Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 16:59
Static task
static1
Behavioral task
behavioral1
Sample
RNSM00278.7z
Resource
win7-20241023-en
General
-
Target
RNSM00278.7z
-
Size
3.3MB
-
MD5
e3c18bb148191204063824cc2e1729ef
-
SHA1
f294d8334e112ed4aa598528b8e7e5840fb02c8c
-
SHA256
2a68c74bf9430074297107fa0d4f1cd04b13d5a771b039a096dfbf4a9f38a50a
-
SHA512
dc94d016b1cf638a81369e5b8cc96f543d5340e91f6cf991117b25c1e220dd77058c82989f0933c1a009c5012be4fa3e51dc225c0bc54e41be8fc5d5f81361a1
-
SSDEEP
98304:67qAIObVOxYuSyWqz1eNKjZBx8GDsKHUbr46:8qpUcxDd1Xh8SIr46
Malware Config
Extracted
gozi
Extracted
C:\Users\Admin\Desktop\_HELP_HELP_HELP_LVCGITNQ.hta
http://p27dokhpz2n7nvgr.15nhsf.top/EFA9-5EFB-D661-0091-C116http://p27dokhpz2n7nvgr.14gmtu.top/EFA9-5EFB-D661-0091-C116http://p27dokhpz2n7nvgr.1321z6.top/EFA9-5EFB-D661-0091-C116http://p27dokhpz2n7nvgr.16ay2s.top/EFA9-5EFB-D661-0091-C116http://p27dokhpz2n7nvgr.1dp6un.top/EFA9-5EFB-D661-0091-C116
http://p27dokhpz2n7nvgr.onion/EFA9-5EFB-D661-0091-C116
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Gozi family
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
-
Locky family
-
Locky_osiris family
-
Troldesh family
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\wvedcdjf\\idjigiar.exe" explorer.exe -
Blocklisted process makes network request 5 IoCs
flow pid Process 1165 2072 mshta.exe 1169 2072 mshta.exe 1171 2072 mshta.exe 1178 2072 mshta.exe 1180 2072 mshta.exe -
Contacts a large (606) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe -
Executes dropped EXE 18 IoCs
pid Process 2728 Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe 2988 Trojan-Ransom.Win32.Blocker.hrft-83dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760.exe 2832 Trojan-Ransom.Win32.Foreign.njoy-703f9eae4f2b62cc0ca7a2d0a8f34da2853121b232e5a0e220ff72f13f5ad303.exe 2948 Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe 2740 Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe 2692 Trojan-Ransom.Win32.Locky.xey-06ba734b49a3da926c18f3434173981b012a9ecd41f1e45196140b6d41360da7.exe 2724 Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 2704 Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe 2768 Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe 2984 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 1344 FB_4D84.tmp.exe 2288 Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe 2160 Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe 1616 Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe 708 Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe 2380 Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe 1640 bitspntw.exe -
Loads dropped DLL 13 IoCs
pid Process 2740 Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe 2988 Trojan-Ransom.Win32.Blocker.hrft-83dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760.exe 2768 Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe 2768 Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe 2740 Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe 2724 Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe 2248 dw20.exe 2248 dw20.exe 2248 dw20.exe 2248 dw20.exe 2248 dw20.exe 2728 Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe 836 cmd.exe -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 193.183.98.154 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 31.3.135.232 Destination IP 5.9.49.12 -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\chtbsext = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DDAC3dlg\\bitspntw.exe" Trojan-Ransom.Win32.Foreign.njoy-703f9eae4f2b62cc0ca7a2d0a8f34da2853121b232e5a0e220ff72f13f5ad303.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe -
Sets desktop wallpaper using registry 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp" Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp" Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8C0A.bmp" Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp" Trojan-Ransom.Win32.Locky.xey-06ba734b49a3da926c18f3434173981b012a9ecd41f1e45196140b6d41360da7.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp" Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe -
Suspicious use of SetThreadContext 11 IoCs
description pid Process procid_target PID 1392 set thread context of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 2768 set thread context of 2288 2768 Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe 46 PID 2740 set thread context of 2160 2740 Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe 47 PID 2724 set thread context of 1616 2724 Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe 48 PID 2728 set thread context of 708 2728 Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe 53 PID 2948 set thread context of 2380 2948 Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe 58 PID 1640 set thread context of 2796 1640 bitspntw.exe 69 PID 2796 set thread context of 1212 2796 svchost.exe 21 PID 1212 set thread context of 1948 1212 Explorer.EXE 57 PID 1212 set thread context of 2056 1212 Explorer.EXE 83 PID 2056 set thread context of 2224 2056 rundll32.exe 84 -
