Analysis
-
max time kernel
136s -
max time network
152s -
platform
windows10_x64 -
resource
win10 -
submitted
21-10-2020 17:56
Static task
static1
Behavioral task
behavioral1
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7
Behavioral task
behavioral2
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
potentialenergy@mail.ru
Signatures
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ProtectWrite.tiff 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Drops startup file 1 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 47 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4560 taskkill.exe 4848 taskkill.exe 5628 taskkill.exe 3216 taskkill.exe 2584 taskkill.exe 3816 taskkill.exe 4260 taskkill.exe 4944 taskkill.exe 2532 taskkill.exe 5196 taskkill.exe 5256 taskkill.exe 1544 taskkill.exe 1892 taskkill.exe 4888 taskkill.exe 644 taskkill.exe 5564 taskkill.exe 1192 taskkill.exe 4176 taskkill.exe 4300 taskkill.exe 4696 taskkill.exe 4856 taskkill.exe 5384 taskkill.exe 5428 taskkill.exe 5588 taskkill.exe 2240 taskkill.exe 1992 taskkill.exe 5480 taskkill.exe 3352 taskkill.exe 2156 taskkill.exe 4460 taskkill.exe 4600 taskkill.exe 1236 taskkill.exe 4196 taskkill.exe 5148 taskkill.exe 5676 taskkill.exe 820 taskkill.exe 2188 taskkill.exe 4124 taskkill.exe 4532 taskkill.exe 4820 taskkill.exe 4244 taskkill.exe 4648 taskkill.exe 5524 taskkill.exe 1060 taskkill.exe 4632 taskkill.exe 5224 taskkill.exe 4400 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 5964 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exepid process 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exedescription pid process Token: SeDebugPrivilege 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 820 taskkill.exe Token: SeDebugPrivilege 1192 taskkill.exe Token: SeDebugPrivilege 1060 taskkill.exe Token: SeDebugPrivilege 1544 taskkill.exe Token: SeDebugPrivilege 1892 taskkill.exe Token: SeDebugPrivilege 2584 taskkill.exe Token: SeDebugPrivilege 3216 taskkill.exe Token: SeDebugPrivilege 3352 taskkill.exe Token: SeDebugPrivilege 2240 taskkill.exe Token: SeDebugPrivilege 3816 taskkill.exe Token: SeDebugPrivilege 2188 taskkill.exe Token: SeDebugPrivilege 1992 taskkill.exe Token: SeDebugPrivilege 2156 taskkill.exe Token: SeDebugPrivilege 4124 taskkill.exe Token: SeDebugPrivilege 4176 taskkill.exe Token: SeDebugPrivilege 4260 taskkill.exe Token: SeDebugPrivilege 4300 taskkill.exe Token: SeDebugPrivilege 4400 taskkill.exe Token: SeDebugPrivilege 4460 taskkill.exe Token: SeDebugPrivilege 4532 taskkill.exe Token: SeDebugPrivilege 4600 taskkill.exe Token: SeDebugPrivilege 4632 taskkill.exe Token: SeDebugPrivilege 4696 taskkill.exe Token: SeDebugPrivilege 4820 taskkill.exe Token: SeDebugPrivilege 4888 taskkill.exe Token: SeDebugPrivilege 4856 taskkill.exe Token: SeDebugPrivilege 4944 taskkill.exe Token: SeDebugPrivilege 2532 taskkill.exe Token: SeDebugPrivilege 4244 taskkill.exe Token: SeDebugPrivilege 1236 taskkill.exe Token: SeDebugPrivilege 4648 taskkill.exe Token: SeDebugPrivilege 4848 taskkill.exe Token: SeDebugPrivilege 4196 taskkill.exe Token: SeDebugPrivilege 644 taskkill.exe Token: SeDebugPrivilege 5148 taskkill.exe Token: SeDebugPrivilege 5196 taskkill.exe Token: SeDebugPrivilege 5224 taskkill.exe Token: SeDebugPrivilege 5256 taskkill.exe Token: SeDebugPrivilege 5384 taskkill.exe Token: SeDebugPrivilege 5428 taskkill.exe Token: SeDebugPrivilege 5480 taskkill.exe Token: SeDebugPrivilege 5564 taskkill.exe Token: SeDebugPrivilege 5524 taskkill.exe Token: SeDebugPrivilege 5588 taskkill.exe Token: SeDebugPrivilege 5628 taskkill.exe Token: SeDebugPrivilege 5676 taskkill.exe Token: SeDebugPrivilege 5772 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exenotepad.exepid process 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 5964 notepad.