Resubmissions
13/01/2025, 11:23
250113-ng6tqasnek113/01/2025, 02:09
250113-clc7estjhl813/01/2025, 01:54
250113-cbwwsazmgt10Analysis
- max time kernel
572s - max time network
648s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20241211-en - resource tags
- submitted
13/01/2025, 01:54
Errors
Reason
Machine shutdown
General
- Target 5secshuffle.py
- Size 6KB
- Sample250113-cbwwsazmgt
- SHA256 c29bc7ab31b2c17e5b4ba1734abcfdff97fd1e5ecf078f6d42eb0a083f3cfc6e
Score
10/10
Malware Config
Extracted
Path
-
C:\$Recycle.Bin\S-1-5-21-3506525125-3566313221-3651816328-1000\FHBYN-MANUAL.txt
-
gandcrab
Ransom Note
- ---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .FHBYN The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/874bd514a789dae0 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAJz1oKKyc7WiBoWtmJRkyFis7HFZTFgU8fzTY7Il2nCM3SmHR4HErFlVp59NrRwm+OyIcDsxd8zT6tHOvSiEo3CzrYVjJ3/av8UNyGGgfpZuVBOFq6YBzN7phOvWeO67sAcglVmIyPACycs/rD/Bv+c9UhT9i7SWqZowtfQvOO8QCAYqFJkTr8kMLf5JY0c7OwuUvqy7g97hr37ExdfizeTYndJQveXc02Tmk0EdTfq5IF2LHpudZuNaIbdKiAjpYdgpPesN9+Ki1jUqKuEwZJqn26JrFEGpXBe1nFwr4eZWRGmR5DxSRF6thmMfYeSWwxNDNs2bC1fycjxb/CTubnbp6+uuNvpO0EvQeM12w4gjW61ZYAnFxY0Gk7MH0bPb3ZWUPIyBDJI/9RNSm94JgxZtRAXcn9kstzqAeYwLP6Xl4+5ugX9olfJXsahSD0WxmDSHHPT2NJtAXWlxHOXqSbT9KXy/5nkM8z8og+656Em6vhcWeQy5LbzzN/7yVQAj+kiyl5ow7WyztCtQ0zaZUn+Fn9NTsQiHQ067IgVeOwbmyIaTauB1Hg+04XSt/6CTDGl7h9mXoUaz4/fH4AQS3okPPdn/JFJzBm7nJYLIyGC/uv6AJN/Pw7jR+5oQQlWlJDe7WeA7VA+L5dZouIan7AX/KZQq8Gu/lVbFnnib9boStyVYxozraaebZWfRwleZZ1WyX7z36nR7NvYfmgBqlWnYO720l/o9Q1N3NgeBCfHcxpoVWDq0gzHsDQmONVJiBI3N42AyKPyQJg/8YuFDEtG8qk/8DB95sG8eZRX5I4eSRfJGHTunG5gAqwzZhdVX13pgDcNvPz2XScqnZfYdnMgpWY+zB+oYeaTdNnnDQSnhx3gP1l4h75yPa8hkw5dvL14pSy6PF5c4CspL93OsbXeJOGmEkM8e/e3XGp6t2x3Q8npulotiTe0/B3Iy57EfBOa8OMJkqzEvNjKkuDl0yjfh8wSXdOsEy/87JuaiZnJaguRZ1Ul6llJSm/i053+Cm+1A0xn50fqzeLSZkqzEkUx74xnj+a86+H8PTLF2gbmVprfHiwTx+QkzMt2G+3OZKdybyPdYEalxh6aM+Z4hdy0zTk8rYC+cBDnvFLJQSl5lIjsVs7DcpT6/qrIb6n0eZmv8NkBiI/wnMcYsVPBrD9yOfkoLTJWaZAxR1ovYRqQeGV84XfUyr3f58xNTl7hgmhHnoiqFUTCiT4VI3aTcRVPYf+9UgGUCILLDhLFcgCsadBYjuOeHTXCW4eGRvb8zL7+jNOwpHeSZnA4Cz3HkNLSL7zizvDhYrdCuEpux3pzPBceTj5Oh0TczjnVteaWQPQorkplCyymFYdl1fat4vL5yRq