32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6

Resubmissions

29-10-2021 12:12

211029-pdkbzsaaap 10

Analysis

max time kernel
121s
max time network
122s
platform
windows10_x64
resource
win10-en-20211014
submitted
29-10-2021 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Size

152KB
MD5

af9622a8b6a46866f00f9ff35b7f16b6
SHA1

6a81a6e01f502cdb5893d423417bde2448882ac2
SHA256

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6
SHA512

e4effba4959ff985bd63cd0f533c368c88370a25c90eef5e9bef82eab101d2ea1a2bbd33aad1da3cb629b894c2777c8f6c35fd6729b65b8580c54f90a13fb2c2

Score

10^/10

evasion persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note

YOUR COMPANY WAS HACKED AND COMPROMISED!!! All your important files have been encrypted! Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. ____________________________________________________________________________________ For us this is just business and to prove to you our seriousness, we will decrypt you three files for free. Just open our website, upload the encrypted files and get the decrypted files for free. ____________________________________________________________________________________ ! WARNING ! Whole your network was fully COMPROMISED! We has DOWNLOADED of your PRIVATE SENSITIVE Data, including your Billing info, Insuranse cases, Financial reports, Business audit, Banking Accounts! Also we have corporate correspondence, information about your clients. We got even more info about your partners and even about your staff. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. ____________________________________________________________________________________ IF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. YOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. ____________________________________________________________________________________ WE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR ENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES GOOD SUPPORT. Instructions for contacting us: ____________________________________________________________________________________ You have way: 1) Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ and paste it in the Tor browser. c. Start a chat and follow the further instructions. Key Identifier: OP71GCyZOMla9HT5d8QZ+8HB8kJCHcC7RgLNtCyg/YO0bYBHd4cFD3tUkwUUtcSdZdMt+1RIh22h6aV2WArroVxTZmwpDp5NHUsC4A1AN9OnDe8vHnlqG0uDo6/J0wBqfPONAWHS6FI9eZcF/SpeOfMP7NRlpdALukvX6c/MUPFmsjrj3kpyzhOS0Bc8Z1ofSuSSXBldqo7A+pHXGWwxYhO8/O9/ZBNUhUsdKE5DuhfNj3Wn9UFzMQY2UbkNb5XXHtqcwuhnXdamEJQIJEhaMj1ivRjO+SVvR8A8vLh1eVavPpUZulmuGe00UqwJ0glLMwnibk/4kNo+++YQlbysdAIBE/q6LH8Xo/83cOs0fEw93IgGqi9OkT2fhN02ZnYMbaeqifdbqvBlAOj6RlxsGpCJv3Mw3Vx3d0wUAgfdNOCfQ49A3lti/ahxDcVEIcf1QYtevL3amoCm9Mi9bfGZq8LcBdkRqDfM0cCTGKAr8n3huUWduE7l+zuPDN4nNM7CA3BRoYCcm3JUGqKsNbc34tVOIMxzNWMPPnaTXQgx4sFVvZvnQghUO1b9ZJvDuddn2taLH/FOdQsXST46MzSufr11tMHcBIXrbjESRmKG6H1RiUH1ZTsB7nmYcboKuvehJfk8CCZFTklTpN1Nx/WJtij0jhxJns+fWKx+s5BU5Xw=

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Ransom Note

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ

Signatures

Downloads MZ/PE file
Downloads PsExec from SysInternals website 1 IoCs
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

Processes:

description flow ioc

HTTP URL 28 http://live.sysinternals.com/PsExec.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

description	flow	ioc
HTTP URL	28	http://live.sysinternals.com/PsExec.exe

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\DisablePop.tiff.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File renamed	C:\Users\Admin\Pictures\SetRename.png => C:\Users\Admin\Pictures\SetRename.png.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File renamed	C:\Users\Admin\Pictures\WriteRevoke.crw => C:\Users\Admin\Pictures\WriteRevoke.crw.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\WriteRevoke.crw.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\UnlockUnregister.png.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\DisablePop.tiff	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File renamed	C:\Users\Admin\Pictures\DisablePop.tiff => C:\Users\Admin\Pictures\DisablePop.tiff.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\SetRename.png.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File renamed	C:\Users\Admin\Pictures\UnlockUnregister.png => C:\Users\Admin\Pictures\UnlockUnregister.png.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Drops startup file 1 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	process
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	process
File opened (read-only)	\??\R:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\T:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\Y:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\G:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\Q:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\I:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\H:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\N:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\V:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\U:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\O:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\P:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\S:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\F:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\J:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\X:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\M:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\W:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\E:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\A:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\K:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\L:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\Z:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\B:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Drops file in Windows directory 13 IoCs

