Resubmissions
04-11-2021 15:34
211104-sz21psghe5 1029-10-2021 15:29
211029-swzq6saccp 1029-10-2021 07:07
211029-hxtanshefl 8Analysis
-
max time kernel
300s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
04-11-2021 15:34
Static task
static1
Behavioral task
behavioral1
Sample
Worker-1.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Worker-1.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
Worker-1.exe
-
Size
385KB
-
MD5
7677a593678d9c4552578fab18a27384
-
SHA1
5c3b0d278df728c67122ac3ab7184c3f9ebfaa4f
-
SHA256
2c6802679ce8ac5ed90bd25d25805e284c7dd5269f7805c68cc5fd965a0adc21
-
SHA512
8bbce3eefabf7e7d900ba3fa0a42ca3be265425c8b5675e27839a1397d1653ae54e3abbd8a6b0b8ff7ab44d130afb1a81d04d57af42dc45e7227d676a335e082
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Downloads PsExec from SysInternals website 1 IoCs
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.
description flow ioc HTTP URL 15 http://live.sysinternals.com/PsExec.exe -
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\CheckpointUnpublish.tif.v4cnyy Worker-1.exe File renamed C:\Users\Admin\Pictures\InstallLock.crw => C:\Users\Admin\Pictures\InstallLock.crw.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\SearchUndo.tiff Worker-1.exe File renamed C:\Users\Admin\Pictures\SearchUndo.tiff => C:\Users\Admin\Pictures\SearchUndo.tiff.v4cnyy Worker-1.exe File renamed C:\Users\Admin\Pictures\TraceCopy.png => C:\Users\Admin\Pictures\TraceCopy.png.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\TraceCopy.png.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\WaitRedo.tif.v4cnyy Worker-1.exe File renamed C:\Users\Admin\Pictures\CheckpointUnpublish.tif => C:\Users\Admin\Pictures\CheckpointUnpublish.tif.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\InstallLock.crw.v4cnyy Worker-1.exe File renamed C:\Users\Admin\Pictures\InvokeWrite.tif => C:\Users\Admin\Pictures\InvokeWrite.tif.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\InvokeWrite.tif.v4cnyy Worker-1.exe File opened for modification C:\Users\Admin\Pictures\SearchUndo.tiff.v4cnyy Worker-1.exe File renamed C:\Users\Admin\Pictures\WaitRedo.tif => C:\Users\Admin\Pictures\WaitRedo.tif.v4cnyy Worker-1.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Worker-1.exe File opened (read-only) \??\S: Worker-1.exe File opened (read-only) \??\F: Worker-1.exe File opened (read-only) \??\L: Worker-1.exe File opened (read-only) \??\N: Worker-1.exe File opened (read-only) \??\I: Worker-1.exe File opened (read-only) \??\O: Worker-1.exe File opened (read-only) \??\A: Worker-1.exe File opened (read-only) \??\H: Worker-1.exe File opened (read-only) \??\J: Worker-1.exe File opened (read-only) \??\K: Worker-1.exe File opened (read-only) \??\Z: Worker-1.exe File opened (read-only) \??\X: Worker-1.exe File opened (read-only) \??\Q: Worker-1.exe File opened (read-only) \??\B: Worker-1.exe File opened (read-only) \??\E: Worker-1.exe File opened (read-only) \??\R: Worker-1.exe File opened (read-only) \??\T: Worker-1.exe File opened (read-only) \??\W: Worker-1.exe File opened (read-only) \??\U: Worker-1.exe File opened (read-only) \??\G: Worker-1.exe File opened (read-only) \??\V: Worker-1.exe File opened (read-only) \??\M: Worker-1.exe File opened (read-only) \??\Y: Worker-1.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 icanhazip.com -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Внимание Внимание Внимание!!!" Worker-1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Добрый день. У Вас возникли сложности на работе? \r\nНе стоит переживать, наши IT-специалисты помогут Вам.\r\nДля этого напишите пожалуйста нам на почту.\r\n\r\nНаш email - [email protected]\r\n\r\nХорошего и продуктивного дня!" Worker-1.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 58 IoCs
pid Process 1960 taskkill.exe 1884 taskkill.exe 1168 taskkill.exe 832 taskkill.exe 752 taskkill.exe 952 taskkill.exe 2012 taskkill.exe 960 taskkill.exe 1432 taskkill.exe 1064 taskkill.exe 396 taskkill.exe 1696 taskkill.exe 1364 taskkill.exe 1596 taskkill.exe 1972 taskkill.exe 1984 taskkill.exe 1476 taskkill.exe 1672 taskkill.exe 888 taskkill.exe 1432 taskkill.exe 1572 taskkill.exe 1040 taskkill.exe 1300 taskkill.exe 1916 taskkill.exe 832 taskkill.exe 1920 taskkill.exe 1928 taskkill.exe 916 taskkill.exe 396 taskkill.exe 1612 taskkill.exe 904 taskkill.exe 828 taskkill.exe 812 taskkill.exe 432 taskkill.exe 1900 taskkill.exe 1836 taskkill.exe 1300 taskkill.exe 1128 taskkill.exe 1864 taskkill.exe 1268 taskkill.exe 1600 taskkill.exe 1728 taskkill.exe 1048 taskkill.exe 1720 taskkill.exe 1984 taskkill.exe 1528 taskkill.exe 756 taskkill.exe 852 taskkill.exe 904 taskkill.exe 1756 taskkill.exe 1916 taskkill.exe 1476 taskkill.exe 1832 taskkill.exe 1640 taskkill.exe 1920 taskkill.exe 1904 taskkill.exe 1720 taskkill.exe 1076 taskkill.exe -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_Classes\Local Settings splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" splwow64.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1256 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe 524 Worker-1.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeDebugPrivilege 524 Worker-1.exe Token: SeDebugPrivilege 524 Worker-1.exe Token: SeDebugPrivilege 1128 taskkill.exe Token: SeDebugPrivilege 1600 taskkill.exe Token: SeDebugPrivilege 2012 taskkill.exe Token: SeDebugPrivilege 1864 taskkill.exe Token: SeDebugPrivilege 828 taskkill.exe Token: SeDebugPrivilege 1612 taskkill.exe Token: SeDebugPrivilege 1720 taskkill.exe Token: SeDebugPrivilege 904 taskkill.exe Token: SeDebugPrivilege 1920 taskkill.exe Token: SeDebugPrivilege 1756 taskkill.exe Token: SeDebugPrivilege 888 taskkill.exe Token: SeDebugPrivilege 1432 taskkill.exe Token: SeDebugPrivilege 960 taskkill.exe Token: SeDebugPrivilege 812 taskkill.exe Token: SeDebugPrivilege 1048 taskkill.exe Token: SeDebugPrivilege 1364 taskkill.exe Token: SeDebugPrivilege 1960 taskkill.exe Token: SeDebugPrivilege 396 taskkill.exe Token: SeDebugPrivilege 916 taskkill.exe Token: SeDebugPrivilege 1728 taskkill.exe Token: SeDebugPrivilege 1972 taskkill.exe Token: SeDebugPrivilege 1884 taskkill.exe Token: SeDebugPrivilege 432 taskkill.exe Token: SeDebugPrivilege 1696 taskkill.exe Token: SeDebugPrivilege 1476 taskkill.exe Token: SeDebugPrivilege 1596 taskkill.exe Token: SeDebugPrivilege 832 taskkill.exe Token: SeDebugPrivilege 1168 taskkill.exe Token: SeDebugPrivilege 1984 taskkill.exe Token: SeDebugPrivilege 1900 taskkill.exe Token: SeDebugPrivilege 752 taskkill.exe Token: SeDebugPrivilege 1928 taskkill.exe Token: SeDebugPrivilege 1300 taskkill.exe Token: SeDebugPrivilege 1640 taskkill.exe Token: SeDebugPrivilege 1832 taskkill.exe Token: SeDebugPrivilege 1268 taskkill.exe Token: SeDebugPrivilege 1572 taskkill.exe Token: SeDebugPrivilege 1836 taskkill.exe Token: SeDebugPrivilege 852 taskkill.exe Token: SeDebugPrivilege 832 taskkill.exe Token: SeDebugPrivilege 1476 taskkill.exe Token: SeDebugPrivilege 1300 taskkill.exe Token: SeDebugPrivilege 1528 taskkill.exe Token: SeDebugPrivilege 952 taskkill.exe Token: SeDebugPrivilege 1672 taskkill.exe Token: SeDebugPrivilege 1432 taskkill.exe Token: SeDebugPrivilege 904 taskkill.exe Token: SeDebugPrivilege 396 taskkill.exe Token: SeDebugPrivilege 1920 taskkill.exe Token: SeDebugPrivilege 1076 taskkill.exe Token: SeDebugPrivilege 1040 taskkill.exe Token: SeDebugPrivilege 756 taskkill.exe Token: SeDebugPrivilege 1904 taskkill.exe Token: SeDebugPrivilege 1720 taskkill.exe Token: SeDebugPrivilege 1984 taskkill.exe Token: SeDebugPrivilege 1972 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 524 Worker-1.exe 524 Worker-1.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 524 Worker-1.exe 524 Worker-1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1980 splwow64.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 524 wrote to memory of 1128 524 Worker-1.exe 29 PID 524 wrote to memory of 1128 524 Worker-1.exe 29 PID 524 wrote to memory of 1128 524 Worker-1.exe 29 PID 524 wrote to memory of 1128 524 Worker-1.exe 29 PID 524 wrote to memory of 956 524 Worker-1.exe 31 PID 524 wrote to memory of 956 524 Worker-1.exe 31 PID 524 wrote to memory of 956 524 Worker-1.exe 31 PID 524 wrote to memory of 956 524 Worker-1.exe 31 PID 524 wrote to memory of 1256 524 Worker-1.exe 33 PID 524 wrote to memory of 1256 524 Worker-1.exe 33 PID 524 wrote to memory of 1256 524 Worker-1.exe 33 PID 524 wrote to memory of 1256 524 Worker-1.exe 33 PID 524 wrote to memory of 1120 524 Worker-1.exe 35 PID 524 wrote to memory of 1120 524 Worker-1.exe 35 PID 524 wrote to memory of 1120 524 Worker-1.exe 35 PID 524 wrote to memory of 1120 524 Worker-1.exe 35 PID 524 wrote to memory of 1212 524 Worker-1.exe 37 PID 524 wrote to memory of 1212 524 Worker-1.exe 37 PID 524 wrote to memory of 1212 524 Worker-1.exe 37 PID 524 wrote to memory of 1212 524 Worker-1.exe 37 PID 524 wrote to memory of 1268 524 Worker-1.exe 38 PID 524 wrote to memory of 1268 524 Worker-1.exe 38 PID 524 wrote to memory of 1268 524 Worker-1.exe 38 PID 524 wrote to memory of 1268 524 Worker-1.exe 38 PID 524 wrote to memory of 1920 524 Worker-1.exe 40 PID 524 wrote to memory of 1920 524 Worker-1.exe 40 PID 524 wrote to memory of 1920 524 Worker-1.exe 40 PID 524 wrote to memory of 1920 524 Worker-1.exe 40 PID 524 wrote to memory of 1884 524 Worker-1.exe 42 PID 524 wrote to memory of 1884 524 Worker-1.exe 42 PID 524 wrote to memory of 1884 524 Worker-1.exe 42 PID 524 wrote to memory of 1884 524 Worker-1.exe 42 PID 524 wrote to memory of 1732 524 Worker-1.exe 45 PID 524 wrote to memory of 1732 524 Worker-1.exe 45 PID 524 wrote to memory of 1732 524 Worker-1.exe 45 PID 524 wrote to memory of 1732 524 Worker-1.exe 45 PID 524 wrote to memory of 572 524 Worker-1.exe 47 PID 524 wrote to memory of 572 524 Worker-1.exe 47 PID 524 wrote to memory of 572 524 Worker-1.exe 47 PID 524 wrote to memory of 572 524 Worker-1.exe 47 PID 524 wrote to memory of 852 524 Worker-1.exe 48 PID 524 wrote to memory of 852 524 Worker-1.exe 48 PID 524 wrote to memory of 852 524 Worker-1.exe 48 PID 524 wrote to memory of 852 524 Worker-1.exe 48 PID 524 wrote to memory of 980 524 Worker-1.exe 51 PID 524 wrote to memory of 980 524 Worker-1.exe 51 PID 524 wrote to memory of 980 524 Worker-1.exe 51 PID 524 wrote to memory of 980 524 Worker-1.exe 51 PID 524 wrote to memory of 1912 524 Worker-1.exe 53 PID 524 wrote to memory of 1912 524 Worker-1.exe 53 PID 524 wrote to memory of 1912 524 Worker-1.exe 53 PID 524 wrote to memory of 1912 524 Worker-1.exe 53 PID 524 wrote to memory of 1600 524 Worker-1.exe 55 PID 524 wrote to memory of 1600 524 Worker-1.exe 55 PID 524 wrote to memory of 1600 524 Worker-1.exe 55 PID 524 wrote to memory of 1600 524 Worker-1.exe 55 PID 524 wrote to memory of 2012 524 Worker-1.exe 56 PID 524 wrote to memory of 2012 524 Worker-1.exe 56 PID 524 wrote to memory of 2012 524 Worker-1.exe 56 PID 524 wrote to memory of 2012 524 Worker-1.exe 56 PID 524 wrote to memory of 1864 524 Worker-1.exe 58 PID 524 wrote to memory of 1864 524 Worker-1.exe 58 PID 524 wrote to memory of 1864 524 Worker-1.exe 58 PID 524 wrote to memory of 1864 524 Worker-1.exe 58 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" Worker-1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Внимание Внимание Внимание!!!" Worker-1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Добрый день. У Вас возникли сложности на работе? \r\nНе стоит переживать, наши IT-специалисты помогут Вам.\r\nДля этого напишите пожалуйста нам на почту.\r\n\r\nНаш email - [email protected]\r\n\r\nХорошего и продуктивного дня!" Worker-1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1" Worker-1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Worker-1.exe"C:\Users\Admin\AppData\Local\Temp\Worker-1.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:524 -
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM RaccineSettings.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1128
-
-
C:\Windows\SysWOW64\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F2⤵PID:956
-
-
C:\Windows\SysWOW64\reg.exe"reg" delete HKCU\Software\Raccine /F2⤵
- Modifies registry key
PID:1256
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F2⤵PID:1120
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵PID:1212
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config Dnscache start= auto2⤵PID:1268
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵PID:1920
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config FDResPub start= auto2⤵PID:1884
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SSDPSRV start= auto2⤵PID:1732
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵PID:572
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SstpSvc start= disabled2⤵PID:852
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLWriter start= disabled2⤵PID:980
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config upnphost start= auto2⤵PID:1912
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:828
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:904
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:812
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
PID:1916
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:916
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:1064
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:832
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:752
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
PID:1916
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:832
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ragent.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqld.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM rmngr.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysql.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:904
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM rphost.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM vmwp.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sql.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM oracle.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM 1cv8.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵PID:1464
-
-
C:\Windows\SysWOW64\arp.exe"arp" -a2⤵PID:1120
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin2⤵PID:1520
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵PID:752
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵PID:1732
-
-
C:\Windows\SysWOW64\arp.exe"arp" -a2⤵PID:1640
-
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\-Инструкция.txt2⤵PID:1292
-
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1980
-