Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 14:21
Behavioral task
behavioral1
Sample
99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe
- Size 669KB
- Sample260812-rpgrcaaj2w
- SHA256 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30
- MD5 6b99ae925a613a56ff3f55e730f0d33c
- SHA1 64b1a0e85bba047fc606bf1aa27e7e6d7378cb90
- SHA512 3bd3c894397818745033411143be5a7c64d97e6e3d01dd5d577c2473a3d35ce0626fc1cb10b73c95c0fd5bff79f0d4fd3857dd434e070bbb7e5687d7d141b2c9
- SSDEEP 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DUKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWBKrKe
- TLSH T1BDE49E1035818132EAB301718EBDA66D517DF9220B2A58DBA3CC656D4F7D9F27E32237
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Path
-
C:\Recovery\WindowsRE\HOW_TO_RECOVER_DATA.html
Ransom Note
- <html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">CBD335727E2C353F2C6564BC74E015D6A96F939234D4386FF91B5C0842C1E96A0CA56E93329616A97C8FBAD30DDF76FD20D99D73ADBA6C154B24658EC110A0A0<br>DB9EB295FCE8F672431D53F2D8F59A3E415733EA63D24C6E22EA37F55A907C2D17988B2CFCD75AE8A9F70BE3F45B39145C1B79A0B745BA5105717A82A11F<br>7262A6FE25C56B69A37B3F501D8608AEEB5C6E84A0DF504B18A98BB6AF8886A1E7A59CA0983DAB137A1842594021927A96EEB86F8BA1030D02DE1686BACC<br>FC75A1CBF9A8946E66A7AF3CF485F731473EC0D87F56F338A498E35BC70257438C0EDEEB1977C1013DC308EF4D250A124CD47A37DA231FB7B55BEED7FF4C<br>267675814B132EA53737ED304A4671ED9EDC57B4A3A2C9CDAD9EA109311F7CFED07B669A5B0C8DC96C9B902F1CEDC8B652291AEF3ACEB2E74629C1751AA3<br>BAA170456C62EC2C7D2CAD1D58E3B51F3078C9F19A9384A00C40F0F43ABE55CF83DC4D3570DB8E8F88AFD90C12D66D393B8AD9E84EE0047D4FF2F4AA4072<br>0F12ACA75A9DA0E9604BB8634969DF6771BEA042E62B1D1DA1002D3C4D80A84435E0A569B49E0AB86C8752AE5C392B460822E47945FF56F2E038D3641F16<br>B81292AAD7E909F3DF86134C3DBB973B1F1F67F798D197295043B8EFAE86A3C4D68724ADAF5DF36D8E58F9C018326BECA35DADE38C68BFBC5F1EC255267F<br>0C6112FD3E61051157C7C9FA5976</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>
Emails
-
href="[email protected]
-
href="[email protected]
Signatures
- Family: MedusaLocker
Ransomware with several variants first seen in September 2019.
- MedusaLocker payload 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001b87d-0.dat family_medusalocker - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe - Renames multiple (224) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 5184 svhost.exe 2148 svhost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened for modification \??\Y:\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\L: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\M: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\P: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\V: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\W: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\D: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\K: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\S: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\T: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\Z: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\Q: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\G: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\J: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\U: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\X: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\A: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\N: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\O: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\R: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\Y: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\F: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\B: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe File opened (read-only) \??\H: 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 4248 wmic.exe 4248 wmic.exe 4248 wmic.exe 4248 wmic.exe 5616 wmic.exe 5616 wmic.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4248 wmic.exe Token: SeSecurityPrivilege 4248 wmic.exe Token: SeTakeOwnershipPrivilege 4248 wmic.exe Token: SeLoadDriverPrivilege 4248 wmic.exe Token: SeSystemProfilePrivilege 4248 wmic.exe Token: SeSystemtimePrivilege 4248 wmic.exe Token: SeProfSingleProcessPrivilege 4248 wmic.exe Token: SeIncBasePriorityPrivilege 4248 wmic.exe Token: SeCreatePagefilePrivilege 4248 wmic.exe Token: SeBackupPrivilege 4248 wmic.exe Token: SeRestorePrivilege 4248 wmic.exe Token: SeShutdownPrivilege 4248 wmic.exe Token: SeDebugPrivilege 4248 wmic.exe Token: SeSystemEnvironmentPrivilege 4248 wmic.exe Token: SeRemoteShutdownPrivilege 4248 wmic.exe Token: SeUndockPrivilege 4248 wmic.exe Token: SeManageVolumePrivilege 4248 wmic.exe Token: 33 4248 wmic.exe Token: 34 4248 wmic.exe Token: 35 4248 wmic.exe Token: 36 4248 wmic.exe Token: SeIncreaseQuotaPrivilege 5616 wmic.exe Token: SeSecurityPrivilege 5616 wmic.exe Token: SeTakeOwnershipPrivilege 5616 wmic.exe