Resubmissions
04-11-2021 15:34
211104-sz21psghe5 1029-10-2021 15:29
211029-swzq6saccp 1029-10-2021 07:07
211029-hxtanshefl 8Analysis
-
max time kernel
300s -
max time network
302s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-10-2021 15:29
Static task
static1
Behavioral task
behavioral1
Sample
Worker-1.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Worker-1.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
Worker-1.exe
-
Size
385KB
-
MD5
7677a593678d9c4552578fab18a27384
-
SHA1
5c3b0d278df728c67122ac3ab7184c3f9ebfaa4f
-
SHA256
2c6802679ce8ac5ed90bd25d25805e284c7dd5269f7805c68cc5fd965a0adc21
-
SHA512
8bbce3eefabf7e7d900ba3fa0a42ca3be265425c8b5675e27839a1397d1653ae54e3abbd8a6b0b8ff7ab44d130afb1a81d04d57af42dc45e7227d676a335e082
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Downloads PsExec from SysInternals website 1 IoCs
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.
description flow ioc HTTP URL 15 http://live.sysinternals.com/PsExec.exe -
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\CheckpointOpen.crw.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\SelectUnprotect.raw.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\ApproveSearch.tiff Worker-1.exe File renamed C:\Users\Admin\Pictures\ApproveSearch.tiff => C:\Users\Admin\Pictures\ApproveSearch.tiff.v4cnyy Worker-1.exe File renamed C:\Users\Admin\Pictures\SelectUnprotect.raw => C:\Users\Admin\Pictures\SelectUnprotect.raw.v4cnyy Worker-1.exe File renamed C:\Users\Admin\Pictures\UpdateEdit.crw => C:\Users\Admin\Pictures\UpdateEdit.crw.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\ConvertFromWrite.raw.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\RenameRedo.png.v4cnyy Worker-1.exe File renamed C:\Users\Admin\Pictures\ConvertFromWrite.raw => C:\Users\Admin\Pictures\ConvertFromWrite.raw.v4cnyy Worker-1.exe File renamed C:\Users\Admin\Pictures\UnprotectResolve.raw => C:\Users\Admin\Pictures\UnprotectResolve.raw.v4cnyy Worker-1.exe File renamed C:\Users\Admin\Pictures\RenameRedo.png => C:\Users\Admin\Pictures\RenameRedo.png.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\UnprotectResolve.raw.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\UpdateEdit.crw.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\ApproveSearch.tiff.v4cnyy Worker-1.exe File renamed C:\Users\Admin\Pictures\CheckpointOpen.crw => C:\Users\Admin\Pictures\CheckpointOpen.crw.v4cnyy Worker-1.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Worker-1.exe File opened (read-only) \??\I: Worker-1.exe File opened (read-only) \??\P: Worker-1.exe File opened (read-only) \??\F: Worker-1.exe File opened (read-only) \??\G: Worker-1.exe File opened (read-only) \??\K: Worker-1.exe File opened (read-only) \??\Z: Worker-1.exe File opened (read-only) \??\Q: Worker-1.exe File opened (read-only) \??\W: Worker-1.exe File opened (read-only) \??\U: Worker-1.exe File opened (read-only) \??\J: Worker-1.exe File opened (read-only) \??\V: Worker-1.exe File opened (read-only) \??\Y: Worker-1.exe File opened (read-only) \??\A: Worker-1.exe File opened (read-only) \??\H: Worker-1.exe File opened (read-only) \??\L: Worker-1.exe File opened (read-only) \??\X: Worker-1.exe File opened (read-only) \??\R: Worker-1.exe File opened (read-only) \??\T: Worker-1.exe File opened (read-only) \??\O: Worker-1.exe File opened (read-only) \??\S: Worker-1.exe File opened (read-only) \??\B: Worker-1.exe File opened (read-only) \??\N: Worker-1.exe File opened (read-only) \??\M: Worker-1.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 icanhazip.com -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Внимание Внимание Внимание!!!" Worker-1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Добрый день. У Вас возникли сложности на работе? \r\nНе стоит переживать, наши IT-специалисты помогут Вам.\r\nДля этого напишите пожалуйста нам на почту.\r\n\r\nНаш email - [email protected]\r\n\r\nХорошего и продуктивного дня!" Worker-1.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 58 IoCs
