8ec919064791aa84aad6bb1374d6c67a8f5c254820f2f9a849a78f61eb6fada2

Resubmissions

18-08-2022 16:49

220818-vb3y7scbb9 10

11-08-2022 18:09

220811-wrtk5safam 10

Analysis

max time kernel
154s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
submitted
11-08-2022 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\odt\README.txt

Ransom Note

Hi, since you are reading this it means you have been hacked. In addition to encrypting all your systems, deleting backups, we also downloaded 2 terabytes of confidential information. Here's what you shouldn't do: 1) Contact the police, fbi or other authorities before the end of our deal 2) Contact the recovery company so that they would conduct dialogues with us. (This can slow down the recovery, and generally put our communication to naught) 3) Do not try to decrypt the files yourself, as well as do not change the file extension yourself !!! This can lead to the impossibility of their decryption. 4) Keep us for fools) We will also stop any communication with you, and continue DDoS, calls to employees and business partners. In a few weeks, we will simply repeat our attack and delete all your data from your networks, WHICH WILL LEAD TO THEIR UNAVAILABILITY! Here's what you should do right after reading it: 1) If you are an ordinary employee, send our message to the CEO of the company, as well as to the IT department 2) If you are a CEO, or a specialist in the IT department, or another person who has weight in the company, you should contact us within 24 hours by email. We are ready to confirm all our intentions regarding DDOS, calls, and deletion of the date at your first request. As a guarantee that we can decrypt the files, we suggest that you send several files for free decryption. Mails to contact us: 1)[email protected] 2)[email protected]/10RcjlacqrOwohIlC4B05A3X8jh isUPAwdwOMgJYaJWzYM5ThOkJEeMkp8oVYjgxELfu7HuVwMqHjtwu1HuUwgCO+C3 E3g9xU/a5Y+4oIt0wSFah4imLmTN4J/xPBAAw21uni8=

Emails

1)[email protected]

