Resubmissions
28/02/2023, 20:04
230228-ytdzksch89 1004/02/2023, 22:36
230204-2jls8aeh82 1004/02/2023, 22:32
230204-2gdptseh74 1004/02/2023, 22:30
230204-2es2qseh68 1004/02/2023, 22:15
230204-16lw3aab7v 1028/12/2022, 14:55
221228-saetwadg2x 10Analysis
-
max time kernel
38s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28/12/2022, 14:55
Static task
static1
Behavioral task
behavioral1
Sample
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Resource
win10v2004-20220812-en
General
-
Target
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
-
Size
333KB
-
MD5
3191feae778309eb99df4e4e25c62f1a
-
SHA1
d639821e3fbbb15e14b46aed5b98568e3ce045c3
-
SHA256
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992
-
SHA512
c8d8734bb1d6e413d8b14e73952a4eb42fd5641ca49822db66f87ea7f0c1fb4c2a38232a652a11ca1c3c5564a517a2aaef8fb59fadff36a11afcce60e5d89798
-
SSDEEP
6144:P1S1JwNbEKcwwZTz2fYNR5OyxyM6qy9iJ4zv5fmRw9aC1oPtYdeAS9aqbGqeBD:9So4KcZbRwyxmf9iWhuw9aCqPtYMH9zs
Malware Config
Extracted
\??\c:\$Recycle.Bin\S-1-5-21-1214520366-621468234-4062160515-1000\How To Restore Your Files.txt
Extracted
C:\Users\Admin\AppData\Local\Temp\readme-warning.hta
https://tox.chat/
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 2948 lsm.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\BlockImport.tiff a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe File opened for modification C:\Users\Admin\Pictures\SkipDisable.tiff a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Stops running service(s) 3 TTPs
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Loads dropped DLL 2 IoCs
pid Process 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Sets desktop wallpaper using registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\hrdb.ico" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\HARDBIT.jpg" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 336 sc.exe 2920 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1700 vssadmin.exe 2816 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.hardbit2 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.hardbit2\ a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.hardbit2\DefaultIcon a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.hardbit2\DefaultIcon\ = "C:\\Users\\Admin\\Documents\\hrdb.ico" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1508 powershell.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1744 WMIC.exe Token: SeSecurityPrivilege 1744 WMIC.exe Token: SeTakeOwnershipPrivilege 1744 WMIC.exe Token: SeLoadDriverPrivilege 1744 WMIC.exe Token: SeSystemProfilePrivilege 1744 WMIC.exe Token: SeSystemtimePrivilege 1744 WMIC.exe Token: SeProfSingleProcessPrivilege 1744 WMIC.exe Token: SeIncBasePriorityPrivilege 1744 WMIC.exe Token: SeCreatePagefilePrivilege 1744 WMIC.exe Token: SeBackupPrivilege 1744 WMIC.exe Token: SeRestorePrivilege 1744 WMIC.exe Token: SeShutdownPrivilege 1744 WMIC.exe Token: SeDebugPrivilege 1744 WMIC.exe Token: SeSystemEnvironmentPrivilege 1744 WMIC.exe Token: SeRemoteShutdownPrivilege 1744 WMIC.exe Token: SeUndockPrivilege 1744 WMIC.exe Token: SeManageVolumePrivilege 1744 WMIC.exe Token: 33 1744 WMIC.exe Token: 34 1744 WMIC.exe Token: 35 1744 WMIC.exe Token: SeIncreaseQuotaPrivilege 1744 WMIC.exe Token: SeSecurityPrivilege 1744 WMIC.exe Token: SeTakeOwnershipPrivilege 1744 WMIC.exe Token: SeLoadDriverPrivilege 1744 WMIC.exe Token: SeSystemProfilePrivilege 1744 WMIC.exe Token: SeSystemtimePrivilege 1744 WMIC.exe Token: SeProfSingleProcessPrivilege 1744 WMIC.exe Token: SeIncBasePriorityPrivilege 1744 WMIC.exe Token: SeCreatePagefilePrivilege 1744 WMIC.exe Token: SeBackupPrivilege 1744 WMIC.exe Token: SeRestorePrivilege 1744 WMIC.exe Token: SeShutdownPrivilege 1744 WMIC.exe Token: SeDebugPrivilege 1744 WMIC.exe Token: SeSystemEnvironmentPrivilege 1744 WMIC.exe Token: SeRemoteShutdownPrivilege 1744 WMIC.exe Token: SeUndockPrivilege 1744 WMIC.exe Token: SeManageVolumePrivilege 1744 WMIC.exe Token: 33 1744 WMIC.exe Token: 34 1744 WMIC.exe Token: 35 1744 WMIC.exe Token: SeDebugPrivilege 1508 powershell.exe Token: SeDebugPrivilege 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Token: SeIncreaseQuotaPrivilege 2140 WMIC.exe Token: SeSecurityPrivilege 2140 WMIC.exe Token: SeTakeOwnershipPrivilege 2140 WMIC.exe Token: SeLoadDriverPrivilege 2140 WMIC.exe Token: SeSystemProfilePrivilege 2140 WMIC.exe Token: SeSystemtimePrivilege 2140 WMIC.exe Token: SeProfSingleProcessPrivilege 2140 WMIC.exe Token: SeIncBasePriorityPrivilege 2140 WMIC.exe Token: SeCreatePagefilePrivilege 2140 WMIC.exe Token: SeBackupPrivilege 2140 WMIC.exe Token: SeRestorePrivilege 2140 WMIC.exe Token: SeShutdownPrivilege 2140 WMIC.exe Token: SeDebugPrivilege 2140 WMIC.exe Token: SeSystemEnvironmentPrivilege 2140 WMIC.exe Token: SeRemoteShutdownPrivilege 2140 WMIC.exe Token: SeUndockPrivilege 2140 WMIC.exe Token: SeManageVolumePrivilege 2140 WMIC.exe Token: 33 2140 WMIC.exe Token: 34 2140 WMIC.exe Token: 35 2140 WMIC.exe Token: SeIncreaseQuotaPrivilege 2140 WMIC.exe Token: SeSecurityPrivilege 2140 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1972 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 30 PID 1736 wrote to memory of 1972 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 30 PID 1736 wrote to memory of 1972 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 30 PID 1736 wrote to memory of 1972 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 