49c36b28ab4bb574e647b8b8889ddaa40f47f0c34052f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab87E6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8848.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__config252888.bat

Filesize
212B

MD5
8d14a5963935a3a8bde046ce64d4bdce

SHA1
f9b42680f7e93354076d932d4b45f2d17cdca697

SHA256
305cf21659447e296f7156e514d23302d3fdbb21edad5f4018ee5b07469414f2

SHA512
4f739adc28dcd0c9af20bf7dbfda4ffc3ab385e8bb7289236004a18a7a94b7b11385c024a171301f3a5522965da7411bd29115a8806dc08d58bd88ab6dbd5d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj7BB6.tmp\RegDll.dll

Filesize
44KB

MD5
615872a93918d36997b2e7c10ce85f8b

SHA1
d6729cfdcde65c96fe5f0598a88115fd32e1c688

SHA256
839d8796e41615723cde372e3361e60f7f19fcb20bead85518f8dd1705384fcc

SHA512
68ae5d22ea4b6ce9aacfd4c4cebe20b2a1712f68ef33e0b6264e53a1188af88b427ce2504f6a0a2b0afcc62c290ed1eae317f0059f0dc34293cb255a12df8a47

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj7BB6.tmp\RunAsLogon.dll

Filesize
85KB

MD5
41026c144852ee30843d5b9ec4969213

SHA1
bad50ab285b5f90973b92618353abfdb7bb971f3

SHA256
71741f95673255c3eddc47d2675f69195709f6962a63a7874a27686694493910

SHA512
bff120e00070025b1d008cbb814b54a4f82ad4be761479c7a0abdb6f99d08a8e76c6add1909e5715bbb7567095c4812c9b728c2936d40ce1f13158721cbf5039

Download Submit
C:\Users\Admin\AppData\Roaming\BBLiveZip\Temp\inst.rpt

Filesize
271B

MD5
408435404672381db18d09660c9519af

SHA1
4664ce01639196182882da20aef6d3fcf9bbb3e0

SHA256
6f186b904d809b4e0ada90de0313fc32f5fd86ac4b340f1b0cb7a3ffd1688aa4

SHA512
5a1a06d4bd1917c54a547c31a33583fc981d06aa37640fe90e7dd86440b716761d8752d40d4c0f49159fb9f92a606bfd87ad0254dd84193feac563ff9666e283

Download Submit
C:\Users\Admin\AppData\Roaming\DaumCleanerUpdater.exe

Filesize
996KB

MD5
20f6e0a35b8b0b82f0c3b9bf1365c124

SHA1
0922827614fcd175c7fee65af141f75b981db104

SHA256
7446accac4e0ad58ba3284afd3f2f3342ca01ac65737a6076338a674eb6323b0

SHA512
fd713a38665fa4f210fc5f59b8f60a62ddd39e476307e084acae1cfbd7bdbc72eb482b0a0cddb31d7606f643a8db0db14d8596285901ba485e1e4866aa01fce0

Download Submit
C:\Users\Admin\AppData\Roaming\shopbacon.exe

Filesize
239KB

MD5
63220fd5a196fce69446a6480e1b63ae

SHA1
d28577cc97f17f3f015eef414cba77feb1871371

SHA256
7cad288cd0f3a4ed04269bd9fcde4012d8c0aaeba7e9f6cc11aa4177ff484b10

SHA512
5bddb1058506240207e69c914f577242c78b7a3959370c0349af8d5bfff9dd79fe70dd38b78fc8e2854adb096f39c7bf15b9bb641557e970404d95980ddcb7a7

Download Submit
C:\Users\Admin\Desktop\00315\HEUR-Trojan-Ransom.Win32.Generic-d23e3a5220ab529d7df6d295167db6774e8d77c106ae26b0c210fbabcffc84c7.exe

Filesize
800KB

MD5
808c1603cbf32c1f459384afec7469f4

SHA1
a9a071987c5eaa4ad3b0688609b86d2ebf9cf8ad

SHA256
d23e3a5220ab529d7df6d295167db6774e8d77c106ae26b0c210fbabcffc84c7

SHA512
1652aba4b07006c655dc07323b695f36931b07b00f5af57feb691221dd94a792fe567919d0a01d016e4b6872bd3b135fba52f3c85dccd619c2ad129415308185

Download Submit
C:\Users\Admin\Desktop\00315\HEUR-Trojan-Ransom.Win32.Generic-fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4.exe

Filesize
134KB

MD5
83aadfbda85a1cb4c1859a4cb49d0096

SHA1
f1e0954e498b6e24a3b86d77ad5074652e180f6e

SHA256
fcdcae2525f6dbc538f9b9a2c4afc46091cbe34cdcbddbbef588517689c6b4f4

SHA512
80f28e8e801eb4099114756d74e891b9472a75cadb6f4962fa5f9ce5515860cac43b17cd7b3d711652c027f2c1c633cc34ce3888911b150ffc4b72bb161e0e11

Download Submit
C:\Users\Admin\Desktop\00315\HEUR-Trojan-Ransom.Win32.Onion.gen-5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254.exe

Filesize
5.6MB

MD5
ff513a9c9b63c636baf803c3a1404992

SHA1
151489d886fdeca359a5b1b3bf5f1eba9093e48f

SHA256
5076fd6073c0c7fc900c0658c40edccf93f28b8169e2e3de4669f82820fcd254

SHA512
901958dfdd767bec8711293e4f3227007d438a7d705683534e7ec91552df4ef817203c30fb531d53d9e8c4e533f4c250c5c52b59beb8cd957df1066aac68f60f

Download Submit
C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.Blocker.cuqz-2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650.exe

Filesize
1.4MB

MD5
88c14ecbfbf45f513d9cc02c56a079a2

SHA1
5976db0a7a357a2ae932c68954a50983884383b6

SHA256
2237a728b4f2100c199b2b22d667ab4e20c87957080cee7245ce695e9c24a650

SHA512
9fa391685b9ab9eec594f9840a72c9afe1c2233d6474131f22b268d3a6d86545519c48bcbd7abe5bce7fe1926509e6e2c379dce97ffe1a7296e28df51757df07

Download Submit
C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.Blocker.dmbt-5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553.exe

Filesize
251KB

MD5
829dde7015c32d7d77d8128665390dab

SHA1
a4185032072a2ee7629c53bda54067e0022600f8

SHA256
5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553

SHA512
c3eb98e3f27e53a62dcb206fcd9057add778860065a1147e66eac7e4d37af3f77d2aab314d6ef9df14bf6e180aed0e1342355abaa67716153dd48ae9609ca6e1

Download Submit
C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.Blocker.meia-acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25.exe

Filesize
63KB

MD5
21f9e531873d5f4f7f50da450d4a05c1

SHA1
3378749ba82dc3aff868bfbfa8e09d720b22dbb1

SHA256
acb82fe03b4face029839512182ac8ceb9954b8aec6c3165122c441b4b526e25

SHA512
727d74276ea3483e006164e61a83b25ee025ec21a9a213983fccc923728a4c135162d8560bc8f5c120d51f09299e4838f30259afdf07ec35390f1cfe25d5754f

Download Submit
C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.Foreign.nzti-9b3af0dd248f86114a0c042e4385649ff294707479a85006a7dd384071213890.exe

Filesize
1.4MB

MD5
1ab249b24f9c36713b5916c1c961eb41

SHA1
dd939e5cffc4b14dffb758af7d130dae0244d158

SHA256
9b3af0dd248f86114a0c042e4385649ff294707479a85006a7dd384071213890

SHA512
16519594e86b6408dfe79d889aa5e5727dfaa8f2c4a407a45e390c3bae86c889a6ba4d56092c3e7a976278e08b06cc01fc1bc3980d04eb2d4b5dc9189e86e178

Download Submit
C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.GandCrypt.xl-f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a.exe