8vxJ4L+y27Hfw390TqCS+CgruTcwLY05dkl3dhRK9xl5aCvJhJxsHp13FlF/KPpAiePRpaqZlkG/Agrd4ZUxC+YP8b3s1bwPC1MQAiqgu77yY0AligUUS8w+Ba8jhyEDkBXwYWBVMiVXwoYcm6E0veYqlWGUhXtPXskRsium7IvldG6wavFhX3aXUW4/9y3p48aAbjWae77xWZq82wcvytr2WBMyxwlhsxZYAg5ZZJNja9mJgXmJgA+17oMYbruLhRQzuKaZtsEDPH1e34lCCyrTVcnXbq5ga+qu8TYvXvnAsFthdna30Khk+hBYsnaeLTxrjM7K2QElPWrHIdNNPwUkRWf1VZBboIRwxga7ylamEo8xTIxSMGjBDUfTsduPuv9grdMvhDVYqc7lZbWHCPJjaqUGe3POIhcOSjATOmfI18ggKZLUolJ03P/NvkhbohPED9fQjBUxg6prGjmpFOfCKfduWCNcGEoY59AOHzNT+XV7bXzZRgX/17PxxarsQ9lf9UcglcRf1I4iZIR4q8+569/Xd6plT37boiHw25NcNZXKiP6PIXjb5joeuJd1zCnwu6hKNF2hj+we1A0yyrMDkzBnk+481tFA+/pVQvFSdTFkkymkeuaU4vV5cFJn6t8NgDREoPdXPgSwPeM5Wh8HO64fmlHMomFkr3nk0BPH1/VkWU3jEONPoTrDqfI+FGFcY9t6IjfJV+nHiuMGwTzrknOV0zORpFXpKeOjRXiFzKIEfVZIj3uEHP3ggSnbSX86vPPLeUT3noAh5jtfQkzTLmQmo1m7SkFs8sixsnrOaMf6WceTam02SAFgxshnggcG9BwdowljXthl6p3wbnpsXcCVvHLpMPZjGsICRTCCI= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDy9NbJLZDAAveVruDJRWnIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemWoy1rWnPOZxV8SSVjOsTAmmL/7s4CzGBkpOKj7RToVZfeU0wFSACDBtKyJP9BcBnpq7cZhR723XrGVmYCRgUeIP97y+PM3LODjXKPjrwxW5OZ7T0jJ1vbhL2d07fePSySz26B+oWfFo533PDqxlSg7ubDoQVp+6k2VyOmsqBtvY7wKrt0yoC8O1fylWzmQ7ql4Gew6gTqwNUzab5MfvdxRLWCjoLjSwF/i8jPDKIqgjY3pWN3+hglhvFqi4oFZEvhEsSM+AN7hzdQWIEz1U0GTyeyMcZ0O1go/+eQSe20E23SaCuLrfdcRPB6VJMorLqwb8AmOcGyVvrCSEaKsTrSHnIyaYEIrb5s07lHfcy/ShKIdDA3FyYH6qAJw1UbUxI7G7XVYm+fKMPMuEsCdCZihzgpfE7oT7wA2q18= ---END PC DATA---
URLs
-
http://gandcrabmfe6mnef.onion/874bd514a789dae0
Extracted
Path
-
C:\g1rFryAhrVg2xrt\DECRYPT_YOUR_FILES.HTML
Ransom Note
- <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>IbhGsQyooCJrMW7nFRLe3DNbNofLyKNAoYncJkRZSFaNNwIJAJOLT1UKu0gGohgFvCFeV9iRPJ/J3AUbU1K3j6g2YQGiL/8A9CSHPjiunVGxPm+ra/YJ9E/zz4o2yuoNdENmrd3qiPAGKj7fbYPGAp5gO4yWak+EboXDSoD2EC/cXWxswa5VmE5JuBQJgjoxdI+yLxokOVMJ8gYF6y+IQ0kUKarH3m63mulMQCUXjsnZZ6VaYNC9Z3kLCoeMS+R+Ev2+CVjgdHYp2A7XKNIWECHQFYzYZ/v1GFuxVPPpiqnMWPpfUWhyPLIZfvrvooQZVnVQrjfeKDXhvtQpdxSUMg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>
Signatures
- BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
- Badrabbit family
- CryptoLocker
Ransomware family with multiple variants.
- Cryptolocker family
- Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
- Gandcrab family
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Mimikatz family
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (449) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
- Contacts a large (1157) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Disables RegEdit via registry modification 2 IoCs
- Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Sets service image path in registry 2 TTPs 9 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 5 IoCs
- Executes dropped EXE 23 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 21 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 6 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon 2 TTPs 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 37 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
- Interacts with shadow copies 3 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 1 IoCs
- Modifies Control Panel 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies Internet Explorer start page 1 TTPs 2 IoCs
- Modifies registry class 4 IoCs
- NTFS ADS 1 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: LoadsDriver 32 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 61 IoCs
- Suspicious use of FindShellTrayWindow 30 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of SetWindowsHookEx 47 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 37 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\5secshuffle.py1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\AppData\Local\Temp\5secshuffle.py"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT4⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 23883⤵
- Program crash
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4828 -ip 48281⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1916 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a53fa2b0-770b-4a25-9203-31724bc74dac} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2360 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3be52caf-acf7-4949-b4dd-2e0b245efb87} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 1 -isForBrowser -prefsHandle 3012 -prefMapHandle 3008 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01fa2700-6de5-433a-9a32-901ec9f87956} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4072 -childID 2 -isForBrowser -prefsHandle 4232 -prefMapHandle 4228 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d7102b5-9cd4-4595-b62a-78ae05acdb95} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 4576 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08d20945-726f-4a9a-a0dd-0ac65b74da72} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 3 -isForBrowser -prefsHandle 5388 -prefMapHandle 5384 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa9e34ee-c1c2-463c-8cf2-9c368808323b} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 4 -isForBrowser -prefsHandle 5612 -prefMapHandle 5608 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bd8c5a8-fc3d-435e-ad28-52e6adccf46c} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5656 -childID 5 -isForBrowser -prefsHandle 5728 -prefMapHandle 5732 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e8958f1-11b3-4aa9-bb25-b21c93e560f0} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2640 -childID 6 -isForBrowser -prefsHandle 2752 -prefMapHandle 2748 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48093e1a-fc1a-4368-94a9-e8272a919120} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6124 -parentBuildID 20240401114208 -prefsHandle 6344 -prefMapHandle 6348 -prefsLen 32460 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6b53b80-053d-4fd8-b9f6-10871be8cbcd} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6332 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6356 -prefMapHandle 6224 -prefsLen 32460 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad6c7091-747d-4708-986c-a42872d5f97c} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7040 -childID 7 -isForBrowser -prefsHandle 7132 -prefMapHandle 1552 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b70379e3-fdd4-41ed-a41e-cf8dac82d523} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5620 -childID 8 -isForBrowser -prefsHandle 7640 -prefMapHandle 7628 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43a0d7ce-fc25-4f72-88d4-42b617bbd2b2} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2688 -childID 9 -isForBrowser -prefsHandle 6212 -prefMapHandle 6208 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a160e85-a3e3-431b-a425-7e4a3c14c86a} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7912 -childID 10 -isForBrowser -prefsHandle 7904 -prefMapHandle 7748 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2778d8a-df9d-4d9b-bcab-d0788878e23e} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6208 -childID 11 -isForBrowser -prefsHandle 4196 -prefMapHandle 6112 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20208247-678f-4a49-9f66-4e755ec4cb49} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7460 -childID 12 -isForBrowser -prefsHandle 8112 -prefMapHandle 7532 -prefsLen 28288 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50edf675-af85-4b7f-983b-c962eda23ef5} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4504 -childID 13 -isForBrowser -prefsHandle 7944 -prefMapHandle 7940 -prefsLen 28384 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1be694c9-2406-4e54-9f04-174823d98711} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2764 -childID 14 -isForBrowser -prefsHandle 1876 -prefMapHandle 8312 -prefsLen 28384 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c2bc38c-9611-4f3b-9ac1-e6a933643aeb} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7520 -childID 15 -isForBrowser -prefsHandle 6160 -prefMapHandle 7648 -prefsLen 28384 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21120c83-8966-45a8-bf5f-29a11ba3991d} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" tab3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x2ec1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\" -spe -an -ai#7zMap9267:108:7zEvent148821⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\run.bat" "1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\$uckyLocker.exe"$uckyLocker.exe"2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\7ev3n.exe"7ev3n.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\system.exe"C:\Users\Admin\AppData\Local\system.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\SCHTASKS.exeC:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:644⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:645⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:644⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:645⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:644⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:645⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:644⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:645⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:644⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:645⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:644⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:645⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:644⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:645⤵
-
-
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Annabelle.exe"Annabelle.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\NetSh.exeNetSh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -r -t 00 -f3⤵