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Boot\PCAT\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Boot\PCAT\fr-FR\bootmgr.exe.mui	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\IEBrowseWeb\RS_DisableaddonLoadingTime.ps1	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\Power\it-IT\Power_Troubleshooter.psd1	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\Video\VF_viddrv_driverblocklist.ps1	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pd3efef62#\f5852c82815dea15df3feb0b6a3dfec0\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\IESecurity\de-DE\IESecurity_TroubleShooter.psd1	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\Video\VF_viddrv_unsigned.ps1	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\INF\netirda.inf	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\normnfkc.nlp	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Cursors\up_rm.cur	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\Boot\Fonts\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\IESecurity\en-US\IESecurity_TroubleShooter.psd1	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\INF\cht4vx64.inf	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\INF\c_printer.inf	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Abf69f55a#\9dc8ecabf3587fd779eed1e7c1376c22\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Boot\EFI\sk-SK\bootmgfw.efi.mui	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\Boot\PCAT\da-DK\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Cursors\aero_arrow_l.cur	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Cursors\busy_r.cur	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Cursors\cross_m.cur	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Cursors\cross_r.cur	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\Device\CL_DetectingDevice.ps1	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Boot\EFI\da-DK\bootmgr.efi.mui	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\INF\mdmmhzel.inf	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-200.png	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\IME\IMEKR\DICTS\imkrhjd.lex	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.rsp	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\es-ES\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Globalization\Sorting\SortDefault.nls	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Boot\EFI\da-DK\bootmgfw.efi.mui	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\IEBrowseWeb\es-ES\DiagPackage.dll.mui	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\INF\uaspstor.inf	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\INF\usbncm.inf	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DebugAndTrace.aspx.fr.resx	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Provider.aspx.de.resx	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageAllRoles.aspx.it.resx	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\apppatch\it-IT\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAuthentication.ascx.es.resx	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\BITS\RC_BITSRegKeys.ps1	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\Bluetooth\DiagPackage.diagpkg	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\Keyboard\it-IT\DiagPackage.dll.mui	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\Power\de-DE\RS_DisableUSBSelective.psd1	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\IME\fr-FR\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\wide.Lock.png	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\diagnostics\system\Audio\CL_Utility.ps1	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\INF\usbstor.inf	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\diagnostics\system\PCW\de-DE\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\Boot\PCAT\lt-LT\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Boot\PCAT\qps-ploc\memtest.exe.mui	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Cursors\busy_il.cur	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\IME\IMEJP\help\IMJPCL.CHM	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\INF\.NET Data Provider for SqlServer\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\INF\mdmcpv.inf	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\apppatch\sysmain.sdb	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\L2Schemas\WFD_LEGACY_profile_v1.xsd	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File created	C:\Windows\Logs\waasmedic\README.txt	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppSetting.ascx.fr.resx	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\EditAppSetting.aspx.es.resx	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp.aspx.fr.resx	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageSingleRole.aspx.fr.resx	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardProviderInfo.ascx.es.resx	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
Token: SeTakeOwnershipPrivilege	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 3572	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	91
PID 3792 wrote to memory of 3572	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	91
PID 3792 wrote to memory of 3572	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	91
PID 3792 wrote to memory of 1724	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	93
PID 3792 wrote to memory of 1724	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	93
PID 3792 wrote to memory of 1724	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	93
PID 3792 wrote to memory of 3328	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	95
PID 3792 wrote to memory of 3328	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	95
PID 3792 wrote to memory of 3328	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	95
PID 3792 wrote to memory of 652	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	97
PID 3792 wrote to memory of 652	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	97
PID 3792 wrote to memory of 652	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	97
PID 3572 wrote to memory of 2996	3572	cmd.exe	98
PID 3572 wrote to memory of 2996	3572	cmd.exe	98
PID 3572 wrote to memory of 2996	3572	cmd.exe	98
PID 3792 wrote to memory of 2144	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	100
PID 3792 wrote to memory of 2144	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	100
PID 3792 wrote to memory of 2144	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	100
PID 3792 wrote to memory of 464	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	102
PID 3792 wrote to memory of 464	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	102
PID 3792 wrote to memory of 464	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	102
PID 3792 wrote to memory of 3424	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	104
PID 3792 wrote to memory of 3424	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	104
PID 3792 wrote to memory of 3424	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	104
PID 3792 wrote to memory of 1828	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	106
PID 3792 wrote to memory of 1828	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	106
PID 3792 wrote to memory of 1828	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	106
PID 3792 wrote to memory of 376	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	107
PID 3792 wrote to memory of 376	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	107
PID 3792 wrote to memory of 376	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	107
PID 3792 wrote to memory of 1200	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	110
PID 3792 wrote to memory of 1200	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	110
PID 3792 wrote to memory of 1200	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	110
PID 3792 wrote to memory of 1256	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	112
PID 3792 wrote to memory of 1256	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	112
PID 3792 wrote to memory of 1256	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	112
PID 3792 wrote to memory of 4140	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	114
PID 3792 wrote to memory of 4140	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	114
PID 3792 wrote to memory of 4140	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	114
PID 3792 wrote to memory of 4164	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	116
PID 3792 wrote to memory of 4164	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	116
PID 3792 wrote to memory of 4164	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	116
PID 3792 wrote to memory of 4212	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	118
PID 3792 wrote to memory of 4212	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	118
PID 3792 wrote to memory of 4212	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	118
PID 3792 wrote to memory of 4240	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	119
PID 3792 wrote to memory of 4240	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	119
PID 3792 wrote to memory of 4240	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	119
PID 3792 wrote to memory of 4304	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	122
PID 3792 wrote to memory of 4304	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	122
PID 3792 wrote to memory of 4304	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	122
PID 3792 wrote to memory of 4352	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	124
PID 3792 wrote to memory of 4352	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	124
PID 3792 wrote to memory of 4352	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	124
PID 3792 wrote to memory of 4412	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	126
PID 3792 wrote to memory of 4412	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	126
PID 3792 wrote to memory of 4412	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	126
PID 3792 wrote to memory of 4476	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	127
PID 3792 wrote to memory of 4476	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	127
PID 3792 wrote to memory of 4476	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	127
PID 3792 wrote to memory of 4532	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	130
PID 3792 wrote to memory of 4532	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	130
PID 3792 wrote to memory of 4532	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	130
PID 3792 wrote to memory of 4608	3792	d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe	132

C:\Users\Admin\AppData\Local\Temp\d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe
C:\Users\Admin\AppData\Local\Temp\d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.exe --pass D86BDXL9N3H
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -command "Get-VM | Stop-VM -Force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Get-VM | Stop-VM -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop MSSQLServerADHelper100
  2⤵
  PID:1724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop MSSQL$ISARS
  2⤵
  PID:3328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop MSSQL$MSFW
  2⤵
  PID:652
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop SQLAgent$ISARS
  2⤵
  PID:2144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop SQLAgent$MSFW
  2⤵
  PID:464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop SQLBrowser
  2⤵
  PID:3424
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop ReportServer$ISARS
  2⤵
  PID:1828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop SQLWriter
  2⤵
  PID:376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop WinDefend
  2⤵
  PID:1200
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop mr2kserv
  2⤵
  PID:1256
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop MSExchangeADTopology
  2⤵
  PID:4140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop MSExchangeFBA
  2⤵
  PID:4164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop MSExchangeIS
  2⤵
  PID:4212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop MSExchangeSA
  2⤵
  PID:4240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop ShadowProtectSvc
  2⤵
  PID:4304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop SPAdminV4
  2⤵
  PID:4352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop SPTimerV4
  2⤵
  PID:4412
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop SPTraceV4
  2⤵
  PID:4476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop SPUserCodeV4
  2⤵
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop SPWriterV4
  2⤵
  PID:4608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop SPSearch4
  2⤵
  PID:4652
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop MSSQLServerADHelper100
  2⤵
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop IISADMIN
  2⤵
  PID:4748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop firebirdguardiandefaultinstance
  2⤵
  PID:4792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop ibmiasrw
  2⤵
  PID:4840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QBCFMonitorService
  2⤵
  PID:4892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QBVSS
  2⤵
  PID:4932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QBPOSDBServiceV12
  2⤵
  PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop "IBM Domino Server (CProgramFilesIBMDominodata)"
  2⤵
  PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop "IBM Domino Diagnostics (CProgramFilesIBMDomino)"
  2⤵
  PID:5056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop IISADMIN
  2⤵
  PID:4112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop "Simply Accounting Database Connection Manager"
  2⤵
  PID:4616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB1
  2⤵
  PID:4704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB2
  2⤵
  PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB3
  2⤵
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB4
  2⤵
  PID:5156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB5
  2⤵
  PID:5188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB6
  2⤵
  PID:5216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB7
  2⤵
  PID:5320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB8
  2⤵
  PID:5352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB9
  2⤵
  PID:5420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB10
  2⤵
  PID:5444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB11
  2⤵
  PID:5512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB12
  2⤵
  PID:5536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB13
  2⤵
  PID:5616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB14
  2⤵
  PID:5672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB15
  2⤵
  PID:5712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB16
  2⤵
  PID:5732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB17
  2⤵
  PID:5808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB18
  2⤵
  PID:5828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB19
  2⤵
  PID:5868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB20
  2⤵
  PID:5936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB21
  2⤵
  PID:6008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB22
  2⤵
  PID:6020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB23
  2⤵
  PID:6100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB24
  2⤵
  PID:5236
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB25
  2⤵
  PID:5360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im mysql*
  2⤵
  PID:5740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im dsa*
  2⤵
  PID:5944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im veeam*
  2⤵
  PID:5484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im chrome*
  2⤵
  PID:6184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im iexplore*
  2⤵
  PID:6216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im firefox*
  2⤵
  PID:6296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im outlook*
  2⤵
  PID:6328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im excel*
  2⤵
  PID:6368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im outlook*
  2⤵
  PID:6408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im taskmgr*
  2⤵
  PID:6432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im tasklist*
  2⤵
  PID:6488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im Ntrtscan*
  2⤵
  PID:6544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im ds_monitor*
  2⤵
  PID:6584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im Notifier*
  2⤵
  PID:6624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im putty*
  2⤵
  PID:6676
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im ssh*
  2⤵
  PID:6748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im iVPAgent*
  2⤵
  PID:6796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im TmListen*
  2⤵
  PID:6788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im CNTAoSMgr*
  2⤵
  PID:6860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im IBM*
  2⤵
  PID:6908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im black*
  2⤵
  PID:6964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im bes10*
  2⤵
  PID:6956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im copy*
  2⤵
  PID:7052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im robo*
  2⤵
  PID:7036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im sql
  2⤵
  PID:7108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im store.exe
  2⤵
  PID:7124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im sql*
  2⤵
  PID:6192
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im vee*
  2⤵
  PID:6556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im wrsa.exe
  2⤵
  PID:6924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im postg*
  2⤵
  PID:7180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im sage*
  2⤵
  PID:7220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" taskkill /f /im wrsa*
  2⤵
  PID:6816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
8f96320ab4e0bc1369dc19e92e8a80f9

