eb2ed1680e9b2350d78f431849a9e8c5c1d91d97ae72767d228b2208e6f72f46

Resubmissions

29-10-2021 09:03

211029-kz7xysdac7 10

28-10-2021 13:28

211028-qq5dcsgdeq 10

23-10-2021 01:52

211023-cagepshab4 8

Analysis

max time kernel
121s
max time network
148s
platform
windows10_x64
resource
win10-en-20210920
submitted
23-10-2021 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

steriok.exe
Size

94KB
MD5

b0c615c0a4f485b2030d6e1ab98375f0
SHA1

de11e9d61e0a31dc19e8c5dd8fe06facf0ead052
SHA256

eb2ed1680e9b2350d78f431849a9e8c5c1d91d97ae72767d228b2208e6f72f46
SHA512

82342be7d388244b5b008134d6d351f669995caff94a9a532ce056130f1af54a20ec6f2b9a3ca78102200c53a73659d1043e5b213ce84642d225690a3a848024

Score

8^/10

ransomware

Malware Config

Signatures

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

steriok.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\CompleteGroup.tiff	steriok.exe
File renamed	C:\Users\Admin\Pictures\RemoveGroup.png => C:\Users\Admin\Pictures\RemoveGroup.png.steriok	steriok.exe
File opened for modification	C:\Users\Admin\Pictures\RemoveGroup.png.steriok	steriok.exe
File renamed	C:\Users\Admin\Pictures\CompleteGroup.tiff => C:\Users\Admin\Pictures\CompleteGroup.tiff.steriok	steriok.exe
File opened for modification	C:\Users\Admin\Pictures\CompleteGroup.tiff.steriok	steriok.exe
File renamed	C:\Users\Admin\Pictures\PingJoin.tif => C:\Users\Admin\Pictures\PingJoin.tif.steriok	steriok.exe
File opened for modification	C:\Users\Admin\Pictures\PingJoin.tif.steriok	steriok.exe
File renamed	C:\Users\Admin\Pictures\PopEnter.raw => C:\Users\Admin\Pictures\PopEnter.raw.steriok	steriok.exe
File opened for modification	C:\Users\Admin\Pictures\PopEnter.raw.steriok	steriok.exe
File renamed	C:\Users\Admin\Pictures\UseRedo.raw => C:\Users\Admin\Pictures\UseRedo.raw.steriok	steriok.exe
File opened for modification	C:\Users\Admin\Pictures\UseRedo.raw.steriok	steriok.exe

Drops startup file 1 IoCs

Processes:

steriok.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	steriok.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

steriok.exe

description	ioc	Process
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	steriok.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	steriok.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	steriok.exe

Drops file in Program Files directory 31 IoCs

Processes:

steriok.exe

description	ioc	Process
File opened for modification	C:\Program Files\LockExit.mpg.steriok	steriok.exe
File opened for modification	C:\Program Files\PingDisconnect.xps	steriok.exe
File opened for modification	C:\Program Files\UseReset.xml.steriok	steriok.exe
File opened for modification	C:\Program Files\WriteShow.cab	steriok.exe
File opened for modification	C:\Program Files\ComparePop.zip	steriok.exe
File opened for modification	C:\Program Files\ConfirmMeasure.xhtml.steriok	steriok.exe
File opened for modification	C:\Program Files\InstallDebug.ods.steriok	steriok.exe
File opened for modification	C:\Program Files\ComparePop.zip.steriok	steriok.exe
File opened for modification	C:\Program Files\PingDisconnect.xps.steriok	steriok.exe
File created	C:\Program Files\RESTORE_FILES_INFO.txt	steriok.exe
File opened for modification	C:\Program Files\EnableTrace.xlt.steriok	steriok.exe
File opened for modification	C:\Program Files\MoveCompress.png	steriok.exe
File opened for modification	C:\Program Files\UseReset.xml	steriok.exe
File opened for modification	C:\Program Files\EnableTrace.xlt	steriok.exe
File opened for modification	C:\Program Files\DisableUninstall.css	steriok.exe
File opened for modification	C:\Program Files\LockExit.mpg	steriok.exe
File opened for modification	C:\Program Files\MoveCompress.png.steriok	steriok.exe
File opened for modification	C:\Program Files\TraceApprove.ods	steriok.exe
File opened for modification	C:\Program Files\UpdateSend.wm	steriok.exe
File opened for modification	C:\Program Files\AddUpdate.iso	steriok.exe
File opened for modification	C:\Program Files\ConfirmMeasure.xhtml	steriok.exe
File opened for modification	C:\Program Files\ConnectUninstall.dwg	steriok.exe
File opened for modification	C:\Program Files\UpdateSend.wm.steriok	steriok.exe
File opened for modification	C:\Program Files\TraceProtect.ps1xml	steriok.exe
File opened for modification	C:\Program Files\WriteShow.cab.steriok	steriok.exe
File opened for modification	C:\Program Files\ConnectUninstall.dwg.steriok	steriok.exe
File opened for modification	C:\Program Files\InstallDebug.ods	steriok.exe
File opened for modification	C:\Program Files\TraceApprove.ods.steriok	steriok.exe
File opened for modification	C:\Program Files\TraceProtect.ps1xml.steriok	steriok.exe
File opened for modification	C:\Program Files\AddUpdate.iso.steriok	steriok.exe
File opened for modification	C:\Program Files\DisableUninstall.css.steriok	steriok.exe

