rhadamanthys | 8a9f45044aca163fcdd47e4fc6f4c72cc6e17231b3a467758e641d8a76684109

Resubmissions

09-06-2024 16:36

240609-t4j65adb63 10

Analysis

max time kernel
664s
max time network
668s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
07-06-2024 01:39

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Requirements upwork.scr
Size

699.6MB
MD5

1cbf33e0f9964d14cc107236d8060972
SHA1

bd7052b3f20a83ed7ce837030d7aee6b1150781a
SHA256

b7615563fc08671d442b6f8102eeb61f5058f75821bac5f701385f7c123d7fa5
SHA512

1042f8ee6b23000d55082af3061a8559c266302d5a72eb35041d33a090ec4e70850f7d55df3c3463478d40d0a17f4a1834d9e72a59829041540898d6b4bba63b
SSDEEP

393216:fM07b4unYmNXdJu4LTYi7dRcogr6+7QJhrrXZEwCz:fNIunb9bJRRgrWXZEw0

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

calc.exe

description pid process target process

PID 5096 created 2916 5096 calc.exe sihost.exe
Executes dropped EXE 3 IoCs

Processes:

pythonw.exepythonw.execalc.exe

pid process

2228 pythonw.exe
4360 pythonw.exe
5096 calc.exe
Loads dropped DLL 4 IoCs

Processes:

pythonw.exepythonw.exe

pid process

2228 pythonw.exe
2228 pythonw.exe
4360 pythonw.exe
4360 pythonw.exe

description	pid	process	target process
PID 5096 created 2916	5096	calc.exe	sihost.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
File opened (read-only)	\??\m:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\q:	explorer.exe
File opened (read-only)	\??\r:	explorer.exe
File opened (read-only)	\??\A:	explorer.exe
File opened (read-only)	\??\b:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\x:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\t:	explorer.exe
File opened (read-only)	\??\y:	explorer.exe
File opened (read-only)	\??\i:	explorer.exe
File opened (read-only)	\??\k:	explorer.exe
File opened (read-only)	\??\l:	explorer.exe
File opened (read-only)	\??\n:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\e:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\h:	explorer.exe
File opened (read-only)	\??\p:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\z:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\u:	explorer.exe
File opened (read-only)	\??\v:	explorer.exe
File opened (read-only)	\??\a:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\s:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\g:	explorer.exe
File opened (read-only)	\??\j:	explorer.exe
File opened (read-only)	\??\w:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\o:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

pythonw.exeexplorer.exe

description pid process target process

PID 4360 set thread context of 4888 4360 pythonw.exe cmd.exe
PID 2860 set thread context of 5096 2860 explorer.exe calc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 4360 set thread context of 4888	4360	pythonw.exe	cmd.exe
PID 2860 set thread context of 5096	2860	explorer.exe	calc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

AcroRd32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 42 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "54"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe

Modifies registry class 33 IoCs

Processes:

OpenWith.exeRequirements upwork.scr

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	Requirements upwork.scr
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\NodeSlot = "9"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1 = 8c003100000000009a58247f110050524f4752417e310000740009000400efbec55259619a58247f2e0000003f0000000000010000000000000000004a0000000000666d0401500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe

Opens file in notepad (likely ransom note) 4 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXENOTEPAD.EXENOTEPAD.EXE

pid process

1320 NOTEPAD.EXE
3384 NOTEPAD.EXE
4352 NOTEPAD.EXE
836 NOTEPAD.EXE

pid	process
1320	NOTEPAD.EXE
3384	NOTEPAD.EXE
4352	NOTEPAD.EXE
836	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

pythonw.exepythonw.execmd.exeAcroRd32.exeexplorer.execalc.exedialer.exe

pid	process
2228	pythonw.exe
4360	pythonw.exe
4360	pythonw.exe
4888	cmd.exe
4888	cmd.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
2860	explorer.exe
2860	explorer.exe
5096	calc.exe
5096	calc.exe
2632	dialer.exe
2632	dialer.exe
2632	dialer.exe
2632	dialer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

3156 OpenWith.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

pythonw.execmd.exe

pid process

4360 pythonw.exe
4888 cmd.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

LogonUI.exe

description pid process

Token: SeShutdownPrivilege 196 LogonUI.exe
Token: SeCreatePagefilePrivilege 196 LogonUI.exe
Token: SeShutdownPrivilege 196 LogonUI.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

568 AcroRd32.exe

pid	process
3156	OpenWith.exe

pid	process
4360	pythonw.exe
4888	cmd.exe

description	pid	process
Token: SeShutdownPrivilege	196	LogonUI.exe
Token: SeCreatePagefilePrivilege	196	LogonUI.exe
Token: SeShutdownPrivilege	196	LogonUI.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

AcroRd32.exeOpenWith.exeLogonUI.exe

pid	process
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
568	AcroRd32.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
3156	OpenWith.exe
196	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Requirements upwork.scrpythonw.exepythonw.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2440 wrote to memory of 2228	2440	Requirements upwork.scr	pythonw.exe
PID 2440 wrote to memory of 2228	2440	Requirements upwork.scr	pythonw.exe
PID 2440 wrote to memory of 568	2440	Requirements upwork.scr	AcroRd32.exe
PID 2440 wrote to memory of 568	2440	Requirements upwork.scr	AcroRd32.exe
PID 2440 wrote to memory of 568	2440	Requirements upwork.scr	AcroRd32.exe
PID 2228 wrote to memory of 4360	2228	pythonw.exe	pythonw.exe
PID 2228 wrote to memory of 4360	2228	pythonw.exe	pythonw.exe
PID 4360 wrote to memory of 4888	4360	pythonw.exe	cmd.exe
PID 4360 wrote to memory of 4888	4360	pythonw.exe	cmd.exe
PID 4360 wrote to memory of 4888	4360	pythonw.exe	cmd.exe
PID 568 wrote to memory of 1524	568	AcroRd32.exe	RdrCEF.exe
PID 568 wrote to memory of 1524	568	AcroRd32.exe	RdrCEF.exe
PID 568 wrote to memory of 1524	568	AcroRd32.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 2276	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 1872	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 1872	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 1872	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 1872	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 1872	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 1872	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 1872	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 1872	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 1872	1524	RdrCEF.exe	RdrCEF.exe
PID 1524 wrote to memory of 1872	1524	RdrCEF.exe	RdrCEF.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2916

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632

C:\Users\Admin\AppData\Local\Temp\Requirements upwork.scr
"C:\Users\Admin\AppData\Local\Temp\Requirements upwork.scr" /S
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe
"C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe" /S
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228

C:\Users\Admin\AppData\Roaming\wh_Ultra\pythonw.exe
"C:\Users\Admin\AppData\Roaming\wh_Ultra\pythonw.exe" /S
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4888

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" /S
5⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2860

C:\Windows\SysWoW64\calc.exe
C:\Windows\SysWoW64\calc.exe
6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5096

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Temp\Requirements.pdf"
2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FAADD53AD171F98C869C9A29BFDC5D71 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2276

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=17FFB68669B02A4BA5158B87628168AB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=17FFB68669B02A4BA5158B87628168AB --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
4⤵
PID:1872

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8B58D5F9133019783EB0786D4FD460F1 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:3332

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6E948151976E14C9C6BB1E95DA457227 --mojo-platform-channel-handle=1952 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2344

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=57ECA65AEEA3A634FF9E04CEB1C55AD0 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2940

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9652CE548F6424D14C36DD1BC2C07DDD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9652CE548F6424D14C36DD1BC2C07DDD --renderer-client-id=7 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job /prefetch:1
4⤵
PID:804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1620

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1717727543.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1320

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3156

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\THCFD7A.tmp.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3384

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ade3b227.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4352

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1717727543.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:836

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a12855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:196

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-1696768468-2170909707-4198977321-1000\ReadOnly\LockScreen_Z\LockScreen___1280_0720_notdimmed.jpg
Filesize
62KB

MD5
6cb7e9f13c79d1dd975a8aa005ab0256

SHA1
eac7fc28cc13ac1e9c85f828215cd61f0c698ae3

SHA256
af2537d470fddbeda270c965b8dbdf7e9ccf480ed2f525012e2f1035112a6d67

SHA512
3a40359d8e4cc8792be78a022dc04daed5c1cc55d78fe9cf3e061ea5587baa15023ce2152238f5be5cc5124cd468f220cf9dab54344d93edd3dfcd400b24469d

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
2b7fac61ba98e8d74f6aa6b6a97d1224

SHA1
72f0fa7d065b7f4a17c18e970af0aa881bed89b3

SHA256
9705be6741d8a619b5f1d68912ae9af6181358390949178b0095f922a7eca8bd

SHA512
f7f43e94a265b14d7e6ab66b6d4d31eda82d35aa472aa408259dc4c71ef24f592fc0f6f51b5c163af517130146e6659c764baabca4e00fe107fe770cdf3b8d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\Local\Temp\THCFD7A.tmp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ade3b227
Filesize
2.4MB

MD5
0c954be7394a33dc3963c7c884e802c9

SHA1
a81f7098413a9b5841eff7f904cd178e4ad68c31

SHA256
c130d5224dcb11d5548eb805469967db714c83c8d28e99fa9c32cae3bf331886

SHA512
8dfddc976fd6e6e2246938f3ca214ca7b6dd63e13d7bd7dbe9e728029f07e998855f4e8e01450d047b17bbfae89e099fbafc6662b415af077d0658f668a65179

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\VCRUNTIME140.dll
Filesize
106KB

MD5
49c96cecda5c6c660a107d378fdfc3d4

SHA1
00149b7a66723e3f0310f139489fe172f818ca8e

SHA256
69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

SHA512
e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\birdseed.ppt
Filesize
49KB