pid Process 1072 taskkill.exe 1824 taskkill.exe 1512 taskkill.exe 752 taskkill.exe 1708 taskkill.exe 1876 taskkill.exe 1732 taskkill.exe 1748 taskkill.exe 1412 taskkill.exe 960 taskkill.exe 1384 taskkill.exe 976 taskkill.exe 1544 taskkill.exe 1572 taskkill.exe 1748 taskkill.exe 1628 taskkill.exe 888 taskkill.exe 1968 taskkill.exe 852 taskkill.exe 1996 taskkill.exe 1972 taskkill.exe 108 taskkill.exe 1880 taskkill.exe 1192 taskkill.exe 1948 taskkill.exe 784 taskkill.exe 1676 taskkill.exe 1672 taskkill.exe 1400 taskkill.exe 1128 taskkill.exe 1736 taskkill.exe 436 taskkill.exe 1628 taskkill.exe 988 taskkill.exe 1168 taskkill.exe 1936 taskkill.exe 1196 taskkill.exe 576 taskkill.exe 484 taskkill.exe 1952 taskkill.exe 1208 taskkill.exe 1288 taskkill.exe 376 taskkill.exe 1820 taskkill.exe 1616 taskkill.exe 1740 taskkill.exe 1344 taskkill.exe 1384 taskkill.exe 1924 taskkill.exe 1560 taskkill.exe 984 taskkill.exe 1168 taskkill.exe 1192 taskkill.exe 1536 taskkill.exe 1072 taskkill.exe 364 taskkill.exe 368 taskkill.exe 548 taskkill.exe -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_Classes\Local Settings splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU splwow64.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" splwow64.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1988 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe 1564 Worker-1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 560 splwow64.exe -
Suspicious use of AdjustPrivilegeToken 59 IoCs
description pid Process Token: SeDebugPrivilege 1564 Worker-1.exe Token: SeDebugPrivilege 1564 Worker-1.exe Token: SeDebugPrivilege 960 taskkill.exe Token: SeDebugPrivilege 1616 taskkill.exe Token: SeDebugPrivilege 1384 taskkill.exe Token: SeDebugPrivilege 1628 taskkill.exe Token: SeDebugPrivilege 1732 taskkill.exe Token: SeDebugPrivilege 1072 taskkill.exe Token: SeDebugPrivilege 1748 taskkill.exe Token: SeDebugPrivilege 1676 taskkill.exe Token: SeDebugPrivilege 1996 taskkill.exe Token: SeDebugPrivilege 1168 taskkill.exe Token: SeDebugPrivilege 364 taskkill.exe Token: SeDebugPrivilege 1128 taskkill.exe Token: SeDebugPrivilege 888 taskkill.exe Token: SeDebugPrivilege 1544 taskkill.exe Token: SeDebugPrivilege 1412 taskkill.exe Token: SeDebugPrivilege 576 taskkill.exe Token: SeDebugPrivilege 1708 taskkill.exe Token: SeDebugPrivilege 1952 taskkill.exe Token: SeDebugPrivilege 1192 taskkill.exe Token: SeDebugPrivilege 1968 taskkill.exe Token: SeDebugPrivilege 1972 taskkill.exe Token: SeDebugPrivilege 368 taskkill.exe Token: SeDebugPrivilege 108 taskkill.exe Token: SeDebugPrivilege 1824 taskkill.exe Token: SeDebugPrivilege 1948 taskkill.exe Token: SeDebugPrivilege 1572 taskkill.exe Token: SeDebugPrivilege 484 taskkill.exe Token: SeDebugPrivilege 548 taskkill.exe Token: SeDebugPrivilege 1876 taskkill.exe Token: SeDebugPrivilege 752 taskkill.exe Token: SeDebugPrivilege 1192 taskkill.exe Token: SeDebugPrivilege 1208 taskkill.exe Token: SeDebugPrivilege 1536 taskkill.exe Token: SeDebugPrivilege 1628 taskkill.exe Token: SeDebugPrivilege 784 taskkill.exe Token: SeDebugPrivilege 1748 taskkill.exe Token: SeDebugPrivilege 1072 taskkill.exe Token: SeDebugPrivilege 1880 taskkill.exe Token: SeDebugPrivilege 988 taskkill.exe Token: SeDebugPrivilege 852 taskkill.exe Token: SeDebugPrivilege 1288 taskkill.exe Token: SeDebugPrivilege 1672 taskkill.exe Token: SeDebugPrivilege 1736 taskkill.exe Token: SeDebugPrivilege 1384 taskkill.exe Token: SeDebugPrivilege 984 taskkill.exe Token: SeDebugPrivilege 1740 taskkill.exe Token: SeDebugPrivilege 1924 taskkill.exe Token: SeDebugPrivilege 1168 taskkill.exe Token: SeDebugPrivilege 1344 taskkill.exe Token: SeDebugPrivilege 1936 taskkill.exe Token: SeDebugPrivilege 976 taskkill.exe Token: SeDebugPrivilege 1400 taskkill.exe Token: SeDebugPrivilege 436 taskkill.exe Token: SeDebugPrivilege 376 taskkill.exe Token: SeDebugPrivilege 1560 taskkill.exe Token: SeDebugPrivilege 1820 taskkill.exe Token: SeDebugPrivilege 1624 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1564 Worker-1.exe 1564 Worker-1.