30 PID 1972 wrote to memory of 336 1972 cmd.exe 32 PID 1972 wrote to memory of 336 1972 cmd.exe 32 PID 1972 wrote to memory of 336 1972 cmd.exe 32 PID 1972 wrote to memory of 336 1972 cmd.exe 32 PID 1736 wrote to memory of 1372 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 33 PID 1736 wrote to memory of 1372 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 33 PID 1736 wrote to memory of 1372 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 33 PID 1736 wrote to memory of 1372 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 33 PID 1736 wrote to memory of 1728 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 35 PID 1736 wrote to memory of 1728 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 35 PID 1736 wrote to memory of 1728 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 35 PID 1736 wrote to memory of 1728 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 35 PID 1728 wrote to memory of 1700 1728 cmd.exe 37 PID 1728 wrote to memory of 1700 1728 cmd.exe 37 PID 1728 wrote to memory of 1700 1728 cmd.exe 37 PID 1728 wrote to memory of 1700 1728 cmd.exe 37 PID 1728 wrote to memory of 1744 1728 cmd.exe 38 PID 1728 wrote to memory of 1744 1728 cmd.exe 38 PID 1728 wrote to memory of 1744 1728 cmd.exe 38 PID 1728 wrote to memory of 1744 1728 cmd.exe 38 PID 1736 wrote to memory of 1468 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 40 PID 1736 wrote to memory of 1468 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 40 PID 1736 wrote to memory of 1468 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 40 PID 1736 wrote to memory of 1468 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 40 PID 1736 wrote to memory of 1508 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 42 PID 1736 wrote to memory of 1508 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 42 PID 1736 wrote to memory of 1508 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 42 PID 1736 wrote to memory of 1508 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 42 PID 1736 wrote to memory of 1944 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 44 PID 1736 wrote to memory of 1944 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 44 PID 1736 wrote to memory of 1944 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 44 PID 1736 wrote to memory of 1944 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 44 PID 1736 wrote to memory of 812 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 46 PID 1736 wrote to memory of 812 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 46 PID 1736 wrote to memory of 812 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 46 PID 1736 wrote to memory of 812 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 46 PID 1736 wrote to memory of 1844 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 47 PID 1736 wrote to memory of 1844 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 47 PID 1736 wrote to memory of 1844 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 47 PID 1736 wrote to memory of 1844 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 47 PID 1736 wrote to memory of 1136 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 50 PID 1736 wrote to memory of 1136 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 50 PID 1736 wrote to memory of 1136 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 50 PID 1736 wrote to memory of 1136 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 50 PID 1736 wrote to memory of 952 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 51 PID 1736 wrote to memory of 952 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 51 PID 1736 wrote to memory of 952 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 51 PID 1736 wrote to memory of 952 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 51 PID 1736 wrote to memory of 744 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 54 PID 1736 wrote to memory of 744 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 54 PID 1736 wrote to memory of 744 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 54 PID 1736 wrote to memory of 744 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 54 PID 1844 wrote to memory of 1308 1844 net.exe 64 PID 1844 wrote to memory of 1308 1844 net.exe 64 PID 1844 wrote to memory of 1308 1844 net.exe 64 PID 1844 wrote to memory of 1308 1844 net.exe 64 PID 1736 wrote to memory of 852 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 65 PID 1736 wrote to memory of 852 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 65 PID 1736 wrote to memory of 852 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 65 PID 1736 wrote to memory of 852 1736 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 65
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe"C:\Users\Admin\AppData\Local\Temp\a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies extensions of user files
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C sc delete VSS2⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\sc.exesc delete VSS3⤵
- Launches sc.exe
PID:336
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵PID:1372
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete2⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1700
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵PID:1468
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop avpsus /y2⤵PID:1944