resource yara_rule behavioral1/files/0x00060000000186f4-22.dat upx behavioral1/files/0x0006000000018704-35.dat upx behavioral1/memory/2948-42-0x0000000000F80000-0x0000000000FAA000-memory.dmp upx behavioral1/memory/2988-32-0x0000000000400000-0x0000000000638000-memory.dmp upx behavioral1/memory/1616-149-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1616-152-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1616-153-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1616-163-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1616-164-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2948-180-0x0000000000F80000-0x0000000000FAA000-memory.dmp upx behavioral1/memory/1616-343-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2380-712-0x0000000000F80000-0x0000000000FAA000-memory.dmp upx behavioral1/memory/2948-706-0x0000000000F80000-0x0000000000FAA000-memory.dmp upx -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\microsoft\word Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\onenote Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\thunderbird Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\bitcoin Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\microsoft\excel Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\microsoft\office Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\word Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\powerpoint Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\microsoft sql server Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\office Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\outlook Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files\ Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\ Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\excel Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\steam Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification \??\c:\program files (x86)\the bat! Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification \??\c:\windows\ Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 35 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB_4D84.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Foreign.njoy-703f9eae4f2b62cc0ca7a2d0a8f34da2853121b232e5a0e220ff72f13f5ad303.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Locky.xey-06ba734b49a3da926c18f3434173981b012a9ecd41f1e45196140b6d41360da7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bitspntw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Blocker.hrft-83dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2092 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 1960 taskkill.exe -
Modifies Control Panel 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\TileWallpaper = "0" Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\WallpaperStyle = "0" Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\TileWallpaper = "0" Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\WallpaperStyle = "0" Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\TileWallpaper = "0" Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\WallpaperStyle = "0" Trojan-Ransom.Win32.Locky.xey-06ba734b49a3da926c18f3434173981b012a9ecd41f1e45196140b6d41360da7.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\TileWallpaper = "0" Trojan-Ransom.Win32.Locky.xey-06ba734b49a3da926c18f3434173981b012a9ecd41f1e45196140b6d41360da7.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\WallpaperStyle = "0" Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{678305F1-A8F3-11EF-B45F-4E45515FDA5B} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69CEF991-A8F3-11EF-B45F-4E45515FDA5B} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf000000000200000000001066000000010000200000007df13c80ac138ea592b160781da47ec8fa390ded2789a44d64580b51e462227e000000000e8000000002000020000000626a10ca09f404a9e5e64371a4e750963b64a5f89d58d5445804cbdb0838a1b320000000928f5945ec7e4386d697412b787b242392b3ba6117d0099c0d45c84b82d6dc5540000000a13625ecef31ac2e4c4ecf13bca6156dee19e148910f0c49a73fd83820f3d4a4074c7e126d3b37d08c9b4e3d308231be73283621c2a06390a43d0ae6f349c1e2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4EBA5B91-A8F3-11EF-B45F-4E45515FDA5B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf00000000020000000000106600000001000020000000277fc6f314f7d5303609a7f47840be5f0a28707e9cfb3de426532ae048a10460000000000e800000000200002000000031397b939ac488186d8da8a974ab2dcbad3212b0bdd74635da73afcb2c571b0a9000000040bfe08e705af19201c78cae971346fd3921d7b6dfed54fdba404aa560e6b9e774d43323d04a59362f60e27237d61f88cff4b6d71cf2ea5bf1d260d4d110907602d2e50da1f833a4ea59ca4e6f8d774613c1c176b3170f98fae0d109e8e4e9aeb30590f6f55711c89af6c553ea0f914282ff5eb92ec67ddf0e417efbd9c42f1fb35931a6125de0cf8d9a81d197e8169d4000000093c5c4cdf34b5de00d9fa6b5078330a92af3927ed79f69535a0b1c0aef04e9f296eb50dd3bc8b2532ad17370c784cddf242ff5cc93a96accf4f9e4f338d698cf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 4c0031000000000076591a881020303032373800380008000400efbe76596a8776591a882a000000e786010000000800000000000000000000000000000030003000320037003800000014000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 03010000fd0000eeebbeef00040001000000550000003153505330f125b7ef471a10a5f102608c9eebac390000000a000000001f000000130000004400650073006b0074006f00700020004200610063006b00670072006f0075006e00640000000000000000004900000031535053537def0c64fad111a2030000f81fedee2d00000005000000001f0000000e0000007000610067006500570061006c006c00700061007000650072000000000000004d000000315350538727bf5ccf480842b90eee5e5d4202943100000019000000001f000000100000007400680065006d006500630070006c002e0064006c006c002c002d0031000000000000000000000000000000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 1e00718000000000000000000000d64e83ed5a4bfe4b8f11a626dcb6a9210000 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 0c0001008421de39010000000000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369" Explorer.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2092 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 10 IoCs
