7163e267d5132a1df96df8ef045b10809c07048aded2ce87d2de1600cbd44b28

Analysis

max time kernel
74s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21/06/2022, 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.exe
Size

94KB
MD5

26f65722f6307386f3aa23237f44c24a
SHA1

d26becc64f43c7af17f2d39d3fc1b744ac3e8fbb
SHA256

cce5a753888cb5b044c767fe8e95e410ebdf1e1c79cabc95db1c9e1a8e81c5e7
SHA512

241c6ba3e95206827fe26ee6ef279e0bad2fbe6d4b55732fdacd078e2a977726a01bc16fd4b213b7483a1f1e74d1355dc416fb04ad8d86e3da2443cfa499bbb1

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RECOVERY.txt

Ransom Note

All your important files are encrypted! Any attempts to recover your files using third-party software will have fatal consequences, the files will be changed forever, without the possibility of recovery. There is only one way to get your files back: install the tor browser (https://www.torproject.org/download ) Important: Create a new email in the service http://pflujznptk5lmuf6xwadfqy6nffykdvahfbljh7liljailjbxrgvhfid.onion/account/create for contact! write to me at [email protected] Send me your ID by email Key Identifier: SMODk6hMz5lk5zn8XQHTiQpkmWuc84m7seTi63tYw9WhR9jrjTN5ynODxNmzD+uMyxgFYLxyn9OWtkId5ypPEEeDlGNsy1NgTqxeng0ryTX60kH2EjSWUTLRUHOh9oH6d6OIKCUpbzQCtSMMXXL05PGAXCKSUFo/fDetmCt5Hqul9dh4eiwyC/KKh/cdG0LM7ofj16uMVweBSLkBenGCh918MC1itrbDiW8Yhf1+Ljgvu5+1TX4N36Aw0g8o9/mf7yyqxGvZkcJlSrkEGOdknH0EQUd1hLJi10XGpOUUgBBoYrOsxasjVnGPqr+L1j2PyD8txaaqd6Kpxr5DZ4b8id9bdYcbIUlW+fOY6Xtid314BC3lJEszqVQsBk4Ac9TxQu6Wh9XZ1SPq/DjMpJYwuWSgb1g5Wzg6DSZdlSGqYI61JHhx8fucrLASZp2RnFOADAMp/fwnVVkLLHOA6aU9yEZjnyevyWlHYqc0aCDEY17H5ygrF+ySudnTTMgmyX+1aIFXoTbxCTRkD6tRowPixiA3wR2VRJEI6NutVOCqC7vGRIaQofFK00L2RQk55nrTsIiQn3P/47h6jinfKb22XX8mqrs3fNh4rx8Jq4XaI3hpcUUm8msCPD6OepiTsFwBXQtA5oamvOamwztAgML+D6LfR53TUjcYTCYqS71nFOo=

Emails

[email protected]

URLs

http://pflujznptk5lmuf6xwadfqy6nffykdvahfbljh7liljailjbxrgvhfid.onion/account/create

Signatures

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ShowHide.tiff	sample.exe
File renamed	C:\Users\Admin\Pictures\ShowHide.tiff => C:\Users\Admin\Pictures\ShowHide.tiff.trins	sample.exe
File opened for modification	C:\Users\Admin\Pictures\ShowHide.tiff.trins	sample.exe
File renamed	C:\Users\Admin\Pictures\GrantShow.png => C:\Users\Admin\Pictures\GrantShow.png.trins	sample.exe
File opened for modification	C:\Users\Admin\Pictures\GrantShow.png.trins	sample.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	sample.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	sample.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log.trins	sample.exe
File opened for modification	C:\Windows\setuperr.log	sample.exe
File opened for modification	C:\Windows\WMSysPr9.prx	sample.exe
File opened for modification	C:\Windows\lsasetup.log.trins	sample.exe
File opened for modification	C:\Windows\Professional.xml	sample.exe
File opened for modification	C:\Windows\win.ini	sample.exe
File opened for modification	C:\Windows\system.ini	sample.exe
File opened for modification	C:\Windows\system.ini.trins	sample.exe
File opened for modification	C:\Windows\win.ini.trins	sample.exe
File opened for modification	C:\Windows\WindowsShell.Manifest	sample.exe
File opened for modification	C:\Windows\WindowsUpdate.log.trins	sample.exe
File opened for modification	C:\Windows\DtcInstall.log	sample.exe
File opened for modification	C:\Windows\lsasetup.log	sample.exe
File opened for modification	C:\Windows\setupact.log	sample.exe
File opened for modification	C:\Windows\PFRO.log.trins	sample.exe
File opened for modification	C:\Windows\Professional.xml.trins	sample.exe
File opened for modification	C:\Windows\setupact.log.trins	sample.exe
File opened for modification	C:\Windows\WindowsUpdate.log	sample.exe
File opened for modification	C:\Windows\bootstat.dat	sample.exe
File opened for modification	C:\Windows\mib.bin	sample.exe
File opened for modification	C:\Windows\PFRO.log	sample.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
716	sc.exe
4752	sc.exe
1928	sc.exe
3740	sc.exe
4904	sc.exe
3804	sc.exe
2784	sc.exe
4692	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

pid	Process
4200	taskkill.exe
3628	taskkill.exe
3196	taskkill.exe
4756	taskkill.exe
3580	taskkill.exe
4280	taskkill.exe
2236	taskkill.exe
1764	taskkill.exe
896	taskkill.exe
3084	taskkill.exe
4144	taskkill.exe
5044	taskkill.exe
2780	taskkill.exe
2360	taskkill.exe
1272	taskkill.exe
3052	taskkill.exe
5000	taskkill.exe
1124	taskkill.exe
2196	taskkill.exe
4352	taskkill.exe
972	taskkill.exe
4028	taskkill.exe
628	taskkill.exe
3448	taskkill.exe
392	taskkill.exe
2472	taskkill.exe
1984	taskkill.exe
4020	taskkill.exe
2376	taskkill.exe
3796	taskkill.exe
5012	taskkill.exe
2076	taskkill.exe
2476	taskkill.exe
4972	taskkill.exe
4788	taskkill.exe
1140	taskkill.exe
1568	taskkill.exe
60	taskkill.exe
4100	taskkill.exe
2876	taskkill.exe
2028	taskkill.exe
4408	taskkill.exe
540	taskkill.exe
4320	taskkill.exe
5032	taskkill.exe
2696	taskkill.exe
1484	taskkill.exe
4292	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1724	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	524	sample.exe
Token: SeDebugPrivilege	1124	taskkill.exe
Token: SeDebugPrivilege	4280	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	60	taskkill.exe
Token: SeDebugPrivilege	4200	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	2236	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	3196	taskkill.exe
Token: SeDebugPrivilege	3628	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	4756	taskkill.exe
Token: SeDebugPrivilege	896	taskkill.exe
Token: SeDebugPrivilege	4028	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe
Token: SeDebugPrivilege	4144	taskkill.exe
Token: SeDebugPrivilege	628	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	2876	taskkill.exe
Token: SeDebugPrivilege	5012	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	3448	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	2360	taskkill.exe
Token: SeDebugPrivilege	1272	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	540	taskkill.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeDebugPrivilege	392	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	5000	taskkill.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	4020	taskkill.exe
Token: SeDebugPrivilege	4292	taskkill.exe
Token: SeDebugPrivilege	2376	taskkill.exe
Token: SeDebugPrivilege	3796	taskkill.exe
Token: SeDebugPrivilege	3192	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
524	sample.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
524	sample.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 1124	524	sample.exe	87
PID 524 wrote to memory of 1124	524	sample.exe	87
PID 524 wrote to memory of 1124	524	sample.exe	87
PID 524 wrote to memory of 3644	524	sample.exe	89
PID 524 wrote to memory of 3644	524	sample.exe	89
PID 524 wrote to memory of 3644	524	sample.exe	89
PID 524 wrote to memory of 1724	524	sample.exe	92
PID 524 wrote to memory of 1724	524	sample.exe	92
PID 524 wrote to memory of 1724	524	sample.exe	92
PID 524 wrote to memory of 4500	524	sample.exe	95
PID 524 wrote to memory of 4500	524	sample.exe	95
PID 524 wrote to memory of 4500	524	sample.exe	95
PID 524 wrote to memory of 1708	524	sample.exe	97
PID 524 wrote to memory of 1708	524	sample.exe	97
PID 524 wrote to memory of 1708	524	sample.exe	97
PID 524 wrote to memory of 1928	524	sample.exe	99
PID 524 wrote to memory of 1928	524	sample.exe	99
PID 524 wrote to memory of 1928	524	sample.exe	99
PID 524 wrote to memory of 3740	524	sample.exe	100
PID 524 wrote to memory of 3740	524	sample.exe	100
PID 524 wrote to memory of 3740	524	sample.exe	100
PID 524 wrote to memory of 4904	524	sample.exe	102
PID 524 wrote to memory of 4904	524	sample.exe	102
PID 524 wrote to memory of 4904	524	sample.exe	102
PID 524 wrote to memory of 3804	524	sample.exe	105
PID 524 wrote to memory of 3804	524	sample.exe	105
PID 524 wrote to memory of 3804	524	sample.exe	105
PID 524 wrote to memory of 2784	524	sample.exe	107
PID 524 wrote to memory of 2784	524	sample.exe	107
PID 524 wrote to memory of 2784	524	sample.exe	107
PID 524 wrote to memory of 4692	524	sample.exe	109
PID 524 wrote to memory of 4692	524	sample.exe	109
PID 524 wrote to memory of 4692	524	sample.exe	109
PID 524 wrote to memory of 716	524	sample.exe	111
PID 524 wrote to memory of 716	524	sample.exe	111
PID 524 wrote to memory of 716	524	sample.exe	111
PID 524 wrote to memory of 4752	524	sample.exe	113
PID 524 wrote to memory of 4752	524	sample.exe	113
PID 524 wrote to memory of 4752	524	sample.exe	113
PID 524 wrote to memory of 4280	524	sample.exe	115
PID 524 wrote to memory of 4280	524	sample.exe	115
PID 524 wrote to memory of 4280	524	sample.exe	115
PID 524 wrote to memory of 2196	524	sample.exe	116
PID 524 wrote to memory of 2196	524	sample.exe	116
PID 524 wrote to memory of 2196	524	sample.exe	116
PID 524 wrote to memory of 4352	524	sample.exe	118
PID 524 wrote to memory of 4352	524	sample.exe	118
PID 524 wrote to memory of 4352	524	sample.exe	118
PID 524 wrote to memory of 972	524	sample.exe	121
PID 524 wrote to memory of 972	524	sample.exe	121
PID 524 wrote to memory of 972	524	sample.exe	121
PID 524 wrote to memory of 60	524	sample.exe	127
PID 524 wrote to memory of 60	524	sample.exe	127
PID 524 wrote to memory of 60	524	sample.exe	127
PID 524 wrote to memory of 2696	524	sample.exe	126
PID 524 wrote to memory of 2696	524	sample.exe	126
PID 524 wrote to memory of 2696	524	sample.exe	126
PID 524 wrote to memory of 4200	524	sample.exe	125
PID 524 wrote to memory of 4200	524	sample.exe	125
PID 524 wrote to memory of 4200	524	sample.exe	125
PID 524 wrote to memory of 2236	524	sample.exe	129
PID 524 wrote to memory of 2236	524	sample.exe	129
PID 524 wrote to memory of 2236	524	sample.exe	129
PID 524 wrote to memory of 1764	524	sample.exe	130

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\SysWOW64\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:3644
- C:\Windows\SysWOW64\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:1724
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:4500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:1708
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  - Launches sc.exe
  PID:1928
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  - Launches sc.exe
  PID:3740
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:4904
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  - Launches sc.exe
  PID:3804
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2784
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4692
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  - Launches sc.exe
  PID:716
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:4752
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:60
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3628
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4028
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:896
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3084
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3448
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2076
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:540
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4320
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:392
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3052
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3580
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-131-0x00000000049E0000-0x0000000004A46000-memory.dmp

Filesize
408KB

Download
memory/524-130-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/3192-197-0x0000000006730000-0x000000000674E000-memory.dmp

Filesize
120KB

Download
memory/3192-196-0x0000000006070000-0x00000000060D6000-memory.dmp

Filesize
408KB

Download
memory/3192-195-0x0000000005770000-0x0000000005792000-memory.dmp

Filesize
136KB

Download
memory/3192-194-0x00000000059D0000-0x0000000005FF8000-memory.dmp

Filesize
6.2MB

Download
memory/3192-193-0x0000000002E10000-0x0000000002E46000-memory.dmp

Filesize
216KB

Download