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exepid process 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exedescription pid process target process PID 3904 wrote to memory of 3924 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 3904 wrote to memory of 3924 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 3904 wrote to memory of 2172 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe cmd.exe PID 3904 wrote to memory of 2172 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe cmd.exe PID 3904 wrote to memory of 3160 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 3904 wrote to memory of 3160 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 3904 wrote to memory of 512 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 3904 wrote to memory of 512 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 3904 wrote to memory of 2976 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 3904 wrote to memory of 2976 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 3904 wrote to memory of 820 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 820 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 1060 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 1060 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 1192 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 1192 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 1544 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 1544 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 1892 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 1892 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 2584 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 2584 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 3216 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 3216 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 3352 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 3352 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 2240 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 2240 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 3816 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 3816 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 2188 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 2188 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 1992 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 1992 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 2156 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 2156 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4124 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4124 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4176 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4176 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4260 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4260 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4300 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4300 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4400 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4400 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4460 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4460 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4532 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4532 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4560 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4560 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4600 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4600 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4632 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4632 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4696 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4696 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4820 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4820 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4856 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4856 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4888 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 3904 wrote to memory of 4888 3904 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logMD5
c6b0a774fa56e0169ed7bb7b25c114dd
SHA1bcdba7d4ecfff2180510850e585b44691ea81ba5
SHA256b87210c4a0814394371ec7fba00fc02d9adbb22bcb1811a2abab46fdf4325da9
SHA51242295d57f735c31749235c8463ac2c31778bff46a6a16c87918440d0b2fc70d2f1f6fb10d2499105866f7022108bbda4268d2580356245bd19bbed1ee3a2c446
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
3197ae8a27c9cfd9b5a16714b1e85c2f
SHA14a4c11ce61be1ac12fc5426b4cdb2d64f9548b6f
SHA256bd5654dec9e9780a30d32d2fa011a7064097abc6a6ee0b92d8c65ad2b1b1415c
SHA5124233a5a77ccd1a072db58b164219ab8c10d49c540ad4afcd44b7d28ef42d1b8cf7c4864025aa067f10e3f98911ae438832607f50c9a29e093331c3cc26d7bb3d
-
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txtMD5
29f3da88069970b8303038682efd3a08
SHA14a690135809df6f594cca22efe4b9748a0f73cbf
SHA256ecf076cf35c8cc03080b0124c52d3b936e10384978d4f26db57a499c82f63a1b
SHA512c0d37705e3fe8f6395ff105e3377b8d0a052f124f7acdc173d6975ea1cc2fbc4ab149871f7a0b7cd6299c10b237b3b932e7a39f55055495422c066d162a1f6ae
-
memory/512-6-0x0000000000000000-mapping.dmp
-
memory/644-42-0x0000000000000000-mapping.dmp
-
memory/820-8-0x0000000000000000-mapping.dmp
-
memory/1060-9-0x0000000000000000-mapping.dmp
-
memory/1192-10-0x0000000000000000-mapping.dmp
-
memory/1236-38-0x0000000000000000-mapping.dmp
-
memory/1544-11-0x0000000000000000-mapping.dmp
-
memory/1892-12-0x0000000000000000-mapping.dmp
-
memory/1992-19-0x0000000000000000-mapping.dmp
-
memory/2156-20-0x0000000000000000-mapping.dmp
-
memory/2172-4-0x0000000000000000-mapping.dmp
-
memory/2188-18-0x0000000000000000-mapping.dmp
-
memory/2240-16-0x0000000000000000-mapping.dmp
-
memory/2532-36-0x0000000000000000-mapping.dmp
-
memory/2584-13-0x0000000000000000-mapping.dmp
-
memory/2976-7-0x0000000000000000-mapping.dmp
-
memory/3160-5-0x0000000000000000-mapping.dmp
-
memory/3216-14-0x0000000000000000-mapping.dmp
-
memory/3352-15-0x0000000000000000-mapping.dmp
-
memory/3816-17-0x0000000000000000-mapping.dmp
-
memory/3904-1-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB
-
memory/3904-0-0x00007FF8E2780000-0x00007FF8E316C000-memory.dmpFilesize
9.9MB
-
memory/3924-3-0x0000000000000000-mapping.dmp
-
memory/4124-21-0x0000000000000000-mapping.dmp
-
memory/4176-22-0x0000000000000000-mapping.dmp
-
memory/4196-41-0x0000000000000000-mapping.dmp
-
memory/4244-37-0x0000000000000000-mapping.dmp
-
memory/4260-23-0x0000000000000000-mapping.dmp
-
memory/4300-24-0x0000000000000000-mapping.dmp
-
memory/4400-25-0x0000000000000000-mapping.dmp
-
memory/4460-26-0x0000000000000000-mapping.dmp
-
memory/4532-27-0x0000000000000000-mapping.dmp
-
memory/4560-28-0x0000000000000000-mapping.dmp
-
memory/4600-29-0x0000000000000000-mapping.dmp
-
memory/4632-30-0x0000000000000000-mapping.dmp
-
memory/4648-39-0x0000000000000000-mapping.dmp
-
memory/4696-31-0x0000000000000000-mapping.dmp
-
memory/4820-32-0x0000000000000000-mapping.dmp
-
memory/4848-40-0x0000000000000000-mapping.dmp
-
memory/4856-33-0x0000000000000000-mapping.dmp
-
memory/4888-34-0x0000000000000000-mapping.dmp
-
memory/4944-35-0x0000000000000000-mapping.dmp
-
memory/5148-43-0x0000000000000000-mapping.dmp
-
memory/5196-44-0x0000000000000000-mapping.dmp
-
memory/5224-45-0x0000000000000000-mapping.dmp
-
memory/5256-46-0x0000000000000000-mapping.dmp
-
memory/5384-47-0x0000000000000000-mapping.dmp
-
memory/5428-48-0x0000000000000000-mapping.dmp
-
memory/5480-49-0x0000000000000000-mapping.dmp
-
memory/5488-67-0x0000000000000000-mapping.dmp
-
memory/5524-50-0x0000000000000000-mapping.dmp
-
memory/5564-51-0x0000000000000000-mapping.dmp
-
memory/5588-52-0x0000000000000000-mapping.dmp
-
memory/5628-53-0x0000000000000000-mapping.dmp
-
memory/5676-54-0x0000000000000000-mapping.dmp
-
memory/5764-62-0x0000000000000000-mapping.dmp
-
memory/5772-58-0x000002455CCE0000-0x000002455CCE1000-memory.dmpFilesize
4KB
-
memory/5772-57-0x0000024541E40000-0x0000024541E41000-memory.dmpFilesize
4KB
-
memory/5772-56-0x00007FF8E2780000-0x00007FF8E316C000-memory.dmpFilesize
9.9MB
-
memory/5772-55-0x0000000000000000-mapping.dmp
-
memory/5868-63-0x0000000000000000-mapping.dmp
-
memory/5960-64-0x0000000000000000-mapping.dmp
-
memory/5964-61-0x0000000000000000-mapping.dmp
-
memory/5980-66-0x0000000000000000-mapping.dmp