pid Process 2728 Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe 2988 Trojan-Ransom.Win32.Blocker.hrft-83dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760.exe 2948 Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe 2832 Trojan-Ransom.Win32.Foreign.njoy-703f9eae4f2b62cc0ca7a2d0a8f34da2853121b232e5a0e220ff72f13f5ad303.exe 2740 Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 2692 Trojan-Ransom.Win32.Locky.xey-06ba734b49a3da926c18f3434173981b012a9ecd41f1e45196140b6d41360da7.exe 2704 Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe 2724 Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe 2768 Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 1616 Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe 1616 Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe 2160 Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe 2160 Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe 1640 bitspntw.exe 1212 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1212 Explorer.EXE 2056 rundll32.exe -
Suspicious behavior: MapViewOfSection 9 IoCs
pid Process 2724 Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe 2728 Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe 708 Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe 708 Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe 1640 bitspntw.exe 2796 svchost.exe 1212 Explorer.EXE 1212 Explorer.EXE 2056 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeRestorePrivilege 1736 7zFM.exe Token: 35 1736 7zFM.exe Token: SeSecurityPrivilege 1736 7zFM.exe Token: SeShutdownPrivilege 2160 Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe Token: SeRestorePrivilege 2704 Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe Token: SeRestorePrivilege 2704 Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe Token: SeRestorePrivilege 2704 Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe Token: SeRestorePrivilege 2704 Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe Token: SeRestorePrivilege 2704 Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe Token: SeRestorePrivilege 2704 Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe Token: SeRestorePrivilege 2704 Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeDebugPrivilege 1960 taskkill.exe Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 1736 7zFM.exe 1736 7zFM.exe 1040 DllHost.exe 1040 DllHost.exe 1040 DllHost.exe 1948 iexplore.exe 1040 DllHost.exe 1040 DllHost.exe 1040 DllHost.exe 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1040 DllHost.exe 2628 iexplore.exe 1040 DllHost.exe 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 3272 DllHost.exe 3284 iexplore.exe 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 3272 DllHost.exe 4016 iexplore.exe 3272 DllHost.exe 3272 DllHost.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SetWindowsHookEx 26 IoCs
pid Process 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 1948 iexplore.exe 1948 iexplore.exe 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2628 iexplore.exe 2628 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2224 mspaint.exe 2224 mspaint.exe 2224 mspaint.exe 2224 mspaint.exe 1212 Explorer.EXE 1212 Explorer.EXE 3284 iexplore.exe 3284 iexplore.exe 3128 IEXPLORE.EXE 3128 IEXPLORE.EXE 4016 iexplore.exe 4016 iexplore.exe 2020 IEXPLORE.EXE 2020 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2728 2828 cmd.exe 34 PID 2828 wrote to memory of 2728 2828 cmd.exe 34 PID 2828 wrote to memory of 2728 2828 cmd.exe 34 PID 2828 wrote to memory of 2728 2828 cmd.exe 34 PID 2828 wrote to memory of 2988 2828 cmd.exe 35 PID 2828 wrote to memory of 2988 2828 cmd.exe 35 PID 2828 wrote to memory of 2988 2828 cmd.exe 35 PID 2828 wrote to memory of 2988 2828 cmd.exe 35 PID 2828 wrote to memory of 2948 2828 cmd.exe 36 PID 2828 wrote to memory of 2948 2828 cmd.exe 36 PID 2828 wrote to memory of 2948 2828 cmd.exe 36 PID 2828 wrote to memory of 2948 2828 cmd.exe 36 PID 2828 wrote to memory of 2832 2828 cmd.exe 37 PID 2828 wrote to memory of 2832 2828 cmd.exe 37 PID 2828 wrote to memory of 2832 2828 cmd.exe 37 PID 2828 wrote to memory of 2832 2828 cmd.exe 37 PID 2828 wrote to memory of 2740 2828 cmd.exe 38 PID 2828 wrote to memory of 2740 2828 cmd.exe 38 PID 2828 wrote to memory of 2740 2828 cmd.exe 38 PID 2828 wrote to memory of 2740 2828 cmd.exe 38 PID 2828 wrote to memory of 1392 2828 cmd.exe 39 PID 2828 wrote to memory of 1392 2828 cmd.exe 39 PID 2828 wrote to memory of 1392 2828 cmd.exe 39 PID 2828 wrote to memory of 1392 2828 cmd.exe 39 PID 2828 wrote to memory of 2692 2828 cmd.exe 40 PID 2828 wrote to memory of 2692 2828 cmd.exe 40 PID 2828 wrote to memory of 2692 2828 cmd.exe 40 PID 2828 wrote to memory of 2692 2828 cmd.exe 40 PID 2828 wrote to memory of 2704 2828 cmd.exe 41 PID 2828 wrote to memory of 2704 2828 