SHA1
f6b6ce97cc2d25420cedb7fd56e1997f0708784a

SHA256
8e7fbdb100e3011090351fa85b0c0a45b729e3e69cc27de6983868a9a5e80677

SHA512
1c49036de8852e3618939e722294a8353b6ab827d978740fb05954d2ca377e45ab81bcee1130373475d0ce0402c95cf53e9aaac41650b858fec73201c1abc795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
3902e23c5e6e1dc28aa5090a1a48aac7

SHA1
4a20ad2bb624336bb144dbf2351a924122a5fdcf

SHA256
f4fc7755d3123d09d8bddb28570c163ffe1a6303a602c181ae4102583d051b43

SHA512
e0b62395cd6c7cbd59a0a0f444eb0241e4b4a2a9510170102191acbb3d8e593da76b045b8b1fc59675bd8cc4336330982082114a661e947b7a096ce817da03b3

Download Submit
memory/2996-208-0x0000000007210000-0x000000000722A000-memory.dmp

Filesize
104KB

Download
memory/2996-206-0x0000000007150000-0x00000000071E6000-memory.dmp

Filesize
600KB

Download
memory/2996-142-0x00000000045F0000-0x0000000004626000-memory.dmp

Filesize
216KB

Download
memory/2996-193-0x0000000006190000-0x00000000061C2000-memory.dmp

Filesize
200KB

Download
memory/2996-194-0x0000000070510000-0x000000007055C000-memory.dmp

Filesize
304KB

Download
memory/2996-196-0x0000000006B80000-0x0000000006B9E000-memory.dmp

Filesize
120KB

Download
memory/2996-147-0x0000000004CC0000-0x00000000052E8000-memory.dmp

Filesize
6.2MB

Download
memory/2996-201-0x0000000007510000-0x0000000007B8A000-memory.dmp

Filesize
6.5MB

Download
memory/2996-202-0x0000000006ED0000-0x0000000006EEA000-memory.dmp

Filesize
104KB

Download
memory/2996-205-0x0000000006F40000-0x0000000006F4A000-memory.dmp

Filesize
40KB

Download
memory/2996-207-0x0000000007100000-0x000000000710E000-memory.dmp

Filesize
56KB

Download
memory/2996-170-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

Filesize
120KB

Download
memory/2996-153-0x0000000004C20000-0x0000000004C42000-memory.dmp

Filesize
136KB

Download
memory/2996-154-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download
memory/2996-209-0x00000000071F0000-0x00000000071F8000-memory.dmp

Filesize
32KB

Download
memory/2996-155-0x0000000005590000-0x00000000055F6000-memory.dmp

Filesize
408KB

Download