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1564 Worker-1.exe 1564 Worker-1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 560 splwow64.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1564 wrote to memory of 960 1564 Worker-1.exe 29 PID 1564 wrote to memory of 960 1564 Worker-1.exe 29 PID 1564 wrote to memory of 960 1564 Worker-1.exe 29 PID 1564 wrote to memory of 960 1564 Worker-1.exe 29 PID 1564 wrote to memory of 752 1564 Worker-1.exe 31 PID 1564 wrote to memory of 752 1564 Worker-1.exe 31 PID 1564 wrote to memory of 752 1564 Worker-1.exe 31 PID 1564 wrote to memory of 752 1564 Worker-1.exe 31 PID 1564 wrote to memory of 1988 1564 Worker-1.exe 33 PID 1564 wrote to memory of 1988 1564 Worker-1.exe 33 PID 1564 wrote to memory of 1988 1564 Worker-1.exe 33 PID 1564 wrote to memory of 1988 1564 Worker-1.exe 33 PID 1564 wrote to memory of 1344 1564 Worker-1.exe 35 PID 1564 wrote to memory of 1344 1564 Worker-1.exe 35 PID 1564 wrote to memory of 1344 1564 Worker-1.exe 35 PID 1564 wrote to memory of 1344 1564 Worker-1.exe 35 PID 1564 wrote to memory of 1560 1564 Worker-1.exe 37 PID 1564 wrote to memory of 1560 1564 Worker-1.exe 37 PID 1564 wrote to memory of 1560 1564 Worker-1.exe 37 PID 1564 wrote to memory of 1560 1564 Worker-1.exe 37 PID 1564 wrote to memory of 988 1564 Worker-1.exe 38 PID 1564 wrote to memory of 988 1564 Worker-1.exe 38 PID 1564 wrote to memory of 988 1564 Worker-1.exe 38 PID 1564 wrote to memory of 988 1564 Worker-1.exe 38 PID 1564 wrote to memory of 984 1564 Worker-1.exe 45 PID 1564 wrote to memory of 984 1564 Worker-1.exe 45 PID 1564 wrote to memory of 984 1564 Worker-1.exe 45 PID 1564 wrote to memory of 984 1564 Worker-1.exe 45 PID 1564 wrote to memory of 2004 1564 Worker-1.exe 41 PID 1564 wrote to memory of 2004 1564 Worker-1.exe 41 PID 1564 wrote to memory of 2004 1564 Worker-1.exe 41 PID 1564 wrote to memory of 2004 1564 Worker-1.exe 41 PID 1564 wrote to memory of 548 1564 Worker-1.exe 42 PID 1564 wrote to memory of 548 1564 Worker-1.exe 42 PID 1564 wrote to memory of 548 1564 Worker-1.exe 42 PID 1564 wrote to memory of 548 1564 Worker-1.exe 42 PID 1564 wrote to memory of 2000 1564 Worker-1.exe 46 PID 1564 wrote to memory of 2000 1564 Worker-1.exe 46 PID 1564 wrote to memory of 2000 1564 Worker-1.exe 46 PID 1564 wrote to memory of 2000 1564 Worker-1.exe 46 PID 1564 wrote to memory of 1876 1564 Worker-1.exe 50 PID 1564 wrote to memory of 1876 1564 Worker-1.exe 50 PID 1564 wrote to memory of 1876 1564 Worker-1.exe 50 PID 1564 wrote to memory of 1876 1564 Worker-1.exe 50 PID 1564 wrote to memory of 884 1564 Worker-1.exe 51 PID 1564 wrote to memory of 884 1564 Worker-1.exe 51 PID 1564 wrote to memory of 884 1564 Worker-1.exe 51 PID 1564 wrote to memory of 884 1564 Worker-1.exe 51 PID 1564 wrote to memory of 976 1564 Worker-1.exe 52 PID 1564 wrote to memory of 976 1564 Worker-1.exe 52 PID 1564 wrote to memory of 976 1564 Worker-1.exe 52 PID 1564 wrote to memory of 976 1564 Worker-1.exe 52 PID 1564 wrote to memory of 1196 1564 Worker-1.exe 55 PID 1564 wrote to memory of 1196 1564 Worker-1.exe 55 PID 1564 wrote to memory of 1196 1564 Worker-1.exe 55 PID 1564 wrote to memory of 1196 1564 Worker-1.exe 55 PID 1564 wrote to memory of 1616 1564 Worker-1.exe 57 PID 1564 wrote to memory of 1616 1564 Worker-1.exe 57 PID 1564 wrote to memory of 1616 1564 Worker-1.exe 57 PID 1564 wrote to memory of 1616 1564 Worker-1.exe 57 PID 1564 wrote to memory of 1384 1564 Worker-1.exe 58 PID 1564 wrote to memory of 1384 1564 Worker-1.exe 58 PID 1564 wrote to memory of 1384 1564 Worker-1.exe 58 PID 1564 wrote to memory of 1384 1564 Worker-1.exe 58 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Внимание Внимание Внимание!!!" Worker-1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Добрый день. У Вас возникли сложности на работе? \r\nНе стоит переживать, наши IT-специалисты помогут Вам.