cmd.exe 41 PID 2828 wrote to memory of 2704 2828 cmd.exe 41 PID 2828 wrote to memory of 2704 2828 cmd.exe 41 PID 2828 wrote to memory of 2724 2828 cmd.exe 42 PID 2828 wrote to memory of 2724 2828 cmd.exe 42 PID 2828 wrote to memory of 2724 2828 cmd.exe 42 PID 2828 wrote to memory of 2724 2828 cmd.exe 42 PID 2828 wrote to memory of 2768 2828 cmd.exe 43 PID 2828 wrote to memory of 2768 2828 cmd.exe 43 PID 2828 wrote to memory of 2768 2828 cmd.exe 43 PID 2828 wrote to memory of 2768 2828 cmd.exe 43 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 1392 wrote to memory of 2984 1392 Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe 44 PID 2988 wrote to memory of 1344 2988 Trojan-Ransom.Win32.Blocker.hrft-83dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760.exe 45 PID 2988 wrote to memory of 1344 2988 Trojan-Ransom.Win32.Blocker.hrft-83dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760.exe 45 PID 2988 wrote to memory of 1344 2988 Trojan-Ransom.Win32.Blocker.hrft-83dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760.exe 45 PID 2988 wrote to memory of 1344 2988 Trojan-Ransom.Win32.Blocker.hrft-83dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760.exe 45 PID 2768 wrote to memory of 2288 2768 Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe 46 PID 2768 wrote to memory of 2288 2768 Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe 46 PID 2768 wrote to memory of 2288 2768 Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe 46
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1212 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00278.7z"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1736
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\Desktop\00278\Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exeTrojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: MapViewOfSection
PID:2728 -
C:\Users\Admin\Desktop\00278\Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exeTrojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:708 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
- Adds policy Run key to start application
- System Location Discovery: System Language Discovery
PID:1816
-
-
-
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Blocker.hrft-83dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760.exeTrojan-Ransom.Win32.Blocker.hrft-83dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\FB_4D84.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_4D84.tmp.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7685⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2248
-
-
-
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exeTrojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2948 -
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe"C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe"4⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
PID:2380 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\DesktopOSIRIS.htm5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3284 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3128
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sysC062.tmp"5⤵
- System Location Discovery: System Language Discovery
PID:3184
-
-
-
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Foreign.njoy-703f9eae4f2b62cc0ca7a2d0a8f34da2853121b232e5a0e220ff72f13f5ad303.exeTrojan-Ransom.Win32.Foreign.njoy-703f9eae4f2b62cc0ca7a2d0a8f34da2853121b232e5a0e220ff72f13f5ad303.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2832 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\96F2\CB79.bat" "C:\Users\Admin\AppData\Roaming\MICROS~1\DDAC3dlg\bitspntw.exe" "C:\Users\Admin\Desktop\00278\TROJAN~4.EXE""4⤵
- System Location Discovery: System Language Discovery
PID:380 -
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\MICROS~1\DDAC3dlg\bitspntw.exe" "C:\Users\Admin\Desktop\00278\TROJAN~4.EXE""5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:836 -
C:\Users\Admin\AppData\Roaming\MICROS~1\DDAC3dlg\bitspntw.exe"C:\Users\Admin\AppData\Roaming\MICROS~1\DDAC3dlg\bitspntw.exe" "C:\Users\Admin\Desktop\00278\TROJAN~4.EXE"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1640 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2796
-
-
-
-
-
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exeTrojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2740 -
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exeTrojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe4⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_HELP_HELP_HELP_LVCGITNQ.hta"5⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2072
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵PID:1996
-
C:\Windows\system32\taskkill.exetaskkill /f /im "Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe"6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2092
-
-
-
-
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exeTrojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exeC:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe4⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
PID:2984 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\DesktopOSIRIS.htm5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sys1DDD.tmp"5⤵
- System Location Discovery: System Language Discovery
PID:900
-
-
-
