Analysis
-
max time kernel
170s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
31-01-2022 23:06
Static task
static1
Behavioral task
behavioral1
Sample
9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe
Resource
win10v2004-en-20220112
General
-
Target
9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe
-
Size
199KB
-
MD5
39c2a62f7024297c25f9a7b4157aba4c
-
SHA1
30c5c20fbfbd60442b963109ab257ee1969f7f88
-
SHA256
9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2
-
SHA512
502ef61a42a3575227284dcb43b2936772de9f97bec98345f0b9c93ae66c861d451440a07d8f86fb3130d499dc5bc56d3c5398c38346e6b3aa3c7614d9069236
Malware Config
Extracted
C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
1MYNpqa9CKnjvcvxd25iB7qxxeZbfWsBzP
Signatures
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Sets service image path in registry 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exedescription pid process target process PID 3800 set thread context of 3896 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 224 taskkill.exe 1876 taskkill.exe 2808 taskkill.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 3504 notepad.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exepid process 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe Token: SeDebugPrivilege 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe Token: SeDebugPrivilege 224 taskkill.exe Token: SeDebugPrivilege 1876 taskkill.exe Token: SeDebugPrivilege 2808 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3800 wrote to memory of 3600 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 3600 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 3600 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 1288 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 1288 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 1288 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 3896 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 3896 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 3896 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 3896 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 3896 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 3896 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 3896 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3800 wrote to memory of 3896 3800 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe PID 3896 wrote to memory of 3872 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 3896 wrote to memory of 3872 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 3896 wrote to memory of 3872 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 3872 wrote to memory of 2516 3872 net.exe net1.exe PID 3872 wrote to memory of 2516 3872 net.exe net1.exe PID 3872 wrote to memory of 2516 3872 net.exe net1.exe PID 3896 wrote to memory of 1840 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 3896 wrote to memory of 1840 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 3896 wrote to memory of 1840 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 1840 wrote to memory of 2132 1840 net.exe net1.exe PID 1840 wrote to memory of 2132 1840 net.exe net1.exe PID 1840 wrote to memory of 2132 1840 net.exe net1.exe PID 3896 wrote to memory of 4088 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 3896 wrote to memory of 4088 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 3896 wrote to memory of 4088 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 4088 wrote to memory of 3360 4088 net.exe net1.exe PID 4088 wrote to memory of 3360 4088 net.exe net1.exe PID 4088 wrote to memory of 3360 4088 net.exe net1.exe PID 3896 wrote to memory of 1244 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 3896 wrote to memory of 1244 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 3896 wrote to memory of 1244 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 1244 wrote to memory of 1248 1244 net.exe net1.exe PID 1244 wrote to memory of 1248 1244 net.exe net1.exe PID 1244 wrote to memory of 1248 1244 net.exe net1.exe PID 3896 wrote to memory of 1632 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 3896 wrote to memory of 1632 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 3896 wrote to memory of 1632 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe net.exe PID 1632 wrote to memory of 3436 1632 net.exe net1.exe PID 1632 wrote to memory of 3436 1632 net.exe net1.exe PID 1632 wrote to memory of 3436 1632 net.exe net1.exe PID 3896 wrote to memory of 3468 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 3468 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 3468 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 912 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 912 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 912 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 3952 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 3952 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 3952 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 2744 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 2744 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 2744 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe sc.exe PID 3896 wrote to memory of 224 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe taskkill.exe PID 3896 wrote to memory of 224 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe taskkill.exe PID 3896 wrote to memory of 224 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe taskkill.exe PID 3896 wrote to memory of 1876 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe taskkill.exe PID 3896 wrote to memory of 1876 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe taskkill.exe PID 3896 wrote to memory of 1876 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe taskkill.exe PID 3896 wrote to memory of 2808 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe taskkill.exe PID 3896 wrote to memory of 2808 3896 9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe"C:\Users\Admin\AppData\Local\Temp\9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe"C:\Users\Admin\AppData\Local\Temp\9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe"2⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe"C:\Users\Admin\AppData\Local\Temp\9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe"2⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe"C:\Users\Admin\AppData\Local\Temp\9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\net.exe"net.exe" stop avpsus /y3⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop avpsus /y4⤵PID:2516
-
C:\Windows\SysWOW64\net.exe"net.exe" stop McAfeeDLPAgentService /y3⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeDLPAgentService /y4⤵PID:2132
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mfewc /y3⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfewc /y4⤵PID:3360
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BMR Boot Service /y3⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BMR Boot Service /y4⤵PID:1248
-
C:\Windows\SysWOW64\net.exe"net.exe" stop NetBackup BMR MTFTP Service /y3⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y4⤵PID:3436
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY start= disabled3⤵PID:3468
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled3⤵PID:912
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLWriter start= disabled3⤵PID:3952
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SstpSvc start= disabled3⤵PID:2744
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:224 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1876 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt3⤵
- Opens file in notepad (likely ransom note)
PID:3504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe3⤵PID:3924
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵PID:2304
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 81bf57d6effcaa8c73fc8e38da33526d Uw/7oEepo0arbvGyPr1SyQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3968
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9784148014987a39d87265c015962e9535ed86e861093a6c59691095a19be7c2.exe.logMD5
fb3264819f05b468156e37fecd7ca1e7
SHA18461be627ec2c21766472ac5a9215204f6cd03d6
SHA256902e22368b4d29d67c78eb445d67c7e36001a79c7701a1e171a9c7af457a739c
SHA512ddcb2a199799dc30a5627d6bb2aff30aca350b52e15f574ecc9e9e9e4d388fd1fe808b5fd2a8ea7015c91e369a06f045be455bf070c6d20d8c3b1c06de8ef964
-
memory/3800-130-0x0000000000D30000-0x0000000000D68000-memory.dmpFilesize
224KB
-
memory/3800-131-0x000000000DA10000-0x000000000DFB4000-memory.dmpFilesize
5.6MB
-
memory/3800-132-0x000000000D500000-0x000000000D592000-memory.dmpFilesize
584KB
-
memory/3800-133-0x0000000004990000-0x0000000004C50000-memory.dmpFilesize
2.8MB
-
memory/3800-134-0x000000000D4B0000-0x000000000D4BA000-memory.dmpFilesize
40KB
-
memory/3800-135-0x000000000D710000-0x000000000D786000-memory.dmpFilesize
472KB
-
memory/3800-259-0x00000000008C0000-0x00000000008DE000-memory.dmpFilesize
120KB
-
memory/3896-260-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3896-261-0x0000000004960000-0x0000000004971000-memory.dmpFilesize
68KB