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\BadRabbit.exe"BadRabbit.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 153⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3424727799 && exit"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3424727799 && exit"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 02:22:004⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 02:22:005⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\5D57.tmp"C:\Windows\5D57.tmp" \\.\pipe\{06C212C4-050C-4690-BDD6-788AE5A23DF2}4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Birele.exe"Birele.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Cerber5.exe"Cerber5.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset3⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe"CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"CryptoLocker.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000002404⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\CryptoWall.exe"CryptoWall.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"3⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\DeriaLock.exe"DeriaLock.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Dharma.exe"Dharma.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe"3⤵
- Sets service image path in registry
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\Shadow.bat" "3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\systembackup.bat" "3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="4⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value5⤵
-
-
C:\Windows\SysWOW64\find.exeFind "="5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"5⤵
-
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Fantom.exe"Fantom.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"3⤵
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\GandCrab.exe"GandCrab.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet3⤵
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\InfinityCrypt.exe"InfinityCrypt.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\Ransomware\Krotten.exe"Krotten.exe"2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa395a055 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
2Disable or Modify System Firewall
1Safe Mode Boot
1Indicator Removal
2File Deletion
2Modify Registry
8Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
FHBYN-MANUAL.txt
icudtl.dat.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604
MakeAccessible.api.id-A789DAE0.[[email protected]].ncov.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604
DisplayLanguageNames.en_US_POSIX.txt.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604
DECRYPT_YOUR_FILES.HTML.55CBE07C7ABF01B92E09E4DBFEE390B5C6951646794485216AA197D51211A604
appvcleaner.exe.id-A789DAE0.[[email protected]].ncov
000003.log
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
WMSDKNS.DTD
WMSDKNS.XML
WMSDKNS.XML.bak
065FD4D4C15DB827BFFCDB379EE8F3C3ECFDBD3E
DFAF798699EE7D2494A7287D4CF123272A2A18BD
E47F6185E9AB287A92322D97719E3C4ED03B8D89
E7F7A560FAB7054050F81D89B8B3096A4AEE843E
F0EAF5000FD9C2A30FD2826A9F349C1386795C38
WindowsUpdate.exe
tmpaddon
tmpaddon-1
wmsetup.log
system.exe
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
8a47d585.exe
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
SiteSecurityServiceState.bin
broadcast-listeners.json
store.json.mozlz4
data.safe.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
pageload
4e1404e4-1626-4b29-aa3f-789655f6a457
763a1158-fd3b-45e8-9bbd-102710044513
enumerate_devices.txt
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
sessionCheckpoints.json.tmp
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
3870112724rsegmnoittet-es.sqlite
{34184A33-0407-212E-3320-09040709E2C2}.exe
$uckyLocker.exe
7ev3n.exe
Annabelle.exe
BadRabbit.exe
Birele.exe
Cerber5.exe
CoronaVirus.exe
DeriaLock.exe
Dharma.exe
Fantom.exe
GandCrab.exe
InfinityCrypt.exe
Krotten.exe
Locky.AZ.exe
LogDelete.exe
SearchHost.exe
Shadow.bat
mssql.exe
mssql2.exe
nc123.exe
systembackup.bat
vyolxvrdidqtfuc.sys
run.bat
run.bat
FILES ENCRYPTED.txt
5D57.tmp
infpub.dat
DECRYPT_YOUR_FILES.HTML
memory/1584-2085-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2093-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2087-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2051-0x00000000023C0000-0x00000000023F2000-memory.dmp
memory/1584-2083-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2081-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2079-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2077-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2075-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2073-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2072-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2069-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2067-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2066-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2063-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2061-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2059-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2057-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2055-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2054-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2091-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2089-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2096-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2097-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2053-0x0000000004940000-0x0000000004972000-memory.dmp
memory/1584-2113-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2112-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2099-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2101-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2107-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-32435-0x00000000053F0000-0x00000000053FE000-memory.dmp
memory/1584-2109-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2105-0x0000000004940000-0x000000000496B000-memory.dmp
memory/1584-2103-0x0000000004940000-0x000000000496B000-memory.dmp
memory/3464-2052-0x0000000000700000-0x000000000073C000-memory.dmp
memory/4492-2032-0x0000000004C90000-0x0000000004C9A000-memory.dmp
memory/4492-1999-0x00000000052C0000-0x0000000005866000-memory.dmp
memory/4492-1998-0x0000000000380000-0x00000000003EE000-memory.dmp
memory/4492-2012-0x0000000004D10000-0x0000000004DA2000-memory.dmp
memory/5164-2015-0x0000000000400000-0x000000000056F000-memory.dmp
memory/5164-39556-0x0000000000400000-0x000000000056F000-memory.dmp
memory/5208-30607-0x0000000000400000-0x0000000000438000-memory.dmp
memory/5208-2016-0x0000000000400000-0x0000000000438000-memory.dmp
memory/5208-2040-0x0000000000400000-0x0000000000438000-memory.dmp
memory/5720-2030-0x00000000005C0000-0x00000000005E5000-memory.dmp
memory/5972-27248-0x0000000000400000-0x0000000000B02000-memory.dmp
memory/6896-2033-0x0000015C30430000-0x0000015C31424000-memory.dmp
memory/6896-22304-0x0000015C4BB50000-0x0000015C4D0DE000-memory.dmp
memory/7004-2178-0x0000000004F80000-0x0000000004FD6000-memory.dmp
memory/7004-2044-0x0000000000430000-0x00000000004B2000-memory.dmp
memory/7004-2046-0x0000000004D40000-0x0000000004DDC000-memory.dmp
memory/17564-32579-0x0000000000370000-0x000000000037C000-memory.dmp