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Locky.xey-06ba734b49a3da926c18f3434173981b012a9ecd41f1e45196140b6d41360da7.exeTrojan-Ransom.Win32.Locky.xey-06ba734b49a3da926c18f3434173981b012a9ecd41f1e45196140b6d41360da7.exe3⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2692 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\DesktopOSIRIS.htm4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sysC523.tmp"4⤵
- System Location Discovery: System Language Discovery
PID:2448
-
-
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exeTrojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe3⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:2704 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\DesktopOSIRIS.htm4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4016 CREDAT:275457 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sysCF60.tmp"4⤵
- System Location Discovery: System Language Discovery
PID:4080
-
-
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exeTrojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: MapViewOfSection
PID:2724 -
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exeTrojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1616
-
-
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exeTrojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exeTrojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288
-
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\N159GW5N--SRMB--Q78Z--87B238B6--9764BF3CE8F3.osiris2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
PID:2056 -
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\N159GW5N--SRMB--Q78Z--87B238B6--9764BF3CE8F3.osiris"3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2224
-
-
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\92B1.bi1"2⤵PID:2140
-
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵PID:3020
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\92B1.bi1"2⤵PID:2000
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1040
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
PID:1520
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:2292
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3272
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Discovery
Network Service Discovery
1Peripheral Device Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD58320983488033acd5a4c055b51bbd2cd
SHA14369f98cb04053054bc1534809c36d15a506312d
SHA256f2c5c7de6182e2985bfc3a413d40ae2f14c9b6d3b2979c1131c44e76da23f920
SHA51228628b94ce1796a467b9c7cffde513ce2473cfb9e435159867293bb1f68470b973a81e54a68d5e5b51ee5288c0eb1fc9a25777110cd7749fef9b190eeabf6339
-
Filesize
8KB
MD56571f205e5b112f765205ebee0a2a10c
SHA1e3faf875fe6012347e265d33163e85c2b6874866
SHA256010e19e7dcc3257f3b62ae26212b8aa7b0a9cf391c612fa6edf45d5c9b36b0be
SHA5126100864da29fc1d24a13747995171d497605b4ced6d734c588113c0e82749daace15cce7aa7aa5cc62dabf9897874e70ef549fb7e119763b3c68d365714be075
-
Filesize
7KB
MD5564ccaefde5b25aa4008c7659cd7eedc
SHA18eed6be27231bb79cce2eb8ae94e8d52adf22212
SHA2564b81eb2b96284165da1633262fe958e9510d537292aa87bdfaaec890a22de4d7
SHA5125aa67d3560a1dd326434aa7064053adfbac9d4c4f77a179109071b0767061169f5785ed1265d8f99791bf62b861714e6d485074a19d9137fd3edaf0a15ddfa84
-
Filesize
8KB
MD5a4c8c115e77087781f223a40fa7f36de
SHA1b00fa1e1337f74aac72305644865633278c4014f
SHA256cde7e5ba625bb19066464b0c99208227a30346264277de11c19d3c4a21f5941a
SHA5120007d485ec941077417cfdcde0a21c02b865b4c6a5f0634393ce4c91ffa9173160603dc107dcfae0623cb05c0e4b8e54e627b98b34712fa0fac712ce294df934
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf70983ce18264bc536648a67e4d08f4
SHA1b5b1d71db64c6d17f2c0b0c523a49e46f4f28998
SHA2560ad3f74944af6b0bd90f852401678e87f138959c65faada10268d94a0f2d47ea
SHA5121de59544a6a1892aab58b96c43b1dd9a77df9b673f01a43feddeae8d0d3429bdd72a70dbe6adddf52241a7c7cc82c66c1ade3674a7ff0f751b8664be1c0f2696
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a58be3801f43e32a801a7952cb5311d9
SHA14539e40e2526602161d361dff096f805070266fb
SHA256895e5420c927a08efc09cc8a8501f374581a6778f026023b2be74db8ce899eb5
SHA512628fe89679af307b4248f3f00eda19c30fa581c49ad37b2c53533f4eef97e25903c8b4a7c6bc8d0b5962ba8178e13a86f3ca44858045420c0a514fbcb6090756
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ceee8ae3a8d2e4993f0a62134071f72b
SHA1b994b70cd0b370ef3c961a5e13ed5adb32bc8f02
SHA256a0e0c3e58576b71a877b1e041be2bac778b903678608f40b48003a5c02059f67
SHA51295655108a971c932ce0324e78f76a95d54b1c927999766113097f51f59b58843b47440bea8aae0c643c5098fa1c5d2440c06781d1cceb765bd32643658ed98de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50133d4a4a7d9aa6c74fe9b0185e4fe42
SHA10ca61155afd083488ba4e3b057060a017f35e734
SHA2568bea7ed9dfc1821b77498dd341f02e904848c80b1974b47882bd1e86c8d2e396
SHA512ecaf8e7d0ff26a103db729353ff5d729d032c4cd819a302d69a01677bbf3cd8b272425c25c769c093b5c348b535cc2ca5ccc89c791e49661d54bfe0465ea2403
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7260338206074091fcd1f5dabf2b979
SHA1fa39872477907b38100a3a5ce8586d118673e650
SHA256e709ae81a962ad45a5a3fdac141506ecea18ae033febd1ddcfa98e5e81880db1
SHA512150e51b053ffdfefb2e59962367b571cae72371886554055d38fcffbb40e50a1b0db172de0f5bf9727dbc014bc00c79f523c32f66c9b834dcc88b3df76003a15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5366d131d6ffaefedf10087101c81e200
SHA1e8c5b78cfbb84b501efc63c93f1770f554b639da
