cryptomix | f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270

Resubmissions

03/09/2026, 09:58

260903-lzl6xseq7w10

26/07/2021, 12:57

210726-nxkbx8kb9n10

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 09:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
Size 82KB
Sample260903-lzl6xseq7w
SHA256 f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270
MD5 c2f30cd537c79b6bcd292e6824ea874e
SHA1 af2624a31ce8adc5d56df91068b1661992d2afc4
SHA512 ceb17963e7b522998ab4dcc1357b8b729e9c10acb37ca7455e9808077dcf9e869123290993c3fcd4a378855b51d10e7a26c84762ec67e80de5947b74cc3b0891
SSDEEP 768:QfbAQ++rU8pQgzQS374gNuyP3O6lYh2J5a9BVapKSKP8f0Me1G0nEoWOLB//sqmP:YbAQIb0R5PtF5WKKSSQ6GEfmsno0A5
TLSH
T174838D12F197F079D0162D7217919B805F3FA592631CA34B2B98092EBE325C85F2A3F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution cryptomix impact persistence ransomware

Malware Config

Signatures

Family: CryptoMix
Ransomware first seen in 2016 which has returned with new variants in 2019.
ransomware cryptomix
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Executes dropped EXE 1 IoCs

pid	Process
1572	Spy Security SoftWare_1c9b74ea_7833ca48.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*Spy Security SoftWares = "\"C:\\ProgramData\\Spy Security SoftWare_1c9b74ea_7833ca48.exe\""	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Spy Security SoftWare = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe\""	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*Spy Security SoftWare = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe\""	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Spy Security SoftWares = "\"C:\\ProgramData\\Spy Security SoftWare_1c9b74ea_7833ca48.exe\""	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\H:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\O:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\S:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\T:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\U:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\Y:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\P:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\R:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\W:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\Z:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\A:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\I:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\J:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\K:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\L:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\V:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\X:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\B:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\D:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\M:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\N:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
File opened (read-only)	\??\Q:	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 32 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2696	cmd.exe
2364	cmd.exe
5852	cmd.exe
5084	cmd.exe
1472	cmd.exe
4236	cmd.exe
3788	cmd.exe
3272	cmd.exe
2540	cmd.exe
1140	cmd.exe
2496	cmd.exe
4516	cmd.exe
968	cmd.exe
4920	cmd.exe
3424	cmd.exe
952	cmd.exe
5912	cmd.exe
1132	cmd.exe
4596	cmd.exe
4244	cmd.exe
5488	cmd.exe
3576	cmd.exe
1136	cmd.exe
3356	cmd.exe
1008	cmd.exe
5940	cmd.exe
5244	cmd.exe
3544	cmd.exe
3516	cmd.exe
260	cmd.exe
1684	cmd.exe
2004	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spy Security SoftWare_1c9b74ea_7833ca48.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1468	WMIC.exe
1468	WMIC.exe
1468	WMIC.exe
1468	WMIC.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1468	WMIC.exe
Token: SeSecurityPrivilege	1468	WMIC.exe
Token: SeTakeOwnershipPrivilege	1468	WMIC.exe
Token: SeLoadDriverPrivilege	1468	WMIC.exe
Token: SeSystemProfilePrivilege	1468	WMIC.exe
Token: SeSystemtimePrivilege	1468	WMIC.exe
Token: SeProfSingleProcessPrivilege	1468	WMIC.exe
Token: SeIncBasePriorityPrivilege	1468	WMIC.exe
Token: SeCreatePagefilePrivilege	1468	WMIC.exe
Token: SeBackupPrivilege	1468	WMIC.exe
Token: SeRestorePrivilege	1468	WMIC.exe
Token: SeShutdownPrivilege	1468	WMIC.exe
Token: SeDebugPrivilege	1468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1468	WMIC.exe
Token: SeRemoteShutdownPrivilege	1468	WMIC.exe
Token: SeUndockPrivilege	1468	WMIC.exe
Token: SeManageVolumePrivilege	1468	WMIC.exe
Token: 33	1468	WMIC.exe
Token: 34	1468	WMIC.exe
Token: 35	1468	WMIC.exe
Token: 36	1468	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1468	WMIC.exe
Token: SeSecurityPrivilege	1468	WMIC.exe
Token: SeTakeOwnershipPrivilege	1468	WMIC.exe
Token: SeLoadDriverPrivilege	1468	WMIC.exe
Token: SeSystemProfilePrivilege	1468	WMIC.exe
Token: SeSystemtimePrivilege	1468	WMIC.exe
Token: SeProfSingleProcessPrivilege	1468	WMIC.exe
Token: SeIncBasePriorityPrivilege	1468	WMIC.exe
Token: SeCreatePagefilePrivilege	1468	WMIC.exe
Token: SeBackupPrivilege	1468	WMIC.exe
Token: SeRestorePrivilege	1468	WMIC.exe
Token: SeShutdownPrivilege	1468	WMIC.exe
Token: SeDebugPrivilege	1468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1468	WMIC.exe
Token: SeRemoteShutdownPrivilege	1468	WMIC.exe
Token: SeUndockPrivilege	1468	WMIC.exe
Token: SeManageVolumePrivilege	1468	WMIC.exe
Token: 33	1468	WMIC.exe
Token: 34	1468	WMIC.exe
Token: 35	1468	WMIC.exe
Token: 36	1468	WMIC.exe
Token: SeBackupPrivilege	1632	vssvc.exe
Token: SeRestorePrivilege	1632	vssvc.exe
Token: SeAuditPrivilege	1632	vssvc.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 2004	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	93
PID 4132 wrote to memory of 1472	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	95
PID 4132 wrote to memory of 4236	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	97
PID 4132 wrote to memory of 5912	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	100
PID 1472 wrote to memory of 1468	1472	cmd.exe	102
PID 4132 wrote to memory of 4516	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	103
PID 4132 wrote to memory of 3788	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	105
PID 4132 wrote to memory of 1132	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	107
PID 4132 wrote to memory of 2696	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	109
PID 4132 wrote to memory of 968	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	111
PID 4132 wrote to memory of 1136	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	114
PID 4132 wrote to memory of 3272	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	116
PID 4132 wrote to memory of 3516	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	118
PID 4132 wrote to memory of 2364	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	120
PID 4132 wrote to memory of 4596	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	122
PID 4132 wrote to memory of 3356	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	124
PID 4132 wrote to memory of 4920	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	127
PID 4132 wrote to memory of 5852	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	129
PID 4132 wrote to memory of 5084	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	131
PID 4132 wrote to memory of 1140	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	133
PID 4132 wrote to memory of 2540	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	135
PID 4132 wrote to memory of 1008	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	137
PID 4132 wrote to memory of 5940	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	139
PID 4132 wrote to memory of 5244	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	141
PID 4132 wrote to memory of 260	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	143
PID 4132 wrote to memory of 3544	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	145
PID 4132 wrote to memory of 5488	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	147
PID 4132 wrote to memory of 4244	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	149
PID 4132 wrote to memory of 1684	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	151
PID 4132 wrote to memory of 3576	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	153
PID 4132 wrote to memory of 3424	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	155
PID 4132 wrote to memory of 2496	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	157
PID 4132 wrote to memory of 952	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	159
PID 3576 wrote to memory of 4248	3576	cmd.exe	161
PID 4248 wrote to memory of 1056	4248	net.exe	162
PID 4132 wrote to memory of 3752	4132	f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe	164