Filesize
229KB

MD5
55cd89bc177bb4844746ae338dde24ce

SHA1
0ebc1dd8e15263e1f4d9a0db9f928519ac941512

SHA256
f0e33dfc75cfe9939d801f27917c3659480319953c73fb896450f3292e2c5d0a

SHA512
4c9ca87c209bd8ce864b8b32a0486d5205403210381a432e91101687ea28b9970cf8a68cede7680b5c6974d8a7cec911d1d409c14b795aeeb51ff1c03b48f50d

Download Submit
C:\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.SageCrypt.fc-26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14.exe

Filesize
238KB

MD5
c2cd821ccd6eec05ec67be3a99ba0f71

SHA1
916e018fe28774ef227e839b98dc0a85c13d64a3

SHA256
26f5a4b79ee5a6cc0acacd5d285a10907ff9eb2d32af5bddef3ad81f663a5b14

SHA512
8fbe6edcd6c58ec34815e5ba422cf335445a50a958de5758bcefa29fc9179a7fe9c31fb7f5d5c5f310304709496e7e64f539a25d907a349c1e15bf8861f3d548

Download Submit
C:\Users\Admin\Music\!HELP_SOS.hta

Filesize
52KB

MD5
d9501755348ba35137cff1459803b3a1

SHA1
d110431ebf0ef9510bbf7d5e34d022c1a8c137fb

SHA256
d0e5d7f861a6d2d1a26d17f8fb6dd07a8d5f933ec1727b9f07f280f546dae5a5

SHA512
ee3e40a07848d65a31bb81fcf6251012edd5e1c3ba6c209a59889c0a4139849f1193a14ec65fe4c4ebf4e25afca7e927531e1e5cf021e817e469fbbb25ca9e18

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
3e56162d0318fd97f5991a591bdd8ac0

SHA1
c974042c2651018854fbe053608407e6390f5cd8

SHA256
6c0161b64ed1111debedc2b6e4a86b8600be7f6d012575c66bb7c4bd421bd923

SHA512
2a0a04a81f59aaa3f62f9954cf975ab3757c1ee35cdfbf3d2ca0406ec0314733a22ef96b14a1f8e800527a00280757b3da23d1a056c589f57dd9c421db542f13

Download Submit
\Program Files (x86)\BBLiveZip\BBLiveAid.exe

Filesize
620KB

MD5
2fbba36230754433203af7fe0d04b82a

SHA1
e47d011ea738f3c1bf8b95a70d876cc07b765bdf

SHA256
20f5ec0f8e2f3d7175352b86a8e5415f49d156abdadcee9e5ba0a765150d8e1d

SHA512
fa2db6ac6a8b524a96a189e54c429ded12cfe18b285c4fb1c8374337b19b3e3f0a74155e63d986a2e57bb0fb205c54c0bf28d3e5ad8f70d8f18a767b6ca24c0b

Download Submit
\Program Files (x86)\BBLiveZip\BBLiveExt64.dll

Filesize
338KB

MD5
0937717166dc82e48f8df46ac2a4beaf

SHA1
9bb795e300d193b7bb04c1453a061f27b4a6646b

SHA256
5c7612bbaa956d0ae945abb3f81a0a4da78703df9c8ca77f9e35939bfa9ec9a1

SHA512
6030b5413cc0fef54477929587a759f78e58f63e6c9fecd05801b5edeb80dc35e8c44f8237cde105fe57b1db97c553414dc97baf794f9a19ca91b7a87e244b29

Download Submit
\Program Files (x86)\BBLiveZip\BBLiveSvc.exe

Filesize
605KB

MD5
02dda346c111f3cafbb6af5a866ae902

SHA1
337e0b92c9ea26942fa198181f587acdeb18b528

SHA256
147e4cee56aa385ecd273f1553d404f541cdcbd45f6b2a87edc7f7cef8b6378c

SHA512
7426c913f65afe828f0cc0f75ca1c1cc4ec55433a9d95f07d982ca69e4c8408b55cb1554665b3e346920d83e0bb876b5abb936d9117be968e5f7f7e2070d3522