Processes:

netsh.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3623239459\11870838.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2483382631\1144272743.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4272278488\927794230.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4183903823\1195458082.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1301087654\4010849688.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1476457207\263943467.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2878165772\3312292840.pri	netsh.exe
File created	C:\Windows\rescache\_merged\423379043\2764571712.pri	netsh.exe
File created	C:\Windows\rescache\_merged\81479705\2284120958.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3418783148\4223189797.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1601268389\3068621934.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4185669309\1880392806.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1974107395\1506172464.pri	netsh.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
400	taskkill.exe
1216	taskkill.exe
948	taskkill.exe
2940	taskkill.exe
1860	taskkill.exe
2336	taskkill.exe
2840	taskkill.exe
1708	taskkill.exe
1100	taskkill.exe
2348	taskkill.exe
1876	taskkill.exe
660	taskkill.exe
3376	taskkill.exe
3560	taskkill.exe
1300	taskkill.exe
2364	taskkill.exe
984	taskkill.exe
1420	taskkill.exe
3208	taskkill.exe
3960	taskkill.exe
1600	taskkill.exe
2944	taskkill.exe
2144	taskkill.exe
3568	taskkill.exe
4048	taskkill.exe
3212	taskkill.exe
2816	taskkill.exe
3180	taskkill.exe
1192	taskkill.exe
1604	taskkill.exe
1048	taskkill.exe
2596	taskkill.exe
3872	taskkill.exe
900	taskkill.exe
3852	taskkill.exe
2264	taskkill.exe
1196	taskkill.exe
3928	taskkill.exe
1928	taskkill.exe
676	taskkill.exe
436	taskkill.exe
316	taskkill.exe
2152	taskkill.exe
3792	taskkill.exe
3856	taskkill.exe
3140	taskkill.exe
1248	taskkill.exe
836	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1756 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1248 PING.EXE

pid	process
1756	reg.exe

pid	process
1248	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

pid	process
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Token: SeDebugPrivilege	3872	taskkill.exe
Token: SeDebugPrivilege	948	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	1876	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	900	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	3792	taskkill.exe
Token: SeDebugPrivilege	3568	taskkill.exe
Token: SeDebugPrivilege	3856	taskkill.exe
Token: SeDebugPrivilege	4048	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	660	taskkill.exe
Token: SeDebugPrivilege	984	taskkill.exe
Token: SeDebugPrivilege	1420	taskkill.exe
Token: SeDebugPrivilege	676	taskkill.exe
Token: SeDebugPrivilege	436	taskkill.exe
Token: SeDebugPrivilege	316	taskkill.exe
Token: SeDebugPrivilege	1860	taskkill.exe
Token: SeDebugPrivilege	1604	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	2336	taskkill.exe
Token: SeDebugPrivilege	2840	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	3140	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	3376	taskkill.exe
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	1248	taskkill.exe
Token: SeDebugPrivilege	3560	taskkill.exe
Token: SeDebugPrivilege	3212	taskkill.exe
Token: SeDebugPrivilege	1048	taskkill.exe
Token: SeDebugPrivilege	1196	taskkill.exe
Token: SeDebugPrivilege	2816	taskkill.exe
Token: SeDebugPrivilege	400	taskkill.exe
Token: SeDebugPrivilege	3180	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	836	taskkill.exe
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeDebugPrivilege	4020	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