SHA2567f2fb07a903da1da5ca8318afb26cc5e6d1d86b62250a13c306b2fe9a236d2bd
SHA51263eb517943daff42ae5299979bb4666f6eb0f7fab414651920553839e184ff9a11bc6d5d5c23b6db7798ceca3d70aa57b5f290c67e1ae312e6e039cdd0f5c15b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5d88c4084868821480c7c64891e57b4
SHA1d387d8858183b31ff6547e968edb4842ee404a44
SHA256a922cd066f8be08dcc5a7e2810990bda186345c9db248be3cb79a51970e13fb7
SHA512800048a2947e4a33e212f65230635db230fe5e29f0bc1066b6f84ee094b7a7319e0e077e435837a84738a4b757625d5744c4123b2ae7359cf4818b6483c07bd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce5ce193cbf5ea240bd27453493a2d93
SHA130b6be91e49d6c2c79a0593975ca8f2577a6b8de
SHA256d56edd7bf8c51cd85070c11d384ab1fb54d40f42dd6af737b95856707e46a0c9
SHA512225a02e44e4e6f7e317aa02f5ae4d49f84b3045885c988c853b860cdee45319591abd59369ec378b1128354d300e099bad96cf958479e32a739d64fd3b340b69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5203444118e8dd75d75efbae5bb665bd4
SHA117641afd5fdb03d66c8c518742083dac20ae3553
SHA256ed4471634d895d3da4b3e8cb86ed6f79018b1e94497dfba345403f8a6af42d7f
SHA5122c79087b4bd9cbc75088696fb096b16d53d573b3e6f703ab99bef2100e201bbec5b7b2c9649b878f4d5d31635bb1b8e8ce4ac9454069893a0d7d912f17e31063
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5307cc4fa88e3a2eeb75358ddce736bdd
SHA1bf4192375ec448d99f24834db07a8eeb139119f0
SHA25627b9f0f6d1ad04e387aa8336f0257216acdd5fd086db16ab9777226f57ea4771
SHA512a0e671d97c3c0c098f07097aed83c55e8eaaffceca1dfdf65713fe646ed65caa45fb78d27a51cc4ef964815cd2559181d219736c671e7c9dc426751fe1b509eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f55d593adab153614a1bfcf5f1c18025
SHA1b496e85672384d536d78670e7d5874ad1ce6b727
SHA256296c620710af782a13726f99b7af7287fbd606792505d58387e656aa3c8fc892
SHA512b565251143c1dfe0a351826ce2b25460a5e8084b306b5f987e5f2a9aeaee531228fb6a762520feca7e68428543ea367bda378d173cb350ce96c4f08af873f049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1b6f7d96418ec50a79eb957e6af96ac
SHA192b1b0b033ac3803dfc7891f5cc55700327bc1d2
SHA2565917b7f666374d64b63a729b794d215e33bb549ad5d1a9082049a88771b80e28
SHA512b11aa15945ea8ed0ec52479b2343a5b5da6d3dbfb5794e168f437a1574568595dd9c037a0a62720fe1bdf085588cc2fa0e782028581017a2e45060430164c8e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c79fbfb1d8d6cc45bf70d31d57c2778
SHA1898c3b72de553255d2a90bf056338113a0987552
SHA2566fcfc1cdcb1d3318b72061e0187e70f9e199a561040b25ba206f1836a2d6b571
SHA512a87aa34728bbafe975a44def66d7bcfbc4c3f78e64fda50e9932324f83fdd884734200c49ec347e7dff62eff1a0431933f243625c54aa8c96cae89017c7ff308
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546abe3e383ef473af5dc110f61451d4b
SHA1397404f17185b482232b096ae6be27b5501511b9
SHA256a6b08dec11be1aba78ff79eab9a80f1469009e6ccd2c292328100a6934c33000
SHA512a635ca58626f8f5cb7765288977fa9aa82453e882e75410358aba3146f505d6ac557e787f4843d80ba18abb0cc5cd35ae236616c719ed95d346fd984358ad051
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53692c9f409c81b9d1cf504ba2b7d722f
SHA168459ec28a2dd576b412c9cd50d7b5a9d886e60c
SHA256f6a709bd531b139e10851c14aa9a1da04b4bb29e0bd53e3e39f32ef67e96d1e9
SHA51278dded00709c8bca7f9102611b9311cd59a9a007a85b800e1ba1c9ced14b9ba41752ad013d048ad9ef050ac5e549a04988f98b0d274d3c7c5c67f2acb04700b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cf5e40ee4ded5aa2fe2f7c50e744459
SHA19c8590343beb6d948a5c6bfbdc1e18bc5f722428
SHA256c8ba32d25648d1fd171518ed8999e1e037853f5362df514b01c82211f17b8221
SHA51265396bbdd3561baf112c5173e095b42f7b0ec516046f9baf57c2ee59747e00199aac21d58f7364f012fbceeb08e7afa8b04629a02125924583c17bc07d9574d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee034901782be801743fdfbbfd6c2ebf
SHA1b00e49171ca95e3b076b8df01a12b59d110b33f2
SHA256aa751496a034c3c3582f4b9a7c77938a85b38f9be0f96dd164d3ba1f0ddc40b0
SHA512088ab8c1c7fc47daee61f94c62d6e7a0a930e89b35e3dd1cc785e97a5daadcba08322fcae5e623f21e69849269bbdb8c44ff33909815cce8bbf5ab7d8b1fcd21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dbdbc4fb164aa952c004884a6d05212
SHA10301a2d5238952c367681adaca2ae029d0f0a5a1
SHA256a8afdce846b004425a6aa20c4df7b893e327fce8bb09373bf46940b27a5dc125
SHA512d204f1136ac512e5986b0ab06bc1335762fd83a99e58b098434cf41f6a940aa070200080f289815f5684fce3f98a7685d528d4d84c4b5134ccf499eb68b4d808
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538810ed3379ee77cbe6845d4a0697be0
SHA14a8c12eaf004fcb8a3ec27ee4ce66c975704505b
SHA25685cadedc56f671ac22f65425f36e0577082f20816be110291270a6d7940f4e73
SHA512139810d75e4b715150ebf44a9eab5ba4c22a9b9d28e6227cf207a55af1b69fd0b8f1e4698f288705364bf5f972cfecffe213dfb110d79c54cda65ba342c478b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51362de5e5c46b29c8bd3d61ec369ff4e
SHA1b378f652e90a79c7a8e7a9268def298e9edbe3a8
SHA256314933884af356dee52dd2fe6d5ad508b141a3e88346dfe6b29f595e93e92fdd
SHA5124f8d99d1cae55e59ef8e469160db03f89eacc99e0d496193bdd9abf758babf2ddc7112c0ace7dd205b7aaa64f7e17fba138ef24c853e5e411f8a35d3745ee607
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fc2993923ddf98641a6ba1247f2a4c0
SHA11a9b4c7b5288e4ffb49001a1516d4518f3ee1981
SHA2568f315850136aefba8a0bb35c656e907eab38d5bac98a715d3a0884a2cfa16761
SHA512a61cd7b49da9ea9a78c8d0219d9b29c5988fb6564086cfbd255396c8b19779e50ac73917bcc0a0d53f712f43ad1c4d148d3095311e7090866ce4df6edd122eea
-
Filesize
1KB
MD55fdd84abdc7833475907fdc4361336d2