\r\nДля этого напишите пожалуйста нам на почту.\r\n\r\nНаш email - [email protected]\r\n\r\nХорошего и продуктивного дня!" Worker-1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1" Worker-1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" Worker-1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Worker-1.exe"C:\Users\Admin\AppData\Local\Temp\Worker-1.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1564 -
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM RaccineSettings.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
C:\Windows\SysWOW64\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F2⤵PID:752
-
-
C:\Windows\SysWOW64\reg.exe"reg" delete HKCU\Software\Raccine /F2⤵
- Modifies registry key
PID:1988
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F2⤵PID:1344
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config Dnscache start= auto2⤵PID:1560
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵PID:988
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵PID:2004
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵PID:548
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config FDResPub start= auto2⤵PID:984
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SSDPSRV start= auto2⤵PID:2000
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SstpSvc start= disabled2⤵PID:1876
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLWriter start= disabled2⤵PID:884
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config upnphost start= auto2⤵PID:976
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
PID:1196
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:364
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1128
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:576
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵PID:748
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
C:\Windows\SysWOW64\arp.exe"arp" -a2⤵PID:1292
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:368
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:108
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:1512
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:484
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:752
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1208
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:784
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:988
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ragent.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM rmngr.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM rphost.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM 1cv8.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sql.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:976
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqld.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysql.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:436
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM oracle.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM vmwp.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin2⤵PID:1744
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵PID:1076
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵PID:1900
-
-
C:\Windows\SysWOW64\arp.exe"arp" -a2⤵PID:1672
-
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\-Инструкция.txt2⤵PID:1772
-
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:560
-