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop avpsus /y3⤵PID:1392
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop McAfeeDLPAgentService /y2⤵PID:812
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeDLPAgentService /y3⤵PID:912
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mfewc /y2⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfewc /y3⤵PID:1308
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BMR Boot Service /y2⤵PID:1136
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BMR Boot Service /y3⤵PID:1976
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop NetBackup BMR MTFTP Service /y2⤵PID:952
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y3⤵PID:1088
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop DefWatch /y2⤵PID:744
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DefWatch /y3⤵PID:1952
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ccSetMgr /y2⤵PID:1600
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ccSetMgr /y3⤵PID:2036
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" top SavRoam /y2⤵PID:1744
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 top SavRoam /y3⤵PID:1624
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop RTVscan /y2⤵PID:1896
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RTVscan /y3⤵PID:1336
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ccEvtMgr /y2⤵PID:852
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ccEvtMgr /y3⤵PID:1064
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBIDPService /y2⤵PID:2024
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBIDPService /y3⤵PID:1308
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBFCService /y2⤵PID:1536
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBFCService /y3⤵PID:1708
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Intuit.QuickBooks.FCS /y2⤵PID:308
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y3⤵PID:2012
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBCFMonitorService /y2⤵PID:1768
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService /y3⤵PID:1064
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop YooBackup /y2⤵PID:1948
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop YooBackup /y3⤵PID:1720
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop YooIT /y2⤵PID:1628
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop YooIT /y3⤵PID:912
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop zhudongfangyu /y2⤵PID:1448
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop zhudongfangyu /y3⤵PID:1160
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop stc_raw_agent /y2⤵PID:1952
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop stc_raw_agent /y3⤵PID:1956
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VSNAPVSS /y2⤵PID:924
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VSNAPVSS /y3⤵PID:820
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamTransportSvc /y2⤵PID:1960
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y3⤵PID:1976
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamDeploymentService /y2⤵PID:2000
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y3⤵PID:1392
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamNFSSvc /y2⤵PID:452
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y3⤵PID:612
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop veeam /y2⤵PID:1308
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop veeam /y3⤵PID:820
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop PDVFSService /y2⤵PID:1088
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y3⤵PID:532
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecVSSProvider /y2⤵PID:1636
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y3⤵PID:428
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentAccelerator /y2⤵PID:644
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y3⤵PID:1176
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecDiveciMediaService /y2⤵PID:1708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService /y3⤵PID:1892
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentBrowser /y2⤵PID:1268
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y3⤵PID:544
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecJobEngine /y2⤵PID:1680
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y3⤵PID:1140
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecRPCService /y2⤵PID:1348
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y3⤵PID:1956
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecManagementService /y2⤵PID:836
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y3⤵PID:1392
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcrSch2Svc /y2⤵PID:912
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y3⤵PID:820
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcronisAgent /y2⤵PID:1368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y3⤵PID:1176
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop CASAD2DWebSvc /y2⤵PID:1720
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASAD2DWebSvc /y3⤵PID:1956
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop CAARCUpdateSvc /y2⤵PID:1584
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CAARCUpdateSvc /y3⤵PID:532
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sophos /y2⤵PID:1824
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sophos /y3⤵PID:2012
