44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b

Analysis

max time kernel
300s
max time network
308s
platform
windows7_x64
resource
win7-en-20210920
submitted
02-11-2021 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
Size

149KB
MD5

4e68455c60c1aa59b0c28808d6445e50
SHA1

7f58174891abc9b764d5cdd010078f107c1febb5
SHA256

44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b
SHA512

3c0b92f3b567e4652f39d1bd71bfe630933af00a6d39cb0911e30915d34a00dac345d5042877237d849375855f22ead11d8c583495f3823b45cfbaef87ef5f69

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note

YOUR COMPANY WAS HACKED AND COMPROMISED!!! All your important files have been encrypted! Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. ____________________________________________________________________________________ For us this is just business and to prove to you our seriousness, we will decrypt you three files for free. Just open our website, upload the encrypted files and get the decrypted files for free. ____________________________________________________________________________________ ! WARNING ! Whole your network was fully COMPROMISED! We has DOWNLOADED of your PRIVATE SENSITIVE Data, including your Billing info, Insuranse cases, Financial reports, Business audit, Banking Accounts! Also we have corporate correspondence, information about your clients. We got even more info about your partners and even about your staff. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. ____________________________________________________________________________________ IF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. YOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. ____________________________________________________________________________________ WE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR ENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES GOOD SUPPORT. Instructions for contacting us: ____________________________________________________________________________________ You have way: 1) Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5 and paste it in the Tor browser. c. Start a chat and follow the further instructions. Key Identifier: D2AAj+s5W4PKTyeqWF5fCVNR+HSsbukNuKDsw0Q8WYss2/wRmA2xy8hqEK4KQ69tJPD+ur0PevwBPXrFu1QX9A4TnoWc/4TvyCrwW54ktl6UzafShJh7wY1RytMw4has4tTxk9CkbZ1D7KRuByAIxh8HXxTJYzq/DyGdQF8AR5gfJEyXOLJX276SOK182t7lhNTua7vYYn0CyzfBevQEpIaBo/Jinr+LQWpObR+/SDrE14Y8VWdGhDzOGcHAPTyzTPkOsXrHYi3HLndgbN7eOL4UA+Xs1K2alCFBDBBCsbyGQl0vdc+MAQ7lAKY3svFeg4OGtn8pBfto3v4pwvVGAVgNnE2XaWP4sD9UTctdKM9LKx1NEXRkfT29ZYajsLbjswmcWWIH+f7v5F9qwBU2wlDJ5Xxc21vjbxNNAsW4GKQzmZreY2NpgdeVQKbyJceXw20JLsIxAhpWovR0Jv6VayimBmWzpTINtn65Bs5wsublHlTf7rNLEutHFsVF0LhODcTYpw+MFALF3DiCh/lF8o/PEcU4rOwIk3ZvIq0P+wwaX/0RHbmfg41kckRnfPMre6KtYgbhXdtcHh67uZXClzoZM74HdFv7DzmhUw2B+J+QRHykSCeLIiePORy3n3XGkiDPtviICymRIUKupNr0Twy9f930W2bHtPQZsv6fgmU=

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Ransom Note

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note

URLs

http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5

Signatures

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\SuspendConvert.tiff.NMU7PHR3V5	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
File opened for modification	C:\Users\Admin\Pictures\OpenAdd.tiff	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
File opened for modification	C:\Users\Admin\Pictures\OpenAdd.tiff.NMU7PHR3V5	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
File renamed	C:\Users\Admin\Pictures\PingBlock.png => C:\Users\Admin\Pictures\PingBlock.png.NMU7PHR3V5	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
File opened for modification	C:\Users\Admin\Pictures\PingBlock.png.NMU7PHR3V5	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
File renamed	C:\Users\Admin\Pictures\SuspendConvert.tiff => C:\Users\Admin\Pictures\SuspendConvert.tiff.NMU7PHR3V5	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
File renamed	C:\Users\Admin\Pictures\OpenAdd.tiff => C:\Users\Admin\Pictures\OpenAdd.tiff.NMU7PHR3V5	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
File renamed	C:\Users\Admin\Pictures\OpenNew.png => C:\Users\Admin\Pictures\OpenNew.png.NMU7PHR3V5	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
File opened for modification	C:\Users\Admin\Pictures\OpenNew.png.NMU7PHR3V5	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
File opened for modification	C:\Users\Admin\Pictures\SuspendConvert.tiff	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

956 cmd.exe

pid	process
956	cmd.exe

Drops startup file 1 IoCs

Processes:

44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!"	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1856	taskkill.exe
1188	taskkill.exe
1812	taskkill.exe
1216	taskkill.exe
1008	taskkill.exe
1288	taskkill.exe
1008	taskkill.exe
536	taskkill.exe
1652	taskkill.exe
1504	taskkill.exe
1300	taskkill.exe
1764	taskkill.exe
1624	taskkill.exe
628	taskkill.exe
1796	taskkill.exe
1488	taskkill.exe
616	taskkill.exe
1148	taskkill.exe
936	taskkill.exe
1716	taskkill.exe
1660	taskkill.exe
992	taskkill.exe
1880	taskkill.exe
640	taskkill.exe
956	taskkill.exe
1676	taskkill.exe
1104	taskkill.exe
616	taskkill.exe
1640	taskkill.exe
1852	taskkill.exe
1484	taskkill.exe
1792	taskkill.exe
1644	taskkill.exe
1272	taskkill.exe
1864	taskkill.exe
288	taskkill.exe
1084	taskkill.exe
1168	taskkill.exe
1132	taskkill.exe
1076	taskkill.exe
1592	taskkill.exe
1204	taskkill.exe
1808	taskkill.exe
1620	taskkill.exe
1940	taskkill.exe
1448	taskkill.exe
1776	taskkill.exe
904	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1676 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1664 PING.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
1676	reg.exe

pid	process
1664	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

pid	process
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	1640	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	1104	taskkill.exe
Token: SeDebugPrivilege	1188	taskkill.exe
Token: SeDebugPrivilege	992	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	288	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	616	taskkill.exe
Token: SeDebugPrivilege	1084	taskkill.exe
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	1852	taskkill.exe
Token: SeDebugPrivilege	1624	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	1288	taskkill.exe
Token: SeDebugPrivilege	1008	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	536	taskkill.exe
Token: SeDebugPrivilege	1644	taskkill.exe
Token: SeDebugPrivilege	1168	taskkill.exe
Token: SeDebugPrivilege	1448	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	1488	taskkill.exe
Token: SeDebugPrivilege	1132	taskkill.exe
Token: SeDebugPrivilege	1592	taskkill.exe
Token: SeDebugPrivilege	1792	taskkill.exe
Token: SeDebugPrivilege	1204	taskkill.exe
Token: SeDebugPrivilege	904	taskkill.exe
Token: SeDebugPrivilege	956	taskkill.exe
Token: SeDebugPrivilege	616	taskkill.exe
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	1008	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	936	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	628	taskkill.exe
Token: SeDebugPrivilege	1796	taskkill.exe
Token: SeDebugPrivilege	1660	taskkill.exe
Token: SeDebugPrivilege	1076	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

pid	process
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

pid	process
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

description	pid	process	target process
PID 1988 wrote to memory of 1808	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1808	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1808	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1808	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1296	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	reg.exe
PID 1988 wrote to memory of 1296	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	reg.exe
PID 1988 wrote to memory of 1296	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	reg.exe
PID 1988 wrote to memory of 1296	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	reg.exe
PID 1988 wrote to memory of 1676	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	reg.exe
PID 1988 wrote to memory of 1676	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	reg.exe
PID 1988 wrote to memory of 1676	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	reg.exe
PID 1988 wrote to memory of 1676	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	reg.exe
PID 1988 wrote to memory of 1672	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	schtasks.exe
PID 1988 wrote to memory of 1672	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	schtasks.exe
PID 1988 wrote to memory of 1672	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	schtasks.exe
PID 1988 wrote to memory of 1672	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	schtasks.exe
PID 1988 wrote to memory of 1932	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1932	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1932	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1932	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1552	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1552	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1552	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1552	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1660	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1660	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1660	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1660	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1848	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1848	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1848	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1848	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1080	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1080	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1080	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1080	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1892	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1892	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1892	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1892	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1148	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1148	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1148	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1148	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1836	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1836	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1836	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1836	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	sc.exe
PID 1988 wrote to memory of 1640	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1640	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1640	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1640	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1856	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1856	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1856	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1856	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1620	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1620	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1620	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1620	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1652	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1652	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1652	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe
PID 1988 wrote to memory of 1652	1988	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe	taskkill.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY WAS HACKED AND COMPROMISED!!!"	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\nWe has DOWNLOADED of your PRIVATE SENSITIVE Data!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe

C:\Users\Admin\AppData\Local\Temp\44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
"C:\Users\Admin\AppData\Local\Temp\44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1988
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\SysWOW64\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:1296
- C:\Windows\SysWOW64\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:1676
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:1672
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:1932
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:1552
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:1660
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:1848
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:1080
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:1148
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:1892
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:1836
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  PID:1856
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:288
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  PID:616
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1880
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1288
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  PID:1008
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:1272
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  PID:1076
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1132
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1592
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:956
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:616
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1148
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1716
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:1736
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
  2⤵
  - Modifies Internet Explorer settings
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:1932
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:1664
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\44edca2989cfa4ba819191b70323fe5f83e300dd0c2e66abb42f1f9ca831f29b.exe
  2⤵
  - Deletes itself
  PID:956
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5
84d8d5e54106af4ece5c9986804e5e60

SHA1
786a01cbfe56b7e3287a87a66f3ff47523156bde

SHA256
d8cb7f551067270474df1cef476cb748a425d1aed51eadb04dccaf7f54ee7d87

SHA512
d596c9fb9279e80b88ab86f209599cbf3c0f192f079f693bfbd3c83f7e620da3485859ceb7fb5901ab30bd2ff996f29efb4c409449c08924a1937c3f25ffd909

Download Submit
memory/288-78-0x0000000000000000-mapping.dmp

Download
memory/536-91-0x0000000000000000-mapping.dmp

Download
memory/616-106-0x0000000000000000-mapping.dmp

Download
memory/616-82-0x0000000000000000-mapping.dmp

Download
memory/628-113-0x0000000000000000-mapping.dmp

Download
memory/640-90-0x0000000000000000-mapping.dmp

Download
memory/904-104-0x0000000000000000-mapping.dmp

Download
memory/936-110-0x0000000000000000-mapping.dmp

Download
memory/956-105-0x0000000000000000-mapping.dmp

Download
memory/992-77-0x0000000000000000-mapping.dmp

Download
memory/1008-108-0x0000000000000000-mapping.dmp

Download
memory/1008-88-0x0000000000000000-mapping.dmp

Download
memory/1076-118-0x0000000002410000-0x000000000305A000-memory.dmp

Filesize
12.3MB

Download
memory/1076-120-0x0000000002410000-0x000000000305A000-memory.dmp

Filesize
12.3MB

Download
memory/1076-98-0x0000000000000000-mapping.dmp

Download
memory/1076-116-0x0000000000000000-mapping.dmp

Download
memory/1076-117-0x00000000751D1000-0x00000000751D3000-memory.dmp

Filesize
8KB

Download
memory/1076-119-0x0000000002410000-0x000000000305A000-memory.dmp

Filesize
12.3MB

Download
memory/1080-65-0x0000000000000000-mapping.dmp

Download
memory/1084-81-0x0000000000000000-mapping.dmp

Download
memory/1104-75-0x0000000000000000-mapping.dmp

Download
memory/1132-100-0x0000000000000000-mapping.dmp

Download
memory/1148-67-0x0000000000000000-mapping.dmp

Download
memory/1148-107-0x0000000000000000-mapping.dmp

Download
memory/1168-92-0x0000000000000000-mapping.dmp

Download
memory/1188-76-0x0000000000000000-mapping.dmp

Download
memory/1204-103-0x0000000000000000-mapping.dmp

Download
memory/1216-96-0x0000000000000000-mapping.dmp

Download
memory/1272-95-0x0000000000000000-mapping.dmp

Download
memory/1288-87-0x0000000000000000-mapping.dmp

Download
memory/1296-58-0x0000000000000000-mapping.dmp

Download
memory/1300-73-0x0000000000000000-mapping.dmp

Download
memory/1448-93-0x0000000000000000-mapping.dmp

Download
memory/1484-94-0x0000000000000000-mapping.dmp

Download
memory/1488-99-0x0000000000000000-mapping.dmp

Download
memory/1504-74-0x0000000000000000-mapping.dmp

Download
memory/1552-62-0x0000000000000000-mapping.dmp

Download
memory/1592-101-0x0000000000000000-mapping.dmp

Download
memory/1620-71-0x0000000000000000-mapping.dmp

Download
memory/1624-85-0x0000000000000000-mapping.dmp

Download
memory/1640-69-0x0000000000000000-mapping.dmp

Download
memory/1644-89-0x0000000000000000-mapping.dmp

Download
memory/1652-72-0x0000000000000000-mapping.dmp

Download
memory/1660-115-0x0000000000000000-mapping.dmp

Download
memory/1660-63-0x0000000000000000-mapping.dmp

Download
memory/1664-125-0x0000000000000000-mapping.dmp

Download
memory/1672-60-0x0000000000000000-mapping.dmp

Download
memory/1676-109-0x0000000000000000-mapping.dmp

Download
memory/1676-59-0x0000000000000000-mapping.dmp

Download
memory/1716-111-0x0000000000000000-mapping.dmp

Download
memory/1736-121-0x0000000000000000-mapping.dmp

Download
memory/1764-80-0x0000000000000000-mapping.dmp

Download
memory/1776-97-0x0000000000000000-mapping.dmp

Download
memory/1792-102-0x0000000000000000-mapping.dmp

Download
memory/1796-114-0x0000000000000000-mapping.dmp

Download
memory/1808-57-0x0000000000000000-mapping.dmp

Download
memory/1812-79-0x0000000000000000-mapping.dmp

Download
memory/1836-68-0x0000000000000000-mapping.dmp

Download
memory/1848-64-0x0000000000000000-mapping.dmp

Download
memory/1852-84-0x0000000000000000-mapping.dmp

Download
memory/1856-70-0x0000000000000000-mapping.dmp

Download
memory/1864-112-0x0000000000000000-mapping.dmp

Download
memory/1880-86-0x0000000000000000-mapping.dmp

Download
memory/1892-66-0x0000000000000000-mapping.dmp

Download
memory/1928-122-0x0000000000000000-mapping.dmp

Download
memory/1932-61-0x0000000000000000-mapping.dmp

Download
memory/1932-123-0x0000000000000000-mapping.dmp

Download
memory/1940-83-0x0000000000000000-mapping.dmp

Download
memory/1988-54-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/1988-56-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download