SHA14715d47ce1824e8a2a9ff524ccb5f0960e4a442b
SHA25666a02f95fb457b2c45a62f2fd2083eb2536ef04487a28017f9d5556a601bbd35
SHA5122748d0c1f123ba2bc9b4a3a8484610fa237831e37086fb82110a0b61ec66d3bc47074d05cf4fb08b5fe483cfa3d28ea9f3e4bae6497f49f7fa20a154f29528d5
-
Filesize
1KB
MD5dcd465d69e9bc0290caf07bab558a78e
SHA1321f132493a4650328050f3269f00fb7793551f9
SHA256f7ba29aeab66e013f2b9a8b0a1a61fdd46e48bacf62cb9e1f7bf8c57dd0863e7
SHA5129ae4189ad61d21b6bdc6e55fec2fecf367c3b4a2ae27046cff17d993c4c69c522a23a0d425dd05d0a30a93e4bd2cc8029b1a2f30fbde6d11f8b0756285d90297
-
Filesize
1KB
MD5dc922408f02788b4e3a7cc1d3c34f6d2
SHA11e07a3ec9de22aabe5eff9d9840e1e90299bcc70
SHA25640514c76f58ddbdc20de77c8ad9faf34b17948b3105f6a7ce8afb842dfd8d3c0
SHA512fbe1379a816e94216aa88f6f2d7ca13286a929dc5b975c2e90c406da1346e5f3d7c4ea90794d9101237fea972b94086a048c348a60cb9622b3628551d2e6d0a0
-
Filesize
112B
MD5105ef0e3860a62d96451dda65cef297c
SHA1ac2eeccf489333bd810580165ae94974e668204b
SHA256436d0ded8c6877ab243d78480432a345648e88f09d9fbc0c7ed06f4cba1e1ac3
SHA512dac057888d6546f425066786024ed27f927dcd3764b2322f5eaa3418e87a20081aa2ffd14d40fda81252cdcea816684bfbcbae8440345543f394212cb2ef8947
-
Filesize
130B
MD58185c67ec0ecd01e984a6ca0cd583a57
SHA16dcf65464bd4d7b9378494e18d1827ec060121c3
SHA256d2bf1438877f8eb8d29b08f0b1630f96025efcd60efcc183a9a91685854f0ce9
SHA512870e60d06f0a43edce16d50944cf8dd762164748fac8b62daf9ce832608b6c23d89e7dc3be8cb8c74deb5988991b4b1cf6694bc47f8fef941e8fec03d218a8af
-
Filesize
344B
MD528726ccd19444143b2f2022e4f2ce2a6
SHA15151ab14d71086bf61fdad74c6b7ca66777002d7
SHA256c1cbe5d6d593290169dce1ecc668371b6e55fdf264ac9383b46131acc6e7a0a4
SHA512ebb1cbf393c0d7eaea6788be4e77d3b0dcdc2c128b8cec962e4df02ca1e078273ecdef66cc495080ef0de0a534d223b6576f05a9a9108a1e0eb5a7af83f16f34
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
258KB
MD5a170129c54dc03a8c08aeb62658ea160
SHA1294578290c921aeebdb890a42f539dde1503c08a
SHA25624f743c6291c4d5be1aeb7875b1bfe7817cbf0dc06a6217f7ca4b0acee0d32b9
SHA51265b4463ce07cced7371a73b869846a7f40256e0775bfa761f84a14c38c39ff18b6eb0db0e7e3529b513a3c88cbd57e8de877fcac1c761e978bd5ed1ad520f7ae
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
20KB
MD5f6d87bc59e8ea649608e5f3498d55156
SHA15f9d66f88018f5292dcafd16c1fba8174995b32d
SHA256a3b393e8a08ceb03bbf7662baf586978bba74e38188bdacc169fcf5a65197c1d
SHA5123ecd1aebee4006e46a451e08aafa219b823561b49ec3f82d00ad5fa25e3771e0634cf8b6cfae730ca7114000b5aed79f41b332d933522627693a6f2004d2dd68
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1163522206-1469769407-485553996-1000\e9ac7873c0e427a06f7c758cb6b7941e_9d81b961-0275-4281-8321-63119951606b
Filesize1KB
MD50de609e18ebf13a05edcc02fb4248f99
SHA15887b1936a6adb47ba0be7a4cf546e26822320ec
SHA256effdf956bfb174b8a7994cdf65d8ea698c2449df6d8da56150ea11688d2a6c57
SHA512066be2f018d37e673f7224cdaa5bb1149482afcd4b82704c07cef9e1beeababdc0e87aaed133d7a6c3179b18413059eac20be30722b2c1f9a65d7ea8610f37d6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1163522206-1469769407-485553996-1000\e9ac7873c0e427a06f7c758cb6b7941e_9d81b961-0275-4281-8321-63119951606b
Filesize1KB
MD53474af024a4ed8e8611e30b4956b0d44
SHA137ff0b6cda2201514eeac2d6c9ab5d8010789aaa
SHA256f30768a5cc9108613f1368f6524d46d81b75cc7e16c30bbb5855d45706b7b2a4
SHA512937c4cb0aacb6cdf220c2a86350b18d7ef1ea8e103684afc15d9f5933e420f705379c2179705b5c893f83062f4d4e7e393711c7ed1ec3deb792441fdfd14d14a
-
Filesize
3.8MB
MD581563542328696fd6679e2d799e86787
SHA13b5ef427d9c41e4234edad86e0aa66385b6fcb4b
SHA2561b52275d2f677a6f49ee7098ab04f635559dea8c37de0e024742e6119c46cbad
SHA5123e39f3847d22accbb5d626eaba988ef45069a9e706e378ea4b86cea515dad165ef0d2d704699efd2d3b3342284771b3ad198b6a186803e35ac5bf5f0ac6b344b
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.NSIS.Xamyh.kxk-64fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d.exe
Filesize125KB
MD50d3d0f893df336e1bc396e4a2e5d24a0
SHA18902b36cbfdda493b9b7e6b59947b722a1daef29
SHA25664fbaa750a20ae7cc12cb21e6e409e4d267068417925494fca7405d1cef5e65d
SHA512e13d69329435512032a7197fdc04dbd25d2f2cde46183e3e9527724e50fbcc1e275c5350835b8f2a3a00b9f28c80adfc0f4c59bdefc9ce0cea8da0282792e0b9
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Blocker.hrft-83dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760.exe
Filesize1.1MB
MD51b41019a6059d594116e633f3ac61d16
SHA17b25cfb5f2e126267c9efc1dc0fa98ebb222a58a
SHA25683dd335bbc978eb05c4933fa3ea1301740c9d7754068b3de8facf58442171760
SHA5128646ddd55ff8528dc86aa5443bf2a0b18ea97ecdc98231767149332ec125a8c414d4e50621e15319596fe2facb42c82c2a0dba1527a782aa688cc609707cfa76
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Cryptor.gw-b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f.exe
Filesize213KB
MD51e508f04171bba110871927312483445
SHA131e09a03960ec04daa448005d77631009dc01bf0
SHA256b1cb04416c7391d98166ff259bc3a33dbfe0a4e526466b5d30f54b6b78a5c22f
SHA512532aebd93ffa37afbfe62de1c9b6c0e81777519711780036d2f0cac088c6ee1fb9e44c321cdbb2d15fc6e1df01a38a0b9fb4889c46ec7f9c933d37d637cdbfca
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Foreign.njoy-703f9eae4f2b62cc0ca7a2d0a8f34da2853121b232e5a0e220ff72f13f5ad303.exe
Filesize352KB
MD56245a3be8da6a04c694b5d1f81d08b69
SHA1a7d2d70679a5c2d70e24d84905c8c94f95520800
SHA256703f9eae4f2b62cc0ca7a2d0a8f34da2853121b232e5a0e220ff72f13f5ad303
