prometheus | 8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7

Resubmissions

16-03-2022 13:15

220316-qg979accak 10

12-05-2021 00:06

210512-y1glnyls5e 10

Analysis

max time kernel
161s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
16-03-2022 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1f063d6_by_Libranalysis.exe
Size

142KB
MD5

e1f063d63a75e0e0e864052b1a50ab06
SHA1

75d941a28cf0ade2ef2c16dfacbdeb36a51ccaf7
SHA256

8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7
SHA512

25681b210ee18bd60ba3fef496769283d51dc516569e1f1834d6d23a5927c1684b25ff67baf5fba66c908b364a13784f49facdde7a98b2fb8a8a41a2ec792ae3

Score

10^/10

prometheus evasion persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Family

prometheus

Ransom Note

YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: ____________________________________________________________________________________ You have two ways: 1) [Recommended] Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454 and paste it in the Tor browser. c. Start a chat and follow the further instructions. 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a. Open your any browser (Chrome, Firefox, Opera, IE, Edge) b. Open our secondary website: http://prometheusdec.in/ticket.php?track=141-5D9-Y454 c. Start a chat and follow the further instructions. Warning: secondary website can be blocked, thats why first variant much better and more available. _____________________________________________________________________________________ Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: GUKJXatSriaFNhgKe8BhXbGoqEpBejeOnRf+F2LJUziCzXzkVE3cxLzpkRH9qVLquZH4qOQ52A/ntx+CxEElPiGmf5IN/cltsDPCJhj3/Sl4deLq5mMuj6dsveytl08qKLYOk/Lwc1ftProHpna7MaqqqzXnXGkNMOBxyUO6o/j+kM8Ob9rcFRaT/YFiyu8yNZUNH4T+T4DzSo/9TArg/VOlSKaSH4/Kw82z2ryzWBq5BiuXlMnJ1Ftbq4keSAYZpdeDqlw0uRNu4gd8ETQM7B3xxqAfq35WmH2QjxVlm0jQ2RgWgZ8OrYlIODPoHktUhIoh/PZmun1hFhVmcOn4JIef/ZGhwylabphA4qTs21uPk4wLhJfTIQYu5RdFAT7xdqNbCUJBRq9OMt0nonuT6Ci0GC3QSNZ7Z4HR/7T6ZeL9U0zmVVxshAHcZee0a/QfMlDTaQ+/LnIKnxXqHrAD5aFqJqMB2dMQVMmhrVJs+7SwazKkP8MNuoa5ZcqY/uLEjYCr+gyhKZwa+g4xeBE1otniC7FJ4gjMCI6v/2N1P0XQo3vNfQHcEsw5oMcMKAyr58lIrrcHMMZFmMz6AfGycL/9/0fusXM3/iMHnCXadioenbDA4ZU8aYMAX+EV0KF9FB9Xql4kaKvYiPIaZveofMLxDpWy+ehgbsCol3Ck7ng=

URLs

http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454

http://prometheusdec.in/ticket.php?track=141-5D9-Y454

Signatures

Prometheus Ransomware
Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.
ransomware prometheus
Downloads MZ/PE file
Downloads PsExec from SysInternals website 1 IoCs
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

Processes:

description flow ioc

HTTP URL 59 http://live.sysinternals.com/PsExec64.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

description	flow	ioc
HTTP URL	59	http://live.sysinternals.com/PsExec64.exe

Drops startup file 1 IoCs

Processes:

e1f063d6_by_Libranalysis.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	e1f063d6_by_Libranalysis.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

e1f063d6_by_Libranalysis.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY NETWORK HAS BEEN HACKED"	e1f063d6_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	e1f063d6_by_Libranalysis.exe

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{19338C14-AA5B-45D4-BA73-AACE6DAE1338}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{82126E39-3469-4973-B21B-3EA49B73EB14}.catalogItem	svchost.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4492	taskkill.exe
3316	taskkill.exe
3048	taskkill.exe
4348	taskkill.exe
3944	taskkill.exe
3128	taskkill.exe
3296	taskkill.exe
408	taskkill.exe
384	taskkill.exe
2316	taskkill.exe
4176	taskkill.exe
4616	taskkill.exe
1344	taskkill.exe
3572	taskkill.exe
1076	taskkill.exe
3272	taskkill.exe
3084	taskkill.exe
1640	taskkill.exe
4592	taskkill.exe
636	taskkill.exe
4376	taskkill.exe
3464	taskkill.exe
1832	taskkill.exe
5036	taskkill.exe
4736	taskkill.exe
3040	taskkill.exe
4124	taskkill.exe
3184	taskkill.exe
688	taskkill.exe
2656	taskkill.exe
3156	taskkill.exe
4136	taskkill.exe
2700	taskkill.exe
3724	taskkill.exe
5024	taskkill.exe
2344	taskkill.exe
3912	taskkill.exe
2352	taskkill.exe
1484	taskkill.exe
2432	taskkill.exe
2940	taskkill.exe
4132	taskkill.exe
684	taskkill.exe
4268	taskkill.exe
4264	taskkill.exe
2672	taskkill.exe
4496	taskkill.exe
3900	taskkill.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00188006A74949CB = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e0000000002000000000010660000000100002000000052567a497c86ae6aeb64994399f2c2b639e7386653b5cac8beb0bdecf05a9235000000000e8000000002000020000000d8fee3ab78a1d8da29f33a3f2761a5ba93e095c171a7f8174d6bb3c921da5a27800000001de06c7a5487ca814d892ba6b708a75a3f5df573a197e9e7370e3d900abbba9af42fee44fa1401764a68482cc0eb5c9c1c3e373d6b60a04a2dee29a0538719ce2449c3d32df8e9a9c4e81bf0fd49442139132353a222eb58edde9a377e4cc02669d3e4fc4be041bf1bc6f99f3fe8eed31d574ff63c6ca4308b6e8a5a689cfbb840000000f72c56568079a3a92445988b2fbf2a0bbc49dda57d24726b581fdc1ffe049ef53570d500624502cacac7a5f117f99ec2d6bb345886dd8b4d7dcc7aea6c3f8c70	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000003c07a5ba841367b061b1dd2ef2f2485e4e3cfe32a674248a4785b9f32dddb24b000000000e8000000002000020000000b7b498a1de01157c53f0e9cfd9cc09a807df8676ae371733ff928f5a5b1302a7100d00008cf791ca5aa14ee7f3873f7128baf318281ecb2e360952ceba56f93b1fc46c8ddbc63394a7df726441cb1b462765a30ca267aa30471a5b384fe76e3f2eb66c8a2a30f03adc3285189694e2d54941ad61672af8056b1ba397d9ebd2dcc0f56965ab4890e8331f6843497e2aea1e13044257016df8688b511cf41954ea45402d2f41f567038259d89a86d49afca7e9249f584b1c46883518f069c1709e6abd0966242883bd2656b4f33fa4a60a480c715e0111a269da73ed1d171d8c53ed6d281a4b59b57dafefab09578f42c298124689e47bb15a8d829de41643a5606de6333c782b0f761ccff9ad10da18baf578d62dc50f01fbd580f602fea4d9852c859b00448b8c4d7cee58b34abc5eaa6d8a6098fa430c141c2d9c332fdd9accf077ba5125747ef7288c3b7b0b4ae4b38e7bd709b0c7deaf2090dd233a6ccfdef9b802d49abf0ab88def49b9b2be0f4b594b7698bbcdb548e368a2b73e758fe48dcaa54f353eceeceaa7289937b56070f67872f784e4d022d090c0d40ff07e21e43636b6195b06e1fb873f85d75300bbd4ca0d1d71bd8af1d0b82f64eaef65ec611daa0247bfed14894125f3bf7fd461477229514afb03145a4be0cd13821becc3f254a494a4f2bb00e573f797c6e32b6fa02e892b8e8e69ee2eb17d98ed15715da7ff223752ef9736ed5ea2eea31012aae85ab696bf80f92a5cd09a57f39ee1f6905365f1a93596b4c486a3e9b501384d9221f79dd1f2a7c876a66c029405bbb2e7eb98ba53a407fefd3eeb3315d687a0570356cfe88b19c6e197a9c6985c43e1aa59fa4cd83948a2c4f0bb0011a67c58f99967cd79c647532a3c93b907167af0d3653b12811eea8703018228a2152ffeaa1fa8af32805223520bd17636840f33310a526af4c4c05b39c9686e597ef3b2067bebd4154d7ae8a541e1437b84da3289320536e5c9e0286637e1f6063e711f597dc61caba85865b20ad8677db32d9ec2e5d148024070842b62f65c8a9adae1e355bd713f1ff6ea5730c0aaa19598045bf8503b8bb3b085d4c713a13cc155595978ff5e397b78f83df31dde3cb1dc172d514b84e404bf30d818063a58c558b74fe3da6f17cb7ce2211253c59a6465feba88d035985c72ffe1399b98811b202bc968352031565cf3a5ced527b1b1ccfa604ccd4409c213fef38d20a2fccb3646cb95effcff9f2d45457806929dbf8ef69599c24dc74b8283cb0171adc551504b5cd74efe1781cbe785ae6e94b3a9ef90f6e9d344ae792ce2ce690abc14a10f486ca51487076242a79806cbdde704aed82558be69087145458e32073418dd923249b01b0b86680f411d5cbbaea599f49d01e4c9f026b1c0bd8e2d4d25a370741bec00b76e00d1861d092f0f9f9554dcafcf0da4dc04e91d04b6f34e62fb6ac4111fc5ec29dd12265dae6da9a96b38f544bade11cdae8cee855b2d45d7634cafef3aa624cd61cd53998eaba290117f805986abb74c920ed8bbbe1834f78e24002a5892833607749d5bcf7eae9f8c2418b5c66057c2f36e6a64d4a5edb0ace95eba5363b4cb8ab8a1bab7defd16eb0a665f12577e06f080f12233c1b6f3b8cf48c6afc8dd054c5ab361fa923395fa5ac71dd76313ca0859f25bb0a449eb63501dc2ac2c95c9794b6ec70086d05a54cd2c0112e435be19f13aacf418301cee28c66f717faa6338a18852cbeaf099ba2f4c9f464e51949d7c99bda4312d317455739a9bcd3ca58d23d1be90fb4ef7114cc0d168ba280ea388a70519dd23b26f44d6419b88513be54d81c23708050cbb454fceb103ca89adb18f5e94bc68d06568dbeec43d1d87f11ff1e4a3ef45bc1ff6d27e656b8b93ac4c3ae5d2f3737c8b78aad63d56fea422659ab2be324584b00ba72f4ccdc68bca1682e880b57ed7041eb7247d5615dfd393ca410fad7b8f40c05f9cc3ea2667fecd16672422f9b95aac00a9e64effb4c867f2418d2e027c07f94b0090d3e2a014855c4d541579b8c448e21685071542fbfcb62c7c1f4b0a20cfe4fb50f31834949ae637907a32d6b4cc79ea9d79fb45c12593e1551080fbe827426328e69755697d604415456f5c444acb1be954ced9295f530139ea309056929fdf85f0ed3f505ab35c49ff06e79dfc42bdf38620489b30c340cb2718038585a2e52f1fcdd242345edef059219372e89c69d60681edf4e8023a4db5ea25f06aecf78f79e35d9ad770605638e50a021bd071076c45662d5dc1b7cfd9984b891a47c7ef152efe8fb592b17b873986a01b752d941825a53226eeacc054aaaeb4a7d5c0df5e57b91a2b57d0982538c00806ce3419c646096638afc9ecb9543602c1b4fe11c4412c2c9461d8279a65e407d12cc3b77d0a94350936a1b5fd9810856e1d040f6d637db78b4647701e45e1162db32036fd7a647f7916c574fc30454c6e8e9a30d3a82fe8e07ecc6205eb19a6e5d4641c48785e6a610365a3f9a8c80818dd15da6dd02db0ac8ef620115648fc1ea1171603cf610f9990e2ef73119b54f7e4ffc90e206e56b929734f56750745be30a98ec3ea9f6b5e1f09485131e6887132a66ec7b8a98649bc5e7497ab3cc31012feccef4c2607efc82577d973e22a821a07077a3f8a310ba20bc264426b4d5b253bf579ad356f6d4e5fabb28ecd0a24f399f0546db059b473c72e48a9a8911b20e5c2a4f32edeaaf04eb7ca72335524a7f2a73743b6652203ff2575d43050d203fc79e23f9348d13d37144d01606574aed6c6cad5b9ae20690644ef7b0b8620d7cfd3c75c7ff2b209d60e16f1959ac7e752dcd4adef620972ab1943f380e0ee9cc6be7702bb2f12296be688baa576c173ea81575fbad649f00b857c61b6753ee084323567da41873755254947473c50e723790d6be6994f058f0c7a8fac9c6bb9ed0a65a1ca877b028f10e8bcd72e9185eb7688541e6ff7e2237a7ea45495b92a806ebeb0c57c626752e7fd65b521dcab064251ba7a258d97afc6c44caa5ca164257e3a95645d13e9869fa5c793daed6acac18a513e945e7a4368c45c1b1dff5edd7d50fa94c916c8dc5c4e617811e4266b0456b77580af21b8922fbd428baae50521e1abe17f289396086eb4f5d1a670eb91085f6496f19c1aa64d8bfdd8d68b6b105283af2347ca4abea08762e80badcb72672a5151a4f83c08c474c9d922d15cee81710bcea8b0130e1f8fc9fe29f7292ccbcd14b5c2ed189e958e4b2278eac30958538b15791820d5411e0bf9543f2fdff2222fb32f20374795063e727588ad8dd31dc522d4160becc1c51676c3040dc2427aef86359e6f0448e5d64359cceeadd194908d354b30e11348677bb203a652b97901255905c457482cb4eb5660fb7b67a05df886748d4b3f84677ccd1ea7d00a3d1f17d70d045e8a12224d138072fd73910d946f57442ad9ab5241a3da8cb2fcb0e7ce0249a1a6529a8a340b0f7dfc236d6d460b5b486197747ff068bc8fc966d6da08858f0c5751a92b3f51a806dcb1ed8d9f18aab51bd548d8677a0ef338bf8f7d4826905e4f0c8ef472f65af8e7fbc8e8f82e9fdbf80b20cf469141d5b7ea40997d056579a8a0dcc59f7535d9cbc6464daa0698884bb7181a4773d8e3e7287033cd7441630571bd9dbe4160f2ecc0265bb8e48ef62e7035395a5b3bb5439fef75ff82ec410e5dcd4be47534743a527840b76d8282e76679fe82236aebd509a26e0e61fe6c9d363b3bd2358b0f03c314f1380f8e1f6fa02ab498ef5f60ba3b1a48211618dfcb1daf4a669af2f767f7b54b4ca63ecfb7dba67bc0cb305e0138140235e62650363ad8f1add1de5875919fc6cdde2d1d5f7e7a70f2b21c6390df28335736d277525c63ce647e6de235e164a031cfff7a2901727253b0354c5d30941a50d00520779841eba9f4ad9342295abbcd5ced5fd90be94a71c4b900eef92e8a006fcace804e2cc83cb2b488bd593bdc170420337e45e106a87e4a152a46744348ff1083538b289a520de514e64c15c76fb15295be4f1ffb9047b773b3c5344dc8f338e8dc1ff4bd92b12057c2b37079d32c08e402828542aa92af5717f6f120dab31923537fc3bc4fd37f228ec4c31def270470eb3de333530a5ac07a354e888d919cd9c389721ac5eeee289fb75a39ec005197dd2cb1317579371726eb077bf0e1b11b3f41b44e6bd3c962599f9dfde4b510913eec07846a6fbcd2881d6f138187b7628be6fc81837acdd77725e20e4b36c5fcab7b3a9a7df3c320d95cd9e0b22c1d481eb97c90fe58ddaa1b14180f4df5c2f24986030600c746509830a5963848f726d61a67f85342061478cee2c74f963fb82b5e6a70bd2cf6135a11b1bbca0cbcec886d30421c86dc732339f0b6bc8c34541c4784c596ce8759797a96f5c16a6ddcc09601ddd20aecca1854494809d51349e62f1b52d4945681de6810c027ae51e8d98d06c1819cde62eea1891c60293041f9e87f2e22c8ba29b0a3d08bbd1788f5108cb7365bd374948404535d536e8421dbb9cb6dbdfaf5431dedd7cb88342738fb0d3393cba852427d4e0744df16408adc62f666579a127f4ea08ba5a91c384943763c6f99216a06c7a3e21b4238e3a22e96967507d8a5c6c056debfca58eb4ef4c2e041714add64424a83175f77b73711370dbc425c269fef86bc41420971f7036cdb5deb5fd228844a975f05f8656bd123f2fa08897ecf5808ab8b0b08ca9de0daa926c77cd1deda6b7d400000009fb5079bf7e0b1c74fb693a8f35ec27ce28cb61faf457f842c01fb449713b800f1fb71d545498d12eb374353ae4a39bda56b6560fbdc85b8ff6ae81a491f3745	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00188006A74949CB"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1376 reg.exe

pid	process
1376	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e1f063d6_by_Libranalysis.exe

pid	process
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe
3492	e1f063d6_by_Libranalysis.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

e1f063d6_by_Libranalysis.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3492	e1f063d6_by_Libranalysis.exe
Token: SeDebugPrivilege	3944	taskkill.exe
Token: SeDebugPrivilege	688	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	3128	taskkill.exe
Token: SeDebugPrivilege	3724	taskkill.exe
Token: SeDebugPrivilege	4496	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	3900	taskkill.exe
Token: SeDebugPrivilege	3296	taskkill.exe
Token: SeDebugPrivilege	4376	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	1344	taskkill.exe
Token: SeDebugPrivilege	5024	taskkill.exe
Token: SeDebugPrivilege	4132	taskkill.exe
Token: SeDebugPrivilege	3572	taskkill.exe
Token: SeDebugPrivilege	3464	taskkill.exe
Token: SeDebugPrivilege	4492	taskkill.exe
Token: SeDebugPrivilege	3156	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	1832	taskkill.exe
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeDebugPrivilege	4736	taskkill.exe
Token: SeDebugPrivilege	3272	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	408	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe
Token: SeDebugPrivilege	384	taskkill.exe
Token: SeDebugPrivilege	1640	taskkill.exe
Token: SeDebugPrivilege	2432	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	3040	taskkill.exe
Token: SeDebugPrivilege	4124	taskkill.exe
Token: SeDebugPrivilege	3316	taskkill.exe
Token: SeDebugPrivilege	684	taskkill.exe
Token: SeDebugPrivilege	3912	taskkill.exe
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	2352	taskkill.exe
Token: SeDebugPrivilege	636	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	4264	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	4348	taskkill.exe
Token: SeDebugPrivilege	4616	taskkill.exe
Token: SeDebugPrivilege	3184	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	4136	taskkill.exe
Token: SeDebugPrivilege	2036	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

e1f063d6_by_Libranalysis.exe

pid process

3492 e1f063d6_by_Libranalysis.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

e1f063d6_by_Libranalysis.exe

pid process

3492 e1f063d6_by_Libranalysis.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e1f063d6_by_Libranalysis.exe

description	pid	process	target process
PID 3492 wrote to memory of 3944	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3944	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 4056	3492	e1f063d6_by_Libranalysis.exe	reg.exe
PID 3492 wrote to memory of 4056	3492	e1f063d6_by_Libranalysis.exe	reg.exe
PID 3492 wrote to memory of 1376	3492	e1f063d6_by_Libranalysis.exe	reg.exe
PID 3492 wrote to memory of 1376	3492	e1f063d6_by_Libranalysis.exe	reg.exe
PID 3492 wrote to memory of 4216	3492	e1f063d6_by_Libranalysis.exe	schtasks.exe
PID 3492 wrote to memory of 4216	3492	e1f063d6_by_Libranalysis.exe	schtasks.exe
PID 3492 wrote to memory of 1304	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 1304	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 3108	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 3108	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 3792	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 3792	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 1872	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 1872	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 4080	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 4080	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 1684	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 1684	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 1816	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 1816	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 2664	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 2664	3492	e1f063d6_by_Libranalysis.exe	sc.exe
PID 3492 wrote to memory of 688	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 688	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 2672	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 2672	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3128	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3128	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 4496	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 4496	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3724	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3724	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 2656	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 2656	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3900	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3900	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3296	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3296	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 4376	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 4376	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 5024	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 5024	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 1484	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 1484	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 1344	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 1344	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 4132	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 4132	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3572	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3572	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3464	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3464	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 4492	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 4492	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 4192	3492	e1f063d6_by_Libranalysis.exe	netsh.exe
PID 3492 wrote to memory of 4192	3492	e1f063d6_by_Libranalysis.exe	netsh.exe
PID 3492 wrote to memory of 3156	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 3156	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 5036	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 5036	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 1832	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe
PID 3492 wrote to memory of 1832	3492	e1f063d6_by_Libranalysis.exe	taskkill.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

e1f063d6_by_Libranalysis.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	e1f063d6_by_Libranalysis.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	e1f063d6_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY NETWORK HAS BEEN HACKED"	e1f063d6_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your important files have been encrypted!\r\nYour files are safe! Only modified.(AES) \r\nNo software available on internet can help you.\r\nWe are the only ones able to decrypt your files.\r\n\r\n!!!!!!!!!!!!!!!!!!!!!!!!\r\nIf you decide not to work with us: \r\nAll data on your computers will remain encrypted forever. \r\nYOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!\r\nSo you can expect your data to be publicly available in the near future.. \r\nThe price will increase over time. \r\n!!!!!!!!!!!!!!!!!!!!!!!!!\r\n\r\nFull information in the file RESTORE_FILES_INFO"	e1f063d6_by_Libranalysis.exe

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3632

C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\e1f063d6_by_Libranalysis.exe"
1⤵
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3492
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3944
- C:\Windows\SYSTEM32\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:4056
- C:\Windows\SYSTEM32\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:1376
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:4216
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:1304
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:3108
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:1872
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:3792
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:4080
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:1684
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:1816
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:2664
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3128
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3724
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4496
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3296
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3900
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:4192
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3156
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1832
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:408
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3084
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:384
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2316
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3316
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:684
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3912
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4268
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:636
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4264
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:2168
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  PID:1660
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:4620
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:4112
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:4452
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:4368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-137-0x0000023738BB0000-0x0000023738BD2000-memory.dmp

Filesize
136KB

Download
memory/2036-138-0x00007FFCEA880000-0x00007FFCEB341000-memory.dmp

Filesize
10.8MB

Download
memory/2036-139-0x0000023737FF0000-0x0000023737FF2000-memory.dmp

Filesize
8KB

Download
memory/2036-140-0x0000023737FF3000-0x0000023737FF5000-memory.dmp

Filesize
8KB

Download
memory/2036-141-0x0000023737FF6000-0x0000023737FF8000-memory.dmp

Filesize
8KB

Download
memory/3492-134-0x0000000000DD0000-0x0000000000DFA000-memory.dmp

Filesize
168KB

Download
memory/3492-136-0x000000001C4A0000-0x000000001C4A2000-memory.dmp

Filesize
8KB

Download
memory/3492-135-0x00007FFCEA880000-0x00007FFCEB341000-memory.dmp

Filesize
10.8MB

Download