pid	process
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

pid	process
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	pid	process	target process
PID 2664 wrote to memory of 3872	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 3872	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 3872	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 1012	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	reg.exe
PID 2664 wrote to memory of 1012	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	reg.exe
PID 2664 wrote to memory of 1012	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	reg.exe
PID 2664 wrote to memory of 1756	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	reg.exe
PID 2664 wrote to memory of 1756	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	reg.exe
PID 2664 wrote to memory of 1756	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	reg.exe
PID 2664 wrote to memory of 3036	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	schtasks.exe
PID 2664 wrote to memory of 3036	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	schtasks.exe
PID 2664 wrote to memory of 3036	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	schtasks.exe
PID 2664 wrote to memory of 700	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	netsh.exe
PID 2664 wrote to memory of 700	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	netsh.exe
PID 2664 wrote to memory of 700	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	netsh.exe
PID 2664 wrote to memory of 3076	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 3076	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 3076	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 800	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 800	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 800	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 3960	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 3960	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 3960	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 1072	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 1072	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 1072	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 396	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 396	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 396	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 1248	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 1248	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 1248	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 3560	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 3560	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 3560	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 1208	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 1208	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 1208	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	sc.exe
PID 2664 wrote to memory of 948	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 948	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 948	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2364	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2364	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2364	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2348	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2348	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2348	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 1876	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 1876	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 1876	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2144	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2144	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2144	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2940	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2940	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 2940	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 3928	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 3928	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 3928	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 900	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 900	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 900	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe
PID 2664 wrote to memory of 1928	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	taskkill.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

C:\Users\Admin\AppData\Local\Temp\32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
"C:\Users\Admin\AppData\Local\Temp\32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2664
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\SysWOW64\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:1012
- C:\Windows\SysWOW64\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:1756
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:3036
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  - Drops file in Windows directory
  PID:700
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:3076
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:800
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:3960
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:1072
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:396
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:1248
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:3560
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:1208
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1876
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1928
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3792
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  PID:1192
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3852
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:660
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:316
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3140
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3960
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3560
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:1600
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:836
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:3128
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Windows\SysWOW64\arp.exe
  "arp" -a
  2⤵
  PID:2136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:1188
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:588
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:3056
- C:\Windows\SysWOW64\arp.exe
  "arp" -a
  2⤵
  PID:3068
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
  2⤵
  PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:1248
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5
937b18d0aee63e8640a54a67c50d98bf

SHA1
e7e5c80c7dbfc287351cd72539fbe7108d6f9c62

SHA256
5cf6e73cae3dcd00143d230860eec5f9a3dadcda37c753862ee99554a8b1ed09

SHA512
da9d0f071bbdec6c20448a980a7fc067fe22b3942bee47fbefec9ad07a78a9dc6e1c2b6c9317906b930b0f890c61a4d9567dd9da9028d7244b7254e8f6c17b6c