Download Submit
\Program Files (x86)\BBLiveZip\zlib.dll

Filesize
144KB

MD5
756550abfb8a4624a501fdd231a704ee

SHA1
73dd218ab691b484f9f558453096f0be419a15ca

SHA256
c755331225ec7db43c3c3e77f86a0ba72a5f2779f9d59fed678814a3d3f3e1ce

SHA512
12e0c71cb7492345282e58896f92bbb15c596bda17f6a5364fedcbfcff09644dceb39c4734d2a0a3223cd84e6459b8c5cd2f117794de35c8ddba27c5ca25208a

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7BB6.tmp\ChannelDll.dll

Filesize
91KB

MD5
1458c52c0baa22de71c2fa2480f9fb89

SHA1
c816de231baa2b6873b9e76e8090df7577ed391c

SHA256
2e26b19d6a827a60ca2133e454eea4020f03fb2d05b17c0ba1b0a2da2f8a6d7d

SHA512
043f56aadeb68c94a8afb3eaaa79eec1b29b817b655f24fcf32cf124c36d656f63f74acfbf58437ab2ef865c8fc4bbcdf0527641754af07d7536dffc9326e191

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7BB6.tmp\KillProcDLL.dll

Filesize
42KB

MD5
f5a1c92d4a25e4b78f0b39fc063ae6e6

SHA1
359dfb8fd647e345bdc139e7f4887facd6a9a210

SHA256
5aaad8f5599f6196b931144f130637810171a3c723de3413e2eeffa4aa2b5193

SHA512
473fc2137d897e3cebf2368f659b9b34611e176be838c78d6f4db4be707fe08a2d3ece5aca562d51f763a09dafad173c7e1f8a550df59e7ded7fdbb438c33688

Download Submit
\Users\Admin\Desktop\00315\Trojan-Ransom.Win32.Blocker.fpnf-ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15.exe

Filesize
6.5MB

MD5
fbdcd4dbdf03cad6820e5863e87abf7c

SHA1
d99229475073ff2102d07f5cc24f7d113b6cd290

SHA256
ecd869d71c8fb00edc00d49e1fee23eac9a629c327e9d8fae1678d4ce983de15

SHA512
fd08df301501a39939300088928933b5dd26d51fa45b27bead42242aaadaf8cd2f456b349cdef19fb0afbfc4a3eba367dac382f3d69f7117d83a8a86b6168802

Download Submit
memory/956-234-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/956-222-0x0000000000610000-0x0000000000612000-memory.dmp

Filesize
8KB

Download
memory/956-527-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/956-506-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/956-243-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1108-998-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1108-558-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1108-1001-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1108-554-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1108-550-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1108-507-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1108-1007-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1108-989-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1108-1004-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1108-993-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1352-166-0x0000000000D50000-0x0000000000D63000-memory.dmp

Filesize
76KB

Download
memory/1404-45-0x0000000000490000-0x00000000004A8000-memory.dmp

Filesize
96KB

Download
memory/1724-221-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1724-176-0x0000000000330000-0x0000000000332000-memory.dmp

Filesize
8KB

Download
memory/1724-199-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1724-212-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1988-111-0x00000000000C0000-0x00000000000D3000-memory.dmp

Filesize
76KB

Download
memory/1988-208-0x00000000000C0000-0x00000000000D3000-memory.dmp

Filesize
76KB

Download
memory/2120-240-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2120-235-0x0000000000210000-0x0000000000212000-memory.dmp

Filesize
8KB

Download
memory/2120-244-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2340-204-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/2340-224-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2340-209-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2412-211-0x0000000000400000-0x0000000000A4D000-memory.dmp

Filesize
6.3MB

Download
memory/2412-164-0x0000000000270000-0x0000000000287000-memory.dmp

Filesize
92KB

Download
memory/2412-163-0x0000000000400000-0x0000000000A4D000-memory.dmp

Filesize
6.3MB

Download
memory/2484-242-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-991-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-1006-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-505-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-126-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-226-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-213-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-552-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-1003-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-1000-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-556-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-995-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2484-560-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/2580-44-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2580-130-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2580-118-0x0000000003FB0000-0x00000000041D0000-memory.dmp

Filesize
2.1MB

Download
memory/2596-20-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2596-553-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2596-557-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2596-22-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2596-21-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2652-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2652-46-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2652-48-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3044-194-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download