SHA512f9f583d4869ee4c228b8b0fb62a8b508501e845f9bb9e3fa0a2631ea9d3a3931f426740597634875746fb5a2747bd527a07195c7ae572cef62b2913ad9dea1e7
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.GenericCryptor.jnu-2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78.exe
Filesize255KB
MD5ed441acec18afa29fe57d4b9e66ba126
SHA1ee063b1146b855dc5f276228918fe0dee35c15cc
SHA2562175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78
SHA5129c64de1d74eebc52ccde7d0cd40dc3d40c15d3c25f0852ef4959b9a42022eaab80ae91d2922cd37be80af6407889f8bb5fcab6042f7378469d4c0fa7f32bf391
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Locky.aeqw-df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df.exe
Filesize228KB
MD51e9bc539837b404ad18c1f1d86d78a10
SHA10ed44f66164597face22bb7ae7866a916a6c96ac
SHA256df0072204b63b2eed626d88921a20e8bf9702b638e36971a279b8959f890a5df
SHA512ce2f6e93c5739d687424d4bad2ee136b59e2c6b95d45eded90e0af4c4e7d763a6c89243e4fc9283d2319362b988a14ac1e9c1f9e7b621bd10c36c14ee18a60b7
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Locky.xey-06ba734b49a3da926c18f3434173981b012a9ecd41f1e45196140b6d41360da7.exe
Filesize383KB
MD533dfbc8708ab573b38653420aefdc95f
SHA12e82415d603c1cbbd317ba945b006ed4c4523de6
SHA25606ba734b49a3da926c18f3434173981b012a9ecd41f1e45196140b6d41360da7
SHA512c426825a80ff89ff41aab904436036db27e571cf74d3f541d575a3025a15031e21ae3ca6d6ba9a46aaf91abeea77711a376caebd9f21a8e06ac1d391e4bdb7f0
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Locky.xfq-7e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5.exe
Filesize434KB
MD5a1313f88249614877f772764501c2faa
SHA1375f214c676e90aa83e8c13426fc96b6d45f3ee8
SHA2567e3cffc3e1b735a1ed22fda7204fdefcab0a717be43864cc395cf77f34360cd5
SHA5121f4e15f5a146201db59dff72c836d067ba0d5ace270cbdf318508426beb56b36e41e2a34af7d7898deef29427d02e853ca95b3911d206c5188117cd2cf8b40a3
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Shade.lnm-7d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e.exe
Filesize900KB
MD5f18f2e6a984a8a7e8e787f4f052c8bd9
SHA172dc0821b7f510a55d8010a22161e21bbac92c96
SHA2567d9380055fea5e6c7901b2ce9f1b13de67cddaa2c2823fd08ecde6d37d4f245e
SHA512858a4b745ae39b07f68c0d6877c45c6b710338cf67c96e2ee989906d548490640b9eb77878127a68b6d45fb8384abea8fe82b65a506d1f93c48266e351a38bed
-
C:\Users\Admin\Desktop\00278\Trojan-Ransom.Win32.Zerber.fdxn-3db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09.exe
Filesize243KB
MD5fe53909ad081f74af4a11c0ef0ba1222
SHA1cfd8e95f01f82fb8301e4a006c6c23ab25836281
SHA2563db0ccba8fb83e1f5b4511b4d5e40efb55ba2ddca785bc7a5f186c5224e8df09
SHA512f707e284bec9b465f7ce7dc2ccf50e427f16eb42021924a5278422707eae2c1537e5f0171b0d280617e803c4bb05b4a93a56054434700ff74ae4c03b95da054c
-
Filesize
74KB
MD57491944d7a944375217823b026cc01fa
SHA13d6a0055e081705c138139da11a638e02e36c724
SHA2566fddcc78d5e23220e52326098b9ffd4dfc5dbfddca659d668ea37dc3d6b768d0
SHA512f36bc2ac5147d944a253d173324e0d2f3ff51efe747e72b757405a2953c265b6a19448a5810ec473697ac5fc0687a8adc790648d8f107ffe0a67148caf1b1534
-
Filesize
150KB
MD5ab3c95f6ad44f783b2f7981f948a8203
SHA1885eeb67c66de4eeb7c431ab2ce8cb7935c47cc6
SHA2562e5bebab9d8451381f5b6d270ae4d8b0dc800c689e5d62b1fc3caf384fd5ae91
SHA5124d4222e8f1cd0e5077dfd5db31ac35e1ede9759901cd507f24fcde5aa56cc17835fcd73e47cb66b2f9a6b4cadc4afb6c61fef66ded63e3600f9dc03accab9c2b
-
Filesize
151KB
MD5882382ece5df50dabedd18cf2eeef054
SHA14acdf2f54151ca295bf16c84030275bcf4747052
SHA256b23e02c283b01fd32a999c0ccc53eeb686f20c4815f230e373b6a6c5d4f572ed
SHA5125f1d5ed47fe830b9ec775d6843ac58237640c9147e340f9e54de4cc326c45e54bbf05192cc2c62cf343d1399143284604caf9d3d02be5c23bea7859dc5bfa8e6
-
Filesize
151KB
MD53a5faa4d0c36935cffa22a7acb51f33f
SHA1bee380607ee3d9a2d5496d1b6bc8ca25bcbf01c6
SHA256b3e3e017d4ab09eb9c9ba5c5c8a854df1f554a2269f70e8d926ed5809f10ecb2
SHA5126195e567e8fcb258f78f60ff48a6a306dacf73260f3245da5d6618d8b23b2ef4165bcdda7dd57ecb1a3951b6ac425c24b024c96cd7765dbc337ca2118e879671
-
Filesize
151KB
MD5644f2488fd31c6e43bcddae93cc184b9
SHA16c20adadf115631a857636f5aa4433386a3cc571
SHA256fb959fea730bb95a370083097893850b1390ade435f32f0d9b17ae18017625b2
SHA512a6f91d53fce85e793a21afc7d7c70c9a686d999c39925b0818edae6f45ac8e7de643530a0304a274d762e57ef1c474112904a44f0e7f9ad4325d3db1e2273633
-
Filesize
863KB
MD54b52746c51f5f0e1e75f8e58f58b9b81
SHA1b6925f19ec3f544c4997f568e47132833184168e
SHA2568e0172dcfa9da2ae056a197a94bb20ca2759b872f10e5ba438ffa05a02cf0f9b
SHA5126da3d9469f8d0c1735d0e65cd648e975d16685161efc10ca98314d1faba8c1dab945e6d589ff7a1b32064a57a7635dcf59887bb6c4e81fb0206b971de92fe9d4
-
Filesize
64KB
MD5404cc3b4c6225405d6e2e0b1ceaea1af
SHA1db12c06c8166f742232e1213310902f785430750
SHA256092addd70106ce015d27c665b2a9bc445ef2c5ab43c5c595e3c2f49e9f70be10
SHA51226d4950d353b54a84edc42efcf77e5db866837ce64f6803c6d6a2ca078f284955d23db97847eb91ea994329a7fa3b37977766001426526afe42c83aa698a78ca
-
Filesize
84KB
MD5e156b330371d62e2820b2613ca5c05ff
SHA1b91d5b78944428c1f3e9ea47cb94708a602752fe
SHA25628d518d8ff4e62b02b31d605f7285d57d9ffae62d49141278f9b8cb9c373adbc
SHA51284f7d48ca9e8794750edd07fe70d55e90d5261a56ecd2b75c27f7df4b7dd0d24aad94ccf4db5d8d205dcea3b00900f6eb4f53c97ff48201eda477b810954e631
-
Filesize
11KB
MD53e6bf00b3ac976122f982ae2aadb1c51
SHA1caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
SHA2564ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
SHA5121286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706