Download Submit
memory/316-153-0x0000000000000000-mapping.dmp

Download
memory/396-129-0x0000000000000000-mapping.dmp

Download
memory/400-171-0x0000000000000000-mapping.dmp

Download
memory/436-152-0x0000000000000000-mapping.dmp

Download
memory/660-148-0x0000000000000000-mapping.dmp

Download
memory/676-151-0x0000000000000000-mapping.dmp

Download
memory/700-124-0x0000000000000000-mapping.dmp

Download
memory/800-126-0x0000000000000000-mapping.dmp

Download
memory/836-175-0x0000000000000000-mapping.dmp

Download
memory/900-140-0x0000000000000000-mapping.dmp

Download
memory/948-133-0x0000000000000000-mapping.dmp

Download
memory/984-149-0x0000000000000000-mapping.dmp

Download
memory/1012-121-0x0000000000000000-mapping.dmp

Download
memory/1048-168-0x0000000000000000-mapping.dmp

Download
memory/1072-128-0x0000000000000000-mapping.dmp

Download
memory/1100-180-0x0000000000000000-mapping.dmp

Download
memory/1188-209-0x0000000000000000-mapping.dmp

Download
memory/1192-144-0x0000000000000000-mapping.dmp

Download
memory/1196-169-0x0000000000000000-mapping.dmp

Download
memory/1208-132-0x0000000000000000-mapping.dmp

Download
memory/1216-174-0x0000000000000000-mapping.dmp

Download
memory/1248-164-0x0000000000000000-mapping.dmp

Download
memory/1248-130-0x0000000000000000-mapping.dmp

Download
memory/1300-176-0x0000000000000000-mapping.dmp

Download
memory/1420-150-0x0000000000000000-mapping.dmp

Download
memory/1600-172-0x0000000000000000-mapping.dmp

Download
memory/1604-155-0x0000000000000000-mapping.dmp

Download
memory/1708-160-0x0000000000000000-mapping.dmp

Download
memory/1756-122-0x0000000000000000-mapping.dmp

Download
memory/1860-154-0x0000000000000000-mapping.dmp

Download
memory/1876-136-0x0000000000000000-mapping.dmp

Download
memory/1928-141-0x0000000000000000-mapping.dmp

Download
memory/2136-186-0x0000000000000000-mapping.dmp

Download
memory/2144-137-0x0000000000000000-mapping.dmp

Download
memory/2152-159-0x0000000000000000-mapping.dmp

Download
memory/2264-156-0x0000000000000000-mapping.dmp

Download
memory/2336-157-0x0000000000000000-mapping.dmp

Download
memory/2348-135-0x0000000000000000-mapping.dmp

Download
memory/2364-134-0x0000000000000000-mapping.dmp

Download
memory/2596-177-0x0000000000000000-mapping.dmp

Download
memory/2664-115-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2664-119-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/2664-210-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Filesize
4KB

Download
memory/2664-118-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/2664-117-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/2816-170-0x0000000000000000-mapping.dmp

Download
memory/2840-158-0x0000000000000000-mapping.dmp

Download
memory/2940-138-0x0000000000000000-mapping.dmp

Download
memory/2944-178-0x0000000000000000-mapping.dmp

Download
memory/3036-123-0x0000000000000000-mapping.dmp

Download
memory/3076-125-0x0000000000000000-mapping.dmp

Download
memory/3128-179-0x0000000000000000-mapping.dmp

Download
memory/3140-161-0x0000000000000000-mapping.dmp

Download
memory/3180-173-0x0000000000000000-mapping.dmp

Download
memory/3208-162-0x0000000000000000-mapping.dmp

Download
memory/3212-167-0x0000000000000000-mapping.dmp

Download
memory/3376-163-0x0000000000000000-mapping.dmp

Download
memory/3560-166-0x0000000000000000-mapping.dmp

Download
memory/3560-131-0x0000000000000000-mapping.dmp

Download
memory/3568-143-0x0000000000000000-mapping.dmp

Download
memory/3792-142-0x0000000000000000-mapping.dmp

Download
memory/3852-147-0x0000000000000000-mapping.dmp

Download
memory/3856-145-0x0000000000000000-mapping.dmp

Download
memory/3872-120-0x0000000000000000-mapping.dmp

Download
memory/3928-139-0x0000000000000000-mapping.dmp

Download
memory/3960-165-0x0000000000000000-mapping.dmp

Download
memory/3960-127-0x0000000000000000-mapping.dmp

Download
memory/4020-192-0x0000000007FC0000-0x0000000007FC1000-memory.dmp

Filesize
4KB

Download
memory/4020-182-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/4020-194-0x0000000008700000-0x0000000008701000-memory.dmp

Filesize
4KB

Download
memory/4020-195-0x0000000008650000-0x0000000008651000-memory.dmp

Filesize
4KB

Download
memory/4020-188-0x0000000007052000-0x0000000007053000-memory.dmp

Filesize
4KB

Download
memory/4020-189-0x00000000075C0000-0x00000000075C1000-memory.dmp

Filesize
4KB

Download
memory/4020-190-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Filesize
4KB

Download
memory/4020-183-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/4020-193-0x0000000007D60000-0x0000000007D61000-memory.dmp

Filesize
4KB

Download
memory/4020-185-0x0000000007690000-0x0000000007691000-memory.dmp

Filesize
4KB

Download
memory/4020-187-0x0000000007050000-0x0000000007051000-memory.dmp

Filesize
4KB

Download
memory/4020-196-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/4020-206-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/4020-207-0x0000000007053000-0x0000000007054000-memory.dmp

Filesize
4KB

Download
memory/4020-208-0x0000000007054000-0x0000000007056000-memory.dmp

Filesize
8KB

Download
memory/4020-181-0x0000000000000000-mapping.dmp

Download
memory/4020-184-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/4048-146-0x0000000000000000-mapping.dmp

Download