Drops file in Windows directory 23 IoCs

Processes:

steriok.exe

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	steriok.exe
File opened for modification	C:\Windows\DtcInstall.log.steriok	steriok.exe
File opened for modification	C:\Windows\PFRO.log.steriok	steriok.exe
File opened for modification	C:\Windows\setupact.log	steriok.exe
File opened for modification	C:\Windows\setuperr.log	steriok.exe
File opened for modification	C:\Windows\system.ini.steriok	steriok.exe
File opened for modification	C:\Windows\WindowsUpdate.log	steriok.exe
File opened for modification	C:\Windows\mib.bin	steriok.exe
File opened for modification	C:\Windows\PFRO.log	steriok.exe
File opened for modification	C:\Windows\Professional.xml	steriok.exe
File opened for modification	C:\Windows\setupact.log.steriok	steriok.exe
File opened for modification	C:\Windows\win.ini	steriok.exe
File opened for modification	C:\Windows\WMSysPr9.prx	steriok.exe
File opened for modification	C:\Windows\bootstat.dat	steriok.exe
File opened for modification	C:\Windows\lsasetup.log	steriok.exe
File opened for modification	C:\Windows\lsasetup.log.steriok	steriok.exe
File opened for modification	C:\Windows\WindowsUpdate.log.steriok	steriok.exe
File created	C:\Windows\RESTORE_FILES_INFO.txt	steriok.exe
File created	C:\Windows\bootstat.dat.steriok	steriok.exe
File opened for modification	C:\Windows\Professional.xml.steriok	steriok.exe
File opened for modification	C:\Windows\system.ini	steriok.exe
File opened for modification	C:\Windows\win.ini.steriok	steriok.exe
File opened for modification	C:\Windows\WindowsShell.Manifest	steriok.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	Process
2328	taskkill.exe
4116	taskkill.exe
436	taskkill.exe
4272	taskkill.exe
4468	taskkill.exe
4796	taskkill.exe
2764	taskkill.exe
2252	taskkill.exe
2656	taskkill.exe
3116	taskkill.exe
4260	taskkill.exe
4620	taskkill.exe
2920	taskkill.exe
4232	taskkill.exe
5048	taskkill.exe
608	taskkill.exe
2188	taskkill.exe
3608	taskkill.exe
704	taskkill.exe
3260	taskkill.exe
1140	taskkill.exe
828	taskkill.exe
2740	taskkill.exe
2380	taskkill.exe
2400	taskkill.exe
2224	taskkill.exe
3112	taskkill.exe
2556	taskkill.exe
4044	taskkill.exe
3104	taskkill.exe
1772	taskkill.exe
1084	taskkill.exe
2496	taskkill.exe
5000	taskkill.exe
4688	taskkill.exe
2640	taskkill.exe
1964	taskkill.exe
1748	taskkill.exe
3732	taskkill.exe
3984	taskkill.exe
2228	taskkill.exe
4716	taskkill.exe
1052	taskkill.exe
4980	taskkill.exe
2052	taskkill.exe
3728	taskkill.exe
4448	taskkill.exe
1892	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
3324	reg.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

Processes:

NOTEPAD.EXEnotepad.exe

pid	Process
1640	NOTEPAD.EXE
1888	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
2164	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

steriok.exe

pid	Process
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe
4200	steriok.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

steriok.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	4200	steriok.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	2380	taskkill.exe
Token: SeDebugPrivilege	2496	taskkill.exe
Token: SeDebugPrivilege	2400	taskkill.exe
Token: SeDebugPrivilege	4232	taskkill.exe
Token: SeDebugPrivilege	4260	taskkill.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	5000	taskkill.exe
Token: SeDebugPrivilege	2328	taskkill.exe
Token: SeDebugPrivilege	4688	taskkill.exe
Token: SeDebugPrivilege	3112	taskkill.exe
Token: SeDebugPrivilege	2224	taskkill.exe
Token: SeDebugPrivilege	2640	taskkill.exe
Token: SeDebugPrivilege	608	taskkill.exe
Token: SeDebugPrivilege	4620	taskkill.exe
Token: SeDebugPrivilege	4796	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	2556	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	3608	taskkill.exe
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	3732	taskkill.exe
Token: SeDebugPrivilege	4116	taskkill.exe
Token: SeDebugPrivilege	4044	taskkill.exe
Token: SeDebugPrivilege	704	taskkill.exe
Token: SeDebugPrivilege	4448	taskkill.exe
Token: SeDebugPrivilege	3260	taskkill.exe
Token: SeDebugPrivilege	436	taskkill.exe
Token: SeDebugPrivilege	3104	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	828	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	3984	taskkill.exe
Token: SeDebugPrivilege	2740	taskkill.exe
Token: SeDebugPrivilege	1084	taskkill.exe
Token: SeDebugPrivilege	4272	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	4980	taskkill.exe
Token: SeDebugPrivilege	2228	taskkill.exe
Token: SeDebugPrivilege	4716	taskkill.exe
Token: SeDebugPrivilege	3116	taskkill.exe
Token: SeDebugPrivilege	400	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

steriok.exe

pid	Process
4200	steriok.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

steriok.exe

pid	Process
4200	steriok.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

steriok.exe

description	pid	Process	procid_target
PID 4200 wrote to memory of 4468	4200	steriok.exe	69
PID 4200 wrote to memory of 4468	4200	steriok.exe	69
PID 4200 wrote to memory of 4468	4200	steriok.exe	69
PID 4200 wrote to memory of 2152	4200	steriok.exe	71
PID 4200 wrote to memory of 2152	4200	steriok.exe	71
PID 4200 wrote to memory of 2152	4200	steriok.exe	71
PID 4200 wrote to memory of 3324	4200	steriok.exe	73
PID 4200 wrote to memory of 3324	4200	steriok.exe	73
PID 4200 wrote to memory of 3324	4200	steriok.exe	73
PID 4200 wrote to memory of 3912	4200	steriok.exe	75
PID 4200 wrote to memory of 3912	4200	steriok.exe	75
PID 4200 wrote to memory of 3912	4200	steriok.exe	75
PID 4200 wrote to memory of 4308	4200	steriok.exe	77
PID 4200 wrote to memory of 4308	4200	steriok.exe	77
PID 4200 wrote to memory of 4308	4200	steriok.exe	77
PID 4200 wrote to memory of 4060	4200	steriok.exe	79
PID 4200 wrote to memory of 4060	4200	steriok.exe	79
PID 4200 wrote to memory of 4060	4200	steriok.exe	79
PID 4200 wrote to memory of 524	4200	steriok.exe	80
PID 4200 wrote to memory of 524	4200	steriok.exe	80
PID 4200 wrote to memory of 524	4200	steriok.exe	80
PID 4200 wrote to memory of 652	4200	steriok.exe	81
PID 4200 wrote to memory of 652	4200	steriok.exe	81
PID 4200 wrote to memory of 652	4200	steriok.exe	81
PID 4200 wrote to memory of 1040	4200	steriok.exe	85
PID 4200 wrote to memory of 1040	4200	steriok.exe	85
PID 4200 wrote to memory of 1040	4200	steriok.exe	85
PID 4200 wrote to memory of 1124	4200	steriok.exe	88
PID 4200 wrote to memory of 1124	4200	steriok.exe	88
PID 4200 wrote to memory of 1124	4200	steriok.exe	88
PID 4200 wrote to memory of 1468	4200	steriok.exe	89
PID 4200 wrote to memory of 1468	4200	steriok.exe	89
PID 4200 wrote to memory of 1468	4200	steriok.exe	89
PID 4200 wrote to memory of 1636	4200	steriok.exe	91
PID 4200 wrote to memory of 1636	4200	steriok.exe	91
PID 4200 wrote to memory of 1636	4200	steriok.exe	91
PID 4200 wrote to memory of 1836	4200	steriok.exe	93
PID 4200 wrote to memory of 1836	4200	steriok.exe	93
PID 4200 wrote to memory of 1836	4200	steriok.exe	93
PID 4200 wrote to memory of 2380	4200	steriok.exe	95
PID 4200 wrote to memory of 2380	4200	steriok.exe	95
PID 4200 wrote to memory of 2380	4200	steriok.exe	95
PID 4200 wrote to memory of 2400	4200	steriok.exe	97
PID 4200 wrote to memory of 2400	4200	steriok.exe	97
PID 4200 wrote to memory of 2400	4200	steriok.exe	97
PID 4200 wrote to memory of 2496	4200	steriok.exe	100
PID 4200 wrote to memory of 2496	4200	steriok.exe	100
PID 4200 wrote to memory of 2496	4200	steriok.exe	100
PID 4200 wrote to memory of 4232	4200	steriok.exe	101
PID 4200 wrote to memory of 4232	4200	steriok.exe	101
PID 4200 wrote to memory of 4232	4200	steriok.exe	101
PID 4200 wrote to memory of 4260	4200	steriok.exe	102
PID 4200 wrote to memory of 4260	4200	steriok.exe	102
PID 4200 wrote to memory of 4260	4200	steriok.exe	102
PID 4200 wrote to memory of 5000	4200	steriok.exe	105
PID 4200 wrote to memory of 5000	4200	steriok.exe	105
PID 4200 wrote to memory of 5000	4200	steriok.exe	105
PID 4200 wrote to memory of 5048	4200	steriok.exe	107
PID 4200 wrote to memory of 5048	4200	steriok.exe	107
PID 4200 wrote to memory of 5048	4200	steriok.exe	107
PID 4200 wrote to memory of 2328	4200	steriok.exe	109
PID 4200 wrote to memory of 2328	4200	steriok.exe	109
PID 4200 wrote to memory of 2328	4200	steriok.exe	109
PID 4200 wrote to memory of 4688	4200	steriok.exe	111

C:\Users\Admin\AppData\Local\Temp\steriok.exe
"C:\Users\Admin\AppData\Local\Temp\steriok.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\SysWOW64\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:2152
- C:\Windows\SysWOW64\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:3324
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:3912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:4308
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:4060
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:524
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:652
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:1040
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:1124
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:1468
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:1636
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:1836
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2380
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4260
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5048
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2328
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:608
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1748
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:3728
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:704
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3260
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3104
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4272
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:2164
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:2452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\steriok.exe
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4236

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\RESTORE_FILES_INFO.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1640

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\34db701d52b04e3894e39ad150289701 /t 2444 /p 1888
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

MD5
7ca28064fba0c5907d42764d7397b5fb

SHA1
48f82e0d4a8c949d737e11c81bbe0dac2c5271c6

SHA256
a98e6b3a64a23bcef3ae76dfd2a323d99da6be68bc11a2a3f3adc759a5ea9fbe

SHA512
9369df09b2178374e944a2f8e5e751b48ddaee1b94792f99194e78ad73d428bcfb6911b21aa51dd81406a7163a18f46f180a7e4778df54870bb93cd1d5a0ae11

Download Submit
C:\Users\Public\Desktop\RESTORE_FILES_INFO.txt

MD5
7ca28064fba0c5907d42764d7397b5fb

SHA1
48f82e0d4a8c949d737e11c81bbe0dac2c5271c6

SHA256
a98e6b3a64a23bcef3ae76dfd2a323d99da6be68bc11a2a3f3adc759a5ea9fbe

SHA512
9369df09b2178374e944a2f8e5e751b48ddaee1b94792f99194e78ad73d428bcfb6911b21aa51dd81406a7163a18f46f180a7e4778df54870bb93cd1d5a0ae11

Download Submit
memory/400-182-0x0000000000000000-mapping.dmp

Download
memory/400-193-0x0000000007D50000-0x0000000007D51000-memory.dmp

Filesize
4KB

Download
memory/400-183-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/400-185-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/400-186-0x0000000007690000-0x0000000007691000-memory.dmp

Filesize
4KB

Download
memory/400-194-0x0000000008650000-0x0000000008651000-memory.dmp

Filesize
4KB

Download
memory/400-187-0x0000000007490000-0x0000000007491000-memory.dmp

Filesize
4KB

Download
memory/400-195-0x00000000086A0000-0x00000000086A1000-memory.dmp

Filesize
4KB

Download
memory/400-208-0x0000000004BC4000-0x0000000004BC6000-memory.dmp

Filesize
8KB

Download
memory/400-196-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/400-206-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/400-192-0x0000000004BC2000-0x0000000004BC3000-memory.dmp

Filesize
4KB

Download
memory/400-190-0x0000000007FC0000-0x0000000007FC1000-memory.dmp

Filesize
4KB

Download
memory/400-188-0x0000000007CC0000-0x0000000007CC1000-memory.dmp

Filesize
4KB

Download
memory/400-207-0x0000000004BC3000-0x0000000004BC4000-memory.dmp

Filesize
4KB

Download
memory/400-191-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/400-184-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/436-167-0x0000000000000000-mapping.dmp