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mysql572⤵PID:936
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mysql573⤵PID:2296
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop -n apache242⤵PID:768
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop -n apache243⤵PID:544
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" wrapper2⤵PID:2004
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 wrapper3⤵PID:2256
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ccEvtMgr /y2⤵PID:2072
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ccEvtMgr /y3⤵PID:2280
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" DefWatch2⤵PID:2060
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 DefWatch3⤵PID:2500
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SavRoam /y2⤵PID:2100
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SavRoam /y3⤵PID:2908
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Sqlservr /y2⤵PID:2124
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sqlservr /y3⤵PID:2240
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ccSetMgr /y2⤵PID:2092
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ccSetMgr /y3⤵PID:2300
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sqlagent /y2⤵PID:2136
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sqlagent /y3⤵PID:2408
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sqladhlp /y2⤵PID:2152
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sqladhlp /y3⤵PID:2728
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Culserver /y2⤵PID:2164
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Culserver /y3⤵PID:2680
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop RTVscan /y2⤵PID:2188
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RTVscan /y3⤵PID:2600
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QLADHLP /y2⤵PID:2204
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QLADHLP /y3⤵PID:2548
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sqlbrowser /y2⤵PID:2196
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sqlbrowser /y3⤵PID:2488
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBIDPService /y2⤵PID:2212
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBIDPService /y3⤵PID:2908
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Intuit /y2⤵PID:2224
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Intuit /y3⤵PID:2844
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBCFMonitorService /y2⤵PID:2272
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService /y3⤵PID:2892
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop tomcat6 /y2⤵PID:2304
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop tomcat6 /y3⤵PID:2772
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop zhudongfangyu /y2⤵PID:2312
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop zhudongfangyu /y3⤵PID:3020
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop msmdsrv /y2⤵PID:2288
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msmdsrv /y3⤵PID:2820
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop FCS /y2⤵PID:2264
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FCS /y3⤵PID:2960
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QuickBooks /y2⤵PID:2248
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooks /y3⤵PID:2968
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop vmware /y2⤵PID:2336
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vmware /y3⤵PID:2944
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop vmware-converter /y2⤵PID:2344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vmware-converter /y3⤵PID:3032
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop dbsrv12 /y2⤵PID:2360
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop dbsrv12 /y3⤵PID:3048
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop dbeng8 /y2⤵PID:2368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop dbeng8 /y3⤵PID:3012
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$MICROSOFT /y2⤵PID:2376
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$MICROSOFT /y3⤵PID:1160
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ##WID /y2⤵PID:2400
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ##WID /y3⤵PID:2052
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$VEEAMSQL2012 /y2⤵PID:2424
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y3⤵PID:2020
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$VEEAMSQL2012 /y2⤵PID:2416
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y3⤵PID:1956
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLBrowser /y2⤵PID:2432
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y3⤵PID:804
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLWriter /y2⤵PID:2440
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter /y3⤵PID:1892
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop FishbowlMySQL /y2⤵PID:2448
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FishbowlMySQL /y3⤵PID:612
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$MICROSOFT /y2⤵PID:2456
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$MICROSOFT /y3⤵PID:1704
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MySQL57 /y2⤵PID:2464
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL57 /y3⤵PID:2128
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$KAV_CS_ADMIN_KIT /y2⤵PID:2472
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$KAV_CS_ADMIN_KIT /y3⤵PID:2160