Token: SeLoadDriverPrivilege 5616 wmic.exe Token: SeSystemProfilePrivilege 5616 wmic.exe Token: SeSystemtimePrivilege 5616 wmic.exe Token: SeProfSingleProcessPrivilege 5616 wmic.exe Token: SeIncBasePriorityPrivilege 5616 wmic.exe Token: SeCreatePagefilePrivilege 5616 wmic.exe Token: SeBackupPrivilege 5616 wmic.exe Token: SeRestorePrivilege 5616 wmic.exe Token: SeShutdownPrivilege 5616 wmic.exe Token: SeDebugPrivilege 5616 wmic.exe Token: SeSystemEnvironmentPrivilege 5616 wmic.exe Token: SeRemoteShutdownPrivilege 5616 wmic.exe Token: SeUndockPrivilege 5616 wmic.exe Token: SeManageVolumePrivilege 5616 wmic.exe Token: 33 5616 wmic.exe Token: 34 5616 wmic.exe Token: 35 5616 wmic.exe Token: 36 5616 wmic.exe Token: SeIncreaseQuotaPrivilege 2532 wmic.exe Token: SeSecurityPrivilege 2532 wmic.exe Token: SeTakeOwnershipPrivilege 2532 wmic.exe Token: SeLoadDriverPrivilege 2532 wmic.exe Token: SeSystemProfilePrivilege 2532 wmic.exe Token: SeSystemtimePrivilege 2532 wmic.exe Token: SeProfSingleProcessPrivilege 2532 wmic.exe Token: SeIncBasePriorityPrivilege 2532 wmic.exe Token: SeCreatePagefilePrivilege 2532 wmic.exe Token: SeBackupPrivilege 2532 wmic.exe Token: SeRestorePrivilege 2532 wmic.exe Token: SeShutdownPrivilege 2532 wmic.exe Token: SeDebugPrivilege 2532 wmic.exe Token: SeSystemEnvironmentPrivilege 2532 wmic.exe Token: SeRemoteShutdownPrivilege 2532 wmic.exe Token: SeUndockPrivilege 2532 wmic.exe Token: SeManageVolumePrivilege 2532 wmic.exe Token: 33 2532 wmic.exe Token: 34 2532 wmic.exe Token: 35 2532 wmic.exe Token: 36 2532 wmic.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2840 wrote to memory of 4248 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 90 PID 2840 wrote to memory of 5616 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 95 PID 2840 wrote to memory of 2532 2840 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe 97 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe"C:\Users\Admin\AppData\Local\Temp\99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2840 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5616
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5184
-
C:\Users\Admin\AppData\Roaming\svhost.exe"C:\Users\Admin\AppData\Roaming\svhost.exe"1⤵
- Executes dropped EXE
PID:2148
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recovery\WindowsRE\HOW_TO_RECOVER_DATA.html
- Size 4KB
- SHA256 8aa0ead1c2abf54982b638f41335fffa1226c69eb5ecd2f8613014f5916a4951
- MD5 faed01faa8c39ba1ef8f8d144e2bb0da
- SHA1 157d7116ffeb277daad8ee4c3c595a9307473f16
- SHA512 c28d2f55312a1098bd3e450e5e3ff616d32aee3b466e7dfb05255818e6f4147a033a7e0e544ac48fb20936a77e8eb29687c5c6bb018b18565c96a724d408696e
- SSDEEP 96:8y+cAl5azln+DtZog1+AcKX7ciKFe8LDmmRjE:8OAl0z8DjFZZKYQDmJ
- TLSH T1E8A10ADAF7F224D15842A8D5BB643FC21F15810B724AC8183A6D01CD6FBB691E79778C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\svhost.exe
- Size 669KB
- SHA256 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30
- MD5 6b99ae925a613a56ff3f55e730f0d33c
- SHA1 64b1a0e85bba047fc606bf1aa27e7e6d7378cb90
- SHA512 3bd3c894397818745033411143be5a7c64d97e6e3d01dd5d577c2473a3d35ce0626fc1cb10b73c95c0fd5bff79f0d4fd3857dd434e070bbb7e5687d7d141b2c9
- SSDEEP 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DUKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWBKrKe
- TLSH T1BDE49E1035818132EAB301718EBDA66D517DF9220B2A58DBA3CC656D4F7D9F27E32237
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Default\NTUSER.DAT.LOG2
- Size 536B
- SHA256 91bb6e352189c6ce1eb5b67f887ef4758d09e9264903b85247afa9b5367f85b3
- MD5 a86b79242d559eeac410de4d83c7fc68
- SHA1 2b419edccdb5b53b59ae4db504523801206a5f7a
- SHA512 e1f6ce02cb42e93ce5a24bfc41eada9bf2799f185d741ab2d4108c305b10add970de00f3664bf749cb5744955a14f7164d3d94a12ca4204e35330c5f8f32a202
- TLSH T1DAF075A383580948E52C93302A10392B3C05EB6923CC7DEFC956B772B0076E71C087D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Default\NTUSER.DAT{96622b5f-7bdb-11f1-b23c-ee5cbaaceece}.TMContainer00000000000000000002.regtrans-ms
- Size 512KB
- SHA256 68aecf514652127f8d7013382a7639ed5f805b433f8b54ae0883409d1d1575f3
- MD5 2860609a0fcfd7c36adbc3df88dd4faf
- SHA1 44d69dbd57c59b2885db4d4207e1b31949278922
- SHA512 2fade01d579e54b3d96add8319c456f23f7702610768321f92a2e2cb41095adccc212e104578bfe64d9e839290ede2e44a1612599bdc51396cd97a15bc413dd2
- SSDEEP 12288:cbY5ItrTXcq5VvwXKwsRM124OwYtz43K8sZZFbFnLhY6JXhhuHN+q:qAq52KwsRM8w84sxFl/UHN1
- TLSH T13FB42377E6F70A46A928DF8D8B409BF0B1D1D412E38AFE558C39A5B4972D3D270D1382
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \Device\HarddiskVolume3\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini
- Size 129B
- SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
- MD5 a526b9e7c716b3489d8cc062fbce4005
- SHA1 2df502a944ff721241be20a9e449d2acd07e0312
- SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
- TLSH T169B09B0A41476664B05ED15DAC60E147117D547A4D14A2008EF0B345D1A33550778D69
- MD5 SHA1 SHA512 TLSH