Download
memory/524-128-0x0000000000000000-mapping.dmp

Download
memory/608-147-0x0000000000000000-mapping.dmp

Download
memory/652-129-0x0000000000000000-mapping.dmp

Download
memory/704-164-0x0000000000000000-mapping.dmp

Download
memory/828-170-0x0000000000000000-mapping.dmp

Download
memory/1040-130-0x0000000000000000-mapping.dmp

Download
memory/1052-150-0x0000000000000000-mapping.dmp

Download
memory/1084-175-0x0000000000000000-mapping.dmp

Download
memory/1124-131-0x0000000000000000-mapping.dmp

Download
memory/1140-169-0x0000000000000000-mapping.dmp

Download
memory/1468-132-0x0000000000000000-mapping.dmp

Download
memory/1636-133-0x0000000000000000-mapping.dmp

Download
memory/1748-158-0x0000000000000000-mapping.dmp

Download
memory/1772-172-0x0000000000000000-mapping.dmp

Download
memory/1836-134-0x0000000000000000-mapping.dmp

Download
memory/1888-209-0x0000000000000000-mapping.dmp

Download
memory/1892-171-0x0000000000000000-mapping.dmp

Download
memory/1964-153-0x0000000000000000-mapping.dmp

Download
memory/2052-159-0x0000000000000000-mapping.dmp

Download
memory/2152-123-0x0000000000000000-mapping.dmp

Download
memory/2164-211-0x0000000000000000-mapping.dmp

Download
memory/2188-151-0x0000000000000000-mapping.dmp

Download
memory/2224-144-0x0000000000000000-mapping.dmp

Download
memory/2228-179-0x0000000000000000-mapping.dmp

Download
memory/2252-154-0x0000000000000000-mapping.dmp

Download
memory/2328-142-0x0000000000000000-mapping.dmp

Download
memory/2380-135-0x0000000000000000-mapping.dmp

Download
memory/2400-136-0x0000000000000000-mapping.dmp

Download
memory/2496-137-0x0000000000000000-mapping.dmp

Download
memory/2556-155-0x0000000000000000-mapping.dmp

Download
memory/2640-148-0x0000000000000000-mapping.dmp

Download
memory/2656-177-0x0000000000000000-mapping.dmp

Download
memory/2672-210-0x0000000000000000-mapping.dmp

Download
memory/2740-174-0x0000000000000000-mapping.dmp

Download
memory/2764-152-0x0000000000000000-mapping.dmp

Download
memory/2920-156-0x0000000000000000-mapping.dmp

Download
memory/3104-168-0x0000000000000000-mapping.dmp

Download
memory/3112-145-0x0000000000000000-mapping.dmp

Download
memory/3116-181-0x0000000000000000-mapping.dmp

Download
memory/3260-166-0x0000000000000000-mapping.dmp

Download
memory/3324-124-0x0000000000000000-mapping.dmp

Download
memory/3608-157-0x0000000000000000-mapping.dmp

Download
memory/3728-160-0x0000000000000000-mapping.dmp

Download
memory/3732-161-0x0000000000000000-mapping.dmp

Download
memory/3912-125-0x0000000000000000-mapping.dmp

Download
memory/3984-173-0x0000000000000000-mapping.dmp

Download
memory/4044-163-0x0000000000000000-mapping.dmp

Download
memory/4060-127-0x0000000000000000-mapping.dmp

Download
memory/4116-162-0x0000000000000000-mapping.dmp

Download
memory/4200-120-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/4200-121-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/4200-118-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/4232-138-0x0000000000000000-mapping.dmp

Download
memory/4260-139-0x0000000000000000-mapping.dmp

Download
memory/4272-176-0x0000000000000000-mapping.dmp

Download
memory/4308-126-0x0000000000000000-mapping.dmp

Download
memory/4448-165-0x0000000000000000-mapping.dmp

Download
memory/4468-122-0x0000000000000000-mapping.dmp

Download
memory/4620-146-0x0000000000000000-mapping.dmp

Download
memory/4688-143-0x0000000000000000-mapping.dmp

Download
memory/4716-180-0x0000000000000000-mapping.dmp

Download
memory/4796-149-0x0000000000000000-mapping.dmp

Download
memory/4980-178-0x0000000000000000-mapping.dmp

Download
memory/5000-140-0x0000000000000000-mapping.dmp

Download
memory/5048-141-0x0000000000000000-mapping.dmp

Download