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
"C:\Users\Admin\AppData\Local\Temp\f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4236
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1132
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3272
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:260
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All /Quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C net stop vss
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\net.exe
    net stop vss
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop vss
      4⤵
      System Location Discovery: System Language Discovery
      PID:1056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3424
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:952
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Music\INSTRUCTION RESTORE FILE.TXT
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3752

C:\Users\Admin\AppData\Local\Temp\f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe
"C:\Users\Admin\AppData\Local\Temp\f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4396

C:\ProgramData\Spy Security SoftWare_1c9b74ea_7833ca48.exe
"C:\ProgramData\Spy Security SoftWare_1c9b74ea_7833ca48.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Spy Security SoftWare_1c9b74ea_7833ca48.exe

Path C:\ProgramData\Spy Security SoftWare_1c9b74ea_7833ca48.exe
Size 82KB
SHA256 f8751c14c6f14239d867b21ea1229eeddfa052aeab22b25e158131a118628270
MD5 c2f30cd537c79b6bcd292e6824ea874e
SHA1 af2624a31ce8adc5d56df91068b1661992d2afc4
SHA512 ceb17963e7b522998ab4dcc1357b8b729e9c10acb37ca7455e9808077dcf9e869123290993c3fcd4a378855b51d10e7a26c84762ec67e80de5947b74cc3b0891
SSDEEP 768:QfbAQ++rU8pQgzQS374gNuyP3O6lYh2J5a9BVapKSKP8f0Me1G0nEoWOLB//sqmP:YbAQIb0R5PtF5WKKSSQ6GEfmsno0A5
TLSH
T174838D12F197F079D0162D7217919B805F3FA592631CA34B2B98092EBE325C85F2A3F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTRUCTION RESTORE FILE.TXT

Path C:\Users\Admin\INSTRUCTION RESTORE FILE.TXT
Size 1KB
SHA256 cc2acf45c1dce23e358588506ee47780f20ace0fac9e4c6d95228c66daabd3d6
MD5 90f9138f9a6526ea8396a9e195a4e941
SHA1 165480c815be6f7b805b2f30ecba7f18b336aa22
SHA512 225c5ae041655301904e933d2a5cb14e94d5ce24a189528e05cce1608bb7091a3266dbbf09542e27fb18b72da2ba49305238a3be9b87738fddbf4d8693c0195a
TLSH
T1BC319F22B3F84605F2F73F956EBA51704BBB7C96A939DA9C0190104F49F1E4189B0BB7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1572-3-0x0000000000EB0000-0x0000000000EBB000-memory.dmp

Download

memory/4132-0-0x0000000000E90000-0x0000000000E9B000-memory.dmp

Download

memory/4132-4-0x0000000000E90000-0x0000000000E9B000-memory.dmp

Download

memory/4132-289-0x0000000000E90000-0x0000000000E9B000-memory.dmp

Download

memory/4396-2-0x00000000030C0000-0x00000000030CB000-memory.dmp

Download