MD5
cdec9e890deef870a230ac61480ba210

SHA1
549a622bb93e5ab4114f10d8ed884d15be5e3777

SHA256
c36e7e60ca938247cb90be8af70a8044e965dd58c69260748f6bfe3e5109eb04

SHA512
ecb49dcaeaaf7fdefb622c8a2d7b8c187e8d791f8e26e16c669600aa24868d93cbccec0e7fc1cf0be12c7ea7b4f4412f0802e93ac5f2849229aa9c0b3e6bc98e

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\python310.dll
Filesize
4.3MB

MD5
8fbbe41173ae011a717c706f25d06121

SHA1
db35f1d1a0916cc0732b9747bd67a37e827440aa

SHA256
ccd635f18a955d0d6bec012be96de876bb2009ff522c3457df40792405637a5a

SHA512
8a17ecd7545ccee3bba62df2c5a00b839f60e0009fa55d9c9d8cc962349a501c618d65f83de2a977bda9b4368224f6ea89a881478d58fa4b68a9891b998d985a

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe
Filesize
94KB

MD5
9a4cc0d8e7007f7ef20ca585324e0739

SHA1
f3e5a2e477cac4bab85940a2158eed78f2d74441

SHA256
040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92

SHA512
54636a48141804112f5b4f2fc70cb7c959a041e5743aeedb5184091b51daa1d1a03f0016e8299c0d56d924c6c8ae585e4fc864021081ffdf1e6f3eab11dd43b3

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\rhatany.docx
Filesize
2.2MB

MD5
95a2d2cbff9d49bb8f71a968e6d70692

SHA1
d1880df094228be3764a6d466396cd86a16749db

SHA256
3074fd2d1c68a0224d9a1bb28c222ca303af7efe6a251b0ca2b7160c635ecdd5

SHA512
09296b402aeeec2ba5e8005753533a78cf368b361b115e0d11d79375653036c0670918564bc53119a41e5d43a8680e69d339e44d34d33b53176e54550641e098

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Requirements.pdf
Filesize
717KB

MD5
720b78ca59dbb0e1b885f47b9c4eebd3

SHA1
98629bc8c27329023931d158d2ab879e8136b5ff

SHA256
73300eda96e39870895468cf7a7b90616b37d5d7673671c89db1776c192ed2be

SHA512
ee22206441b41881acbae939dba2f4269e652782ba485963f81d3ae2aedd3838bba2a673de502a367cdc5f1a8c33a08e120495a473d617f2ec049fa5f0be17ac

Download Submit
memory/2228-30-0x00007FFA35800000-0x00007FFA3597A000-memory.dmp

Filesize
1.5MB

Download
memory/2632-230-0x0000000076510000-0x0000000076762000-memory.dmp

Filesize
2.3MB

Download
memory/2632-223-0x0000000000DA0000-0x0000000000DA9000-memory.dmp

Filesize
36KB

Download
memory/2632-228-0x00007FFA44CC0000-0x00007FFA44EC9000-memory.dmp

Filesize
2.0MB

Download
memory/2632-227-0x0000000002DF0000-0x00000000031F0000-memory.dmp

Filesize
4.0MB

Download
memory/2860-232-0x00007FF630200000-0x00007FF6303BC000-memory.dmp

Filesize
1.7MB

Download
memory/2860-216-0x00007FF630200000-0x00007FF6303BC000-memory.dmp

Filesize
1.7MB

Download
memory/4360-46-0x00007FFA35800000-0x00007FFA3597A000-memory.dmp

Filesize
1.5MB

Download
memory/4360-73-0x00007FFA35800000-0x00007FFA3597A000-memory.dmp

Filesize
1.5MB

Download
memory/4888-210-0x000000006B030000-0x000000006B1AD000-memory.dmp

Filesize
1.5MB

Download
memory/4888-80-0x000000006B030000-0x000000006B1AD000-memory.dmp

Filesize
1.5MB

Download
memory/4888-79-0x00007FFA44CC0000-0x00007FFA44EC9000-memory.dmp

Filesize
2.0MB

Download
memory/5096-219-0x0000000003E20000-0x0000000004220000-memory.dmp

Filesize
4.0MB

Download
memory/5096-220-0x00007FFA44CC0000-0x00007FFA44EC9000-memory.dmp

Filesize
2.0MB

Download
memory/5096-218-0x0000000003E20000-0x0000000004220000-memory.dmp

Filesize
4.0MB

Download
memory/5096-222-0x0000000076510000-0x0000000076762000-memory.dmp

Filesize
2.3MB

Download
memory/5096-225-0x0000000000320000-0x000000000038D000-memory.dmp

Filesize
436KB

Download
memory/5096-217-0x0000000000320000-0x000000000038D000-memory.dmp

Filesize
436KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads