Analysis
-
max time kernel
75s -
max time network
68s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 12:58
Static task
static1
Behavioral task
behavioral1
Sample
81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe
Resource
win10v20210410
General
-
Target
81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe
-
Size
416KB
-
MD5
21fa6ebdd397f14bbb68a4e3d012467e
-
SHA1
0ecff2f818565e7eb28d3a7b7d295459a868e920
-
SHA256
81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e
-
SHA512
368e0c8e973f2cf655ea8a69be07b29bc073b2855f6feb9130f5fa8569cfa8d094549ec5d7706c293f8b22ae8bb6ee1b7dd2f4c2d2ccff94e7435e36d966bf66
Malware Config
Extracted
C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
hakbit
clearcuMc04997@gmail.com
1Kex5QmBGtJLDagn3o2p1yoqyKn2A6EFG9
Signatures
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Disables Task Manager via registry modification
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exedescription ioc process File created C:\Users\Admin\Pictures\AddGroup.png.builder 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe File opened for modification C:\Users\Admin\Pictures\MergeApprove.tiff 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe File created C:\Users\Admin\Pictures\MergeApprove.tiff.builder 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe File opened for modification C:\Users\Admin\Pictures\WatchPing.tiff 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe File created C:\Users\Admin\Pictures\WatchPing.tiff.builder 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 220 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exedescription ioc process File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exepid process 620 vssadmin.exe 884 vssadmin.exe 1760 vssadmin.exe 1800 vssadmin.exe 1336 vssadmin.exe 300 vssadmin.exe 1744 vssadmin.exe 1764 vssadmin.exe 232 vssadmin.exe 1816 vssadmin.exe 1848 vssadmin.exe 1780 vssadmin.exe 944 vssadmin.exe 1616 vssadmin.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 828 taskkill.exe 1500 taskkill.exe 1684 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 1328 notepad.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
powershell.exe81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exepid process 1752 powershell.exe 1752 powershell.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powershell.exe81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exetaskkill.exetaskkill.exetaskkill.exevssvc.exedescription pid process Token: SeDebugPrivilege 1752 powershell.exe Token: SeDebugPrivilege 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe Token: SeDebugPrivilege 1500 taskkill.exe Token: SeDebugPrivilege 1684 taskkill.exe Token: SeDebugPrivilege 828 taskkill.exe Token: SeBackupPrivilege 1272 vssvc.exe Token: SeRestorePrivilege 1272 vssvc.exe Token: SeAuditPrivilege 1272 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2004 wrote to memory of 1752 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe powershell.exe PID 2004 wrote to memory of 1752 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe powershell.exe PID 2004 wrote to memory of 1752 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe powershell.exe PID 2004 wrote to memory of 428 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 2004 wrote to memory of 428 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 2004 wrote to memory of 428 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 428 wrote to memory of 1620 428 net.exe net1.exe PID 428 wrote to memory of 1620 428 net.exe net1.exe PID 428 wrote to memory of 1620 428 net.exe net1.exe PID 2004 wrote to memory of 1088 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 2004 wrote to memory of 1088 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 2004 wrote to memory of 1088 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 1088 wrote to memory of 1080 1088 net.exe net1.exe PID 1088 wrote to memory of 1080 1088 net.exe net1.exe PID 1088 wrote to memory of 1080 1088 net.exe net1.exe PID 2004 wrote to memory of 1144 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 2004 wrote to memory of 1144 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 2004 wrote to memory of 1144 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 1144 wrote to memory of 1368 1144 net.exe net1.exe PID 1144 wrote to memory of 1368 1144 net.exe net1.exe PID 1144 wrote to memory of 1368 1144 net.exe net1.exe PID 2004 wrote to memory of 1084 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 2004 wrote to memory of 1084 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 2004 wrote to memory of 1084 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 1084 wrote to memory of 380 1084 net.exe net1.exe PID 1084 wrote to memory of 380 1084 net.exe net1.exe PID 1084 wrote to memory of 380 1084 net.exe net1.exe PID 2004 wrote to memory of 824 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 2004 wrote to memory of 824 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 2004 wrote to memory of 824 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe net.exe PID 824 wrote to memory of 976 824 net.exe net1.exe PID 824 wrote to memory of 976 824 net.exe net1.exe PID 824 wrote to memory of 976 824 net.exe net1.exe PID 2004 wrote to memory of 1860 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 1860 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 1860 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 1200 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 1200 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 1200 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 856 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 856 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 856 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 688 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 688 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 688 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe sc.exe PID 2004 wrote to memory of 1500 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe taskkill.exe PID 2004 wrote to memory of 1500 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe taskkill.exe PID 2004 wrote to memory of 1500 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe taskkill.exe PID 2004 wrote to memory of 1684 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe taskkill.exe PID 2004 wrote to memory of 1684 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe taskkill.exe PID 2004 wrote to memory of 1684 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe taskkill.exe PID 2004 wrote to memory of 828 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe taskkill.exe PID 2004 wrote to memory of 828 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe taskkill.exe PID 2004 wrote to memory of 828 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe taskkill.exe PID 2004 wrote to memory of 1760 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe vssadmin.exe PID 2004 wrote to memory of 1760 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe vssadmin.exe PID 2004 wrote to memory of 1760 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe vssadmin.exe PID 2004 wrote to memory of 1616 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe vssadmin.exe PID 2004 wrote to memory of 1616 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe vssadmin.exe PID 2004 wrote to memory of 1616 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe vssadmin.exe PID 2004 wrote to memory of 1848 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe vssadmin.exe PID 2004 wrote to memory of 1848 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe vssadmin.exe PID 2004 wrote to memory of 1848 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe vssadmin.exe PID 2004 wrote to memory of 300 2004 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe"C:\Users\Admin\AppData\Local\Temp\81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe"1⤵
- Modifies extensions of user files
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\net.exe"net.exe" stop avpsus /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop avpsus /y3⤵
-
C:\Windows\system32\net.exe"net.exe" stop McAfeeDLPAgentService /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeDLPAgentService /y3⤵
-
C:\Windows\system32\net.exe"net.exe" stop mfewc /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mfewc /y3⤵
-
C:\Windows\system32\net.exe"net.exe" stop BMR Boot Service /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BMR Boot Service /y3⤵
-
C:\Windows\system32\net.exe"net.exe" stop NetBackup BMR MTFTP Service /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y3⤵
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
-
C:\Windows\system32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
-
C:\Windows\system32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" Delete Shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exe"vssadmin.exe" Delete Shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.sample.exe2⤵
- Deletes itself
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txtMD5
3acea3606822b35ed566777738b99833
SHA1c83c15fcd3a32b475849ad2a144b4efb55dc5116
SHA256a2d0fd7c97f89fb8e13c92cda7d38d6a37ef9493de7c6ef138922e4f7a27152a
SHA5122fe7415f2d3820efec54fd80bcf26019717aa74d842fbadce82033025784b510e2f0f93c1c9a9a47c4bf106e967ceb0f19322206617c0bce8d474fdd3184fa19
-
memory/220-120-0x0000000000000000-mapping.dmp
-
memory/232-114-0x0000000000000000-mapping.dmp
-
memory/300-108-0x0000000000000000-mapping.dmp
-
memory/380-95-0x0000000000000000-mapping.dmp
-
memory/428-88-0x0000000000000000-mapping.dmp
-
memory/620-111-0x0000000000000000-mapping.dmp
-
memory/688-101-0x0000000000000000-mapping.dmp
-
memory/824-96-0x0000000000000000-mapping.dmp
-
memory/828-104-0x0000000000000000-mapping.dmp
-
memory/856-100-0x0000000000000000-mapping.dmp
-
memory/884-117-0x0000000000000000-mapping.dmp
-
memory/944-118-0x0000000000000000-mapping.dmp
-
memory/976-97-0x0000000000000000-mapping.dmp
-
memory/1080-91-0x0000000000000000-mapping.dmp
-
memory/1084-94-0x0000000000000000-mapping.dmp
-
memory/1088-90-0x0000000000000000-mapping.dmp
-
memory/1144-92-0x0000000000000000-mapping.dmp
-
memory/1200-99-0x0000000000000000-mapping.dmp
-
memory/1328-119-0x0000000000000000-mapping.dmp
-
memory/1336-115-0x0000000000000000-mapping.dmp
-
memory/1368-93-0x0000000000000000-mapping.dmp
-
memory/1500-102-0x0000000000000000-mapping.dmp
-
memory/1616-106-0x0000000000000000-mapping.dmp
-
memory/1620-89-0x0000000000000000-mapping.dmp
-
memory/1684-103-0x0000000000000000-mapping.dmp
-
memory/1744-112-0x0000000000000000-mapping.dmp
-
memory/1748-123-0x0000000000000000-mapping.dmp
-
memory/1752-74-0x000000001A9A0000-0x000000001A9A1000-memory.dmpFilesize
4KB
-
memory/1752-71-0x0000000002750000-0x0000000002751000-memory.dmpFilesize
4KB
-
memory/1752-69-0x000000001A9F4000-0x000000001A9F6000-memory.dmpFilesize
8KB
-
memory/1752-87-0x000000001B460000-0x000000001B461000-memory.dmpFilesize
4KB
-
memory/1752-70-0x0000000002500000-0x0000000002501000-memory.dmpFilesize
4KB
-
memory/1752-66-0x0000000002300000-0x0000000002301000-memory.dmpFilesize
4KB
-
memory/1752-65-0x000000001AA70000-0x000000001AA71000-memory.dmpFilesize
4KB
-
memory/1752-68-0x000000001A9F0000-0x000000001A9F2000-memory.dmpFilesize
8KB
-
memory/1752-64-0x0000000002420000-0x0000000002421000-memory.dmpFilesize
4KB
-
memory/1752-63-0x000007FEFB561000-0x000007FEFB563000-memory.dmpFilesize
8KB
-
memory/1752-86-0x000000001B450000-0x000000001B451000-memory.dmpFilesize
4KB
-
memory/1752-62-0x0000000000000000-mapping.dmp
-
memory/1760-105-0x0000000000000000-mapping.dmp
-
memory/1764-113-0x0000000000000000-mapping.dmp
-
memory/1780-116-0x0000000000000000-mapping.dmp
-
memory/1800-110-0x0000000000000000-mapping.dmp
-
memory/1816-109-0x0000000000000000-mapping.dmp
-
memory/1848-107-0x0000000000000000-mapping.dmp
-
memory/1860-98-0x0000000000000000-mapping.dmp
-
memory/2004-60-0x0000000001260000-0x0000000001261000-memory.dmpFilesize
4KB
-
memory/2004-67-0x000000001AC10000-0x000000001AC12000-memory.dmpFilesize
8KB