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLServerADHelper100 /y2⤵PID:2480
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper100 /y3⤵PID:2648
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$KAV_CS_ADMIN_KIT /y2⤵PID:2520
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$KAV_CS_ADMIN_KIT /y3⤵PID:2192
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop msftesql /y2⤵PID:2536
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msftesql /y3⤵PID:2216
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Exchange /y2⤵PID:2556
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Exchange /y3⤵PID:2604
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$MICROSOFT##SSEE /y2⤵PID:2564
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$MICROSOFT##SSEE /y3⤵PID:2984
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$SBSMONITORING /y2⤵PID:2572
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y3⤵PID:2392
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$SHAREPOINT /y2⤵PID:2580
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y3⤵PID:2820
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLFDLauncher$SBSMONITORING /y2⤵PID:2588
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y3⤵PID:428
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBFCService /y2⤵PID:2632
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBFCService /y3⤵PID:2776
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SHAREPOINT /y2⤵PID:2624
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y3⤵PID:2308
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SHAREPOINT /y2⤵PID:2616
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y3⤵PID:2748
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SBSMONITORING /y2⤵PID:2608
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y3⤵PID:2844
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBVSS /y2⤵PID:2640
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBVSS /y3⤵PID:2760
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop YooBackup /y2⤵PID:2672
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop YooBackup /y3⤵PID:1340
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop YooIT /y2⤵PID:2696
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop YooIT /y3⤵PID:1204
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop vss /y2⤵PID:2732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vss /y3⤵PID:2688
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sql /y2⤵PID:2752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sql /y3⤵PID:2664
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop svc$ /y2⤵PID:2780
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop svc$ /y3⤵PID:2716
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL /y2⤵PID:2788
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL /y3⤵PID:2240
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$ /y2⤵PID:2796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ /y3⤵PID:2652
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop memtas /y2⤵PID:2804
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop memtas /y3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mepocs /y2⤵PID:2812
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mepocs /y3⤵PID:2660
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sophos /y2⤵PID:2828
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sophos /y3⤵PID:2976
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop veeam /y2⤵PID:2836
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop veeam /y3⤵PID:3020
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop backup /y2⤵PID:2852
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop backup /y3⤵PID:2268
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop bedbg /y2⤵PID:2860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop bedbg /y3⤵PID:2252
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop PDVFSService /y2⤵PID:2880
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y3⤵PID:3016
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecVSSProvider /y2⤵PID:2388
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y3⤵PID:2680
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentAccelerator /y2⤵PID:1640
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y3⤵PID:2652
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentBrowser /y2⤵PID:3012
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y3⤵PID:2876
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecDiveciMediaService /y2⤵PID:2960
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService /y3⤵PID:2980
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecJobEngine /y2⤵PID:2276
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y3⤵PID:1596
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecRPCService /y2⤵PID:2052
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y3⤵PID:2944
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecManagementService /y2⤵PID:3048
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y3⤵PID:2420
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MVArmor /y2⤵PID:3044
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MVArmor /y3⤵PID:2452
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MVarmor64 /y2⤵PID:820
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MVarmor64 /y3⤵PID:2936
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop stc_raw_agent /y2⤵PID:2932
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop stc_raw_agent /y3⤵PID:828
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VSNAPVSS /y2⤵PID:2300
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VSNAPVSS /y3⤵PID:2748
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamTransportSvc /y2⤵PID:1204
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y3⤵PID:2792
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamDeploymentService /y2⤵PID:2772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y3⤵PID:3004
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ARSM /y2⤵PID:1080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ARSM /y3⤵PID:2524
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcronisAgent /y2⤵PID:1160
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y3⤵PID:428
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamNFSSvc /y2⤵PID:1564
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y3⤵PID:2492
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop CAARCUpdateSvc /y2⤵PID:2768
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CAARCUpdateSvc /y3⤵PID:1340
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop CASAD2DWebSvc /y2⤵PID:2160
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASAD2DWebSvc /y3⤵PID:2676
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcrSch2Svc /y2⤵PID:3024
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y3⤵PID:3008
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop WSBExchange /y2⤵PID:2064
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WSBExchange /y3⤵PID:2112
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSExchange /y2⤵PID:2180
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchange /y3⤵PID:2612
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSExchange$ /y2⤵PID:2840
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchange$ /y3⤵PID:2596
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C sc delete VSS2⤵PID:1592
-
C:\Windows\SysWOW64\sc.exesc delete VSS3⤵
- Launches sc.exe
PID:2920
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵PID:2208
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete2⤵PID:2824
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2816
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\lsm.exe"C:\Users\Admin\AppData\Local\Temp\lsm.exe"2⤵
- Executes dropped EXE
PID:2948 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "3⤵PID:1956
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"2⤵
- Modifies Internet Explorer settings
PID:1524
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"2⤵
- Modifies Internet Explorer settings
PID:2740
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"2⤵
- Modifies Internet Explorer settings
PID:2220
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"2⤵
- Modifies Internet Explorer settings
PID:2460
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"2⤵
- Modifies Internet Explorer settings
PID:2612
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1394485415-119293568-1297475383-1909978677-2337325302057618493-6608286831361435739"1⤵PID:1140
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1775181684-811901087-1514968607-610642271-991678736209324100615230853971138918653"1⤵PID:2976
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "971462686-1561306220851916315-1115075552-4355956671128227821-2142827052-1162731263"1⤵PID:2716
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD5225edee1d46e0a80610db26b275d72fb
SHA1ce206abf11aaf19278b72f5021cc64b1b427b7e8
SHA256e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559
SHA5124f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504
-
Filesize
3B
MD5a5ea0ad9260b1550a14cc58d2c39b03d
SHA1f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA256f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
SHA5127c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74
-
Filesize
75KB
MD57065c6c8efb58c65cbf97d1139fb3998
SHA1419e901005e12fbb7f6bbbf59e1802df4db56eb2
SHA25673b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960
SHA5121f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd
-
Filesize
75KB
MD57065c6c8efb58c65cbf97d1139fb3998
SHA1419e901005e12fbb7f6bbbf59e1802df4db56eb2
SHA25673b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960
SHA5121f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd
-
Filesize
89KB
MD537d55dba7a6114449a2453a5e5357c04
SHA134ea79d82409c679e8a5c32f5c469844dd2488d7
SHA25652003dbfea65f568115dfad09aa0402df57d488ca7f9eb23c7334a51c11deb9f
SHA512d493512c768e9412047e2ece774a670f636d9b380b63b617f8516eac6ed0de219e0daebc196549fafcd756cab1d44b87dd8cd6ddae712f529295ce9794c0a75e
-
Filesize
89KB
MD537d55dba7a6114449a2453a5e5357c04
SHA134ea79d82409c679e8a5c32f5c469844dd2488d7
SHA25652003dbfea65f568115dfad09aa0402df57d488ca7f9eb23c7334a51c11deb9f
SHA512d493512c768e9412047e2ece774a670f636d9b380b63b617f8516eac6ed0de219e0daebc196549fafcd756cab1d44b87dd8cd6ddae712f529295ce9794c0a75e
-
Filesize
75KB
MD57065c6c8efb58c65cbf97d1139fb3998
SHA1419e901005e12fbb7f6bbbf59e1802df4db56eb2
SHA25673b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960
SHA5121f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd
-
Filesize
75KB
MD57065c6c8efb58c65cbf97d1139fb3998
SHA1419e901005e12fbb7f6bbbf59e1802df4db56eb2
SHA25673b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960
SHA5121f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd