Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
9ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
Analysis
-
max time kernel
1788s -
max time network
1786s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-11-2020 14:34
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.exe.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
31.exe
Resource
win10v20201028
agenttesladanabotdharmaformbookgozi_rm3qakbot86920224spx1291590734339appi0qiw9zagilenetbankerbotnetcoreentitycryptoneevasionkeyloggerpackerpersistenceransomwareratrezer0spywarestealertrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
agentteslaazorultplugxredlinesmokeloadertofseexmrigbackdoorbootkitdiscoveryevasioninfostealerkeyloggermacrominerpersistencespywarestealertrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral11
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral12
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral13
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.exe.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral14
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral15
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral16
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral17
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral18
Sample
HYDRA.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral19
Sample
KLwC6vii.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral20
Sample
Keygen.exe
Resource
win10v20201028
asyncratazorultmodiloaderoskiraccoonremcos5e4db353b88c002ba6466c06437973619aad03b3xxxxxxxxxxxdiscoveryevasioninfostealerpersistenceratspywarestealertrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral21
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral22
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral23
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral24
Sample
OnlineInstaller.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral25
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral27
Sample
SecuriteInfo.com.Generic.mg.cde56cf0169830ee.29869.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral28
Sample
SecurityTaskManager_Setup.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral29
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win10v20201028
agentteslaazorultplugxponyredlinesmokeloadertofseexmrigbackdoorbootkitdiscoveryevasioninfostealerkeyloggermacrominerpersistenceratspywarestealertrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral30
Sample
VyprVPN.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral31
Sample
WSHSetup[1].exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral32
Sample
Yard.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
Family
hakbit
Ransom Note
To recover your data contact the email below
[email protected]
Key Identifier:
AurLkNjAgbjanuDB/60MzNmn2c/YqPxL1asGmTG80+NCkBjZ2vXLtGUaqQTTP4IPFTyMtTI85kPMGqZ/X2wFDQUfMrKg9pzhk6mXJw7UibHl+wzHclZTbOUc16lkPinb5sMOtFkvKTS73MC5d733N7iTAyBf/D9rfqIO4VqVd5YdAeNOMw/IRvn3ifZyNPWHYKDhT/1C86gRrumhYZJkF2sbHd3CM1dpUlMDWIMSs8K16e7A1Ra2tzfbjg8z305vg7X+4IwTBnu1Sbm5YstbWZBB3k7OOlLLCH/y5+kXRi+xIKzFPBflFwlg4MKqqNj/UO2s26NWfMeqouuF9mxV1MgEEGESP9btTLyX+1xJZLY/W+OF14R3JBbqbw7G2e8j8EPB0wTgYnTmejhJUAcSTJJ/AIQrqPpCk/XgHDxzITuUEgDivP8jGIFha42gO3tXAeAQ/2sfD/wuomlDT8UGSHIgoG7Cq3RrHJDL/8yzJQrXN/H4450nuoU1CgMTRaIFgqKIZb/FeIr9jIsi/0CK/MH+QDaRvLAr+2Dfkje7UcxAa02dHx1jXc7VOFqAKdghfecAok9OWsnUjnnStgY/cxzi9uHySdRkRO2WUYcIhpvMCIJLJec3OJD0x5ip0Z6d7gI+kg3vyp2iLyQ4/QpZdERb1+uoqU+aLPywnlPJDbw=
Number of files that were processed is: 1274
Emails
Signatures
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\OutUse.tiff 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe File opened for modification C:\Users\Admin\Pictures\RepairMount.tiff 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 47 IoCs
pid Process 4868 taskkill.exe 2896 taskkill.exe 1268 taskkill.exe 4044 taskkill.exe 2104 taskkill.exe 4196 taskkill.exe 4300 taskkill.exe 2292 taskkill.exe 2972 taskkill.exe 4048 taskkill.exe 5076 taskkill.exe 3976 taskkill.exe 2456 taskkill.exe 4504 taskkill.exe 4548 taskkill.exe 4600 taskkill.exe 4632 taskkill.exe 4348 taskkill.exe 5004 taskkill.exe 3196 taskkill.exe 1344 taskkill.exe 2312 taskkill.exe 2844 taskkill.exe 4084 taskkill.exe 4240 taskkill.exe 4268 taskkill.exe 5584 taskkill.exe 3428 taskkill.exe 5596 taskkill.exe 3184 taskkill.exe 4116 taskkill.exe 4384 taskkill.exe 4428 taskkill.exe 4692 taskkill.exe 4784 taskkill.exe 3920 taskkill.exe 4260 taskkill.exe 4936 taskkill.exe 4256 taskkill.exe 1476 taskkill.exe 4716 taskkill.exe 4756 taskkill.exe 4964 taskkill.exe 200 taskkill.exe 2248 taskkill.exe 3384 taskkill.exe 2364 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5416 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4840 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 1268 taskkill.exe Token: SeDebugPrivilege 3976 taskkill.exe Token: SeDebugPrivilege 2896 taskkill.exe Token: SeDebugPrivilege 2456 taskkill.exe Token: SeDebugPrivilege 3384 taskkill.exe Token: SeDebugPrivilege 2844 taskkill.exe Token: SeDebugPrivilege 3184 taskkill.exe Token: SeDebugPrivilege 2364 taskkill.exe Token: SeDebugPrivilege 2972 taskkill.exe Token: SeDebugPrivilege 3920 taskkill.exe Token: SeDebugPrivilege 2312 taskkill.exe Token: SeDebugPrivilege 2248 taskkill.exe Token: SeDebugPrivilege 200 taskkill.exe Token: SeDebugPrivilege 1476 taskkill.exe Token: SeDebugPrivilege 1344 taskkill.exe Token: SeDebugPrivilege 2292 taskkill.exe Token: SeDebugPrivilege 3196 taskkill.exe Token: SeDebugPrivilege 4084 taskkill.exe Token: SeDebugPrivilege 4044 taskkill.exe Token: SeDebugPrivilege 4048 taskkill.exe Token: SeDebugPrivilege 4116 taskkill.exe Token: SeDebugPrivilege 4196 taskkill.exe Token: SeDebugPrivilege 4240 taskkill.exe Token: SeDebugPrivilege 4260 taskkill.exe Token: SeDebugPrivilege 4300 taskkill.exe Token: SeDebugPrivilege 4348 taskkill.exe Token: SeDebugPrivilege 4384 taskkill.exe Token: SeDebugPrivilege 4428 taskkill.exe Token: SeDebugPrivilege 4504 taskkill.exe Token: SeDebugPrivilege 4548 taskkill.exe Token: SeDebugPrivilege 4600 taskkill.exe Token: SeDebugPrivilege 4632 taskkill.exe Token: SeDebugPrivilege 4716 taskkill.exe Token: SeDebugPrivilege 4692 taskkill.exe Token: SeDebugPrivilege 4756 taskkill.exe Token: SeDebugPrivilege 4784 taskkill.exe Token: SeDebugPrivilege 4868 taskkill.exe Token: SeDebugPrivilege 4936 taskkill.exe Token: SeDebugPrivilege 4964 taskkill.exe Token: SeDebugPrivilege 5004 taskkill.exe Token: SeDebugPrivilege 5076 taskkill.exe Token: SeDebugPrivilege 4256 taskkill.exe Token: SeDebugPrivilege 3428 taskkill.exe Token: SeDebugPrivilege 4268 taskkill.exe Token: SeDebugPrivilege 5596 taskkill.exe Token: SeDebugPrivilege 5584 taskkill.exe Token: SeDebugPrivilege 5688 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 828 wrote to memory of 3820 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 75 PID 828 wrote to memory of 3820 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 75 PID 828 wrote to memory of 2932 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 77 PID 828 wrote to memory of 2932 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 77 PID 828 wrote to memory of 1696 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 78 PID 828 wrote to memory of 1696 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 78 PID 828 wrote to memory of 3428 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 79 PID 828 wrote to memory of 3428 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 79 PID 828 wrote to memory of 2960 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 81 PID 828 wrote to memory of 2960 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 81 PID 828 wrote to memory of 200 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 828 wrote to memory of 200 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 828 wrote to memory of 1476 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 828 wrote to memory of 1476 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 828 wrote to memory of 3196 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 828 wrote to memory of 3196 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 828 wrote to memory of 1344 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 828 wrote to memory of 1344 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 828 wrote to memory of 2248 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 828 wrote to memory of 2248 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 828 wrote to memory of 2292 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 828 wrote to memory of 2292 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 828 wrote to memory of 2312 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 828 wrote to memory of 2312 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 828 wrote to memory of 3384 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 828 wrote to memory of 3384 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 98 PID 828 wrote to memory of 3976 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 828 wrote to memory of 3976 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 828 wrote to memory of 2364 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 828 wrote to memory of 2364 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 828 wrote to memory of 2896 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 828 wrote to memory of 2896 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 828 wrote to memory of 3184 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 828 wrote to memory of 3184 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 828 wrote to memory of 3920 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 828 wrote to memory of 3920 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 828 wrote to memory of 2844 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 828 wrote to memory of 2844 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 828 wrote to memory of 2972 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 828 wrote to memory of 2972 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 828 wrote to memory of 4084 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 828 wrote to memory of 4084 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 828 wrote to memory of 1268 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 828 wrote to memory of 1268 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 116 PID 828 wrote to memory of 2456 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 828 wrote to memory of 2456 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 828 wrote to memory of 4044 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 828 wrote to memory of 4044 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 828 wrote to memory of 4048 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 828 wrote to memory of 4048 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 828 wrote to memory of 2104 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 828 wrote to memory of 2104 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 828 wrote to memory of 4116 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 126 PID 828 wrote to memory of 4116 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 126 PID 828 wrote to memory of 4196 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 828 wrote to memory of 4196 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 828 wrote to memory of 4240 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130 PID 828 wrote to memory of 4240 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 130 PID 828 wrote to memory of 4260 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 828 wrote to memory of 4260 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 828 wrote to memory of 4300 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 134 PID 828 wrote to memory of 4300 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 134 PID 828 wrote to memory of 4348 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 136 PID 828 wrote to memory of 4348 828 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 136
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵PID:3820
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:2932
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵PID:1696
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵PID:3428
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵PID:2960
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:200
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2312
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3184
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:2104
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4116
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4784
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4256
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5584
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5596
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5688
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:5416
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵PID:5116
-
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:4840
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:4352
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:5004
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:6328
-
-