Analysis
-
max time kernel
72s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2023 19:47
Behavioral task
behavioral1
Sample
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe
Resource
win10v2004-20230220-en
General
-
Target
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe
-
Size
9.3MB
-
MD5
743d9d9b3c39206b0a2de0dbb107fb7d
-
SHA1
bdff586c4ae0366813335569427b1aeda2815808
-
SHA256
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a
-
SHA512
574402c7f2eff1fdb8edcfc7a78cf741aeb20bd4775db792d44e74156e926c8e143c106623f2f024be20bd28ab46159e18b540862c4a22581c3c17ac2eb5b17c
-
SSDEEP
98304:4fXT9wuCHGLu1TIRtUOV5ZbvoVUq+kScfFbUs:NuCmTRtnvoVUq+6fFbL
Malware Config
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
https://www.getmonero.org/
https://qtox.github.io/
https://wiki.bitmessage.org/
https://github.com/Bitmessage/PyBitmessage/releases/
Signatures
-
Downloads MZ/PE file
-
Downloads PsExec from SysInternals website 1 IoCs
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.
Processes:
description flow ioc HTTP URL 25 http://live.sysinternals.com/PsExec.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Drops startup file 1 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exedescription ioc process File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Drops file in Program Files directory 64 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exedescription ioc process File opened for modification C:\Program Files\OpenSelect.xsl.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UnprotectInstall.mp4 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ClearUninstall.png f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CopyAdd.au f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CopyAdd.au.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ImportSplit.rle.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UnprotectFormat.rtf.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ConnectExit.php f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\GrantDismount.xsl f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\PublishLimit.docx.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\RemoveGroup.potm.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\PingAdd.tiff f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\PublishLimit.docx f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\WriteSkip.xml f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CompareMerge.avi.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ConnectExit.php.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ConvertToLimit.reg f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\MeasureStep.TS f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\LockRedo.emz f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\RemoveGroup.potm f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CompareClose.js.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\OptimizeUnlock.mov.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\RegisterExport.xml.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UnblockEdit.xps f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\MeasureStep.TS.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UpdateUndo.M2V f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ClearUninstall.png.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CompareMerge.avi f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ConvertFromRestart.pptx.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\DenyJoin.tif.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UpdateUndo.M2V.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ConvertToUnblock.vstm.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\DenyJoin.tif f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\EnterSend.xls f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\OptimizeUnlock.mov f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ImportWrite.gif f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\MoveRestart.php.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\OpenSelect.xsl f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SuspendUnprotect.crw f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\PingAdd.tiff.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SendEdit.mpg.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UnblockEdit.xps.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UnprotectFormat.rtf f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ExpandAdd.mpeg f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ImportNew.dotm f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\LockRedo.emz.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\MergeUpdate.potx f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ConvertFromRestart.pptx f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\GrantDismount.xsl.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UpdateComplete.midi.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ConvertToLimit.reg.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ImportResume.pcx.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SuspendUnprotect.crw.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\WriteSkip.xml.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\SendEdit.mpg f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UnprotectInstall.mp4.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ExpandAdd.mpeg.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ImportSplit.rle f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\PopMove.m3u f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\RegisterExport.xml f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\PopMove.m3u.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\UpdateComplete.midi f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\CompareClose.js f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Program Files\ConvertToUnblock.vstm f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Drops file in Windows directory 24 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exedescription ioc process File opened for modification C:\Windows\DtcInstall.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\setupact.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\setupact.log.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\win.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\WindowsShell.Manifest f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\win.ini.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\lsasetup.log.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\PFRO.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\Professional.xml.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\SysmonDrv.sys f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\system.ini.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\WindowsUpdate.log.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\WMSysPr9.prx f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File created C:\Windows\RESTORE_FILES_INFO.txt f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\lsasetup.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\mib.bin f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\PFRO.log.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\setuperr.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\SysmonDrv.sys.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\bootstat.dat f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\DtcInstall.log.[ID-9CCFD0DF].tgipus f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\Professional.xml f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\system.ini f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe File opened for modification C:\Windows\WindowsUpdate.log f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1072 sc.exe 4192 sc.exe 3596 sc.exe 980 sc.exe 264 sc.exe 4072 sc.exe 4660 sc.exe 436 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 48 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4244 taskkill.exe 3500 taskkill.exe 4764 taskkill.exe 4584 taskkill.exe 3768 taskkill.exe 1440 taskkill.exe 4748 taskkill.exe 4500 taskkill.exe 1296 taskkill.exe 1448 taskkill.exe 1372 taskkill.exe 4260 taskkill.exe 844 taskkill.exe 4128 taskkill.exe 4612 taskkill.exe 4732 taskkill.exe 3032 taskkill.exe 3752 taskkill.exe 1072 taskkill.exe 1784 taskkill.exe 1044 taskkill.exe 1820 taskkill.exe 3704 taskkill.exe 2016 taskkill.exe 2388 taskkill.exe 4020 taskkill.exe 616 taskkill.exe 3524 taskkill.exe 1108 taskkill.exe 4772 taskkill.exe 1652 taskkill.exe 4536 taskkill.exe 1516 taskkill.exe 3780 taskkill.exe 1908 taskkill.exe 2444 taskkill.exe 2588 taskkill.exe 2988 taskkill.exe 4396 taskkill.exe 4028 taskkill.exe 3696 taskkill.exe 4276 taskkill.exe 4820 taskkill.exe 2960 taskkill.exe 2028 taskkill.exe 2960 taskkill.exe 2772 taskkill.exe 3332 taskkill.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 4028 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exepid process 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeConhost.exetaskkill.exeConhost.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeTrustedInstaller.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exebackgroundTaskHost.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exesvchost.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe Token: SeDebugPrivilege 2960 taskkill.exe Token: SeDebugPrivilege 1440 taskkill.exe Token: SeDebugPrivilege 1784 taskkill.exe Token: SeDebugPrivilege 4128 taskkill.exe Token: SeDebugPrivilege 4612 taskkill.exe Token: SeDebugPrivilege 4732 taskkill.exe Token: SeDebugPrivilege 1044 taskkill.exe Token: SeDebugPrivilege 1516 taskkill.exe Token: SeDebugPrivilege 4748 taskkill.exe Token: SeDebugPrivilege 4500 Conhost.exe Token: SeDebugPrivilege 2772 taskkill.exe Token: SeDebugPrivilege 1296 Conhost.exe Token: SeDebugPrivilege 3332 taskkill.exe Token: SeDebugPrivilege 4244 taskkill.exe Token: SeDebugPrivilege 3524 taskkill.exe Token: SeDebugPrivilege 1652 taskkill.exe Token: SeDebugPrivilege 4772 taskkill.exe Token: SeDebugPrivilege 1108 taskkill.exe Token: SeDebugPrivilege 3704 TrustedInstaller.exe Token: SeDebugPrivilege 2988 taskkill.exe Token: SeDebugPrivilege 3780 taskkill.exe Token: SeDebugPrivilege 3696 taskkill.exe Token: SeDebugPrivilege 1820 taskkill.exe Token: SeDebugPrivilege 3500 backgroundTaskHost.exe Token: SeDebugPrivilege 2016 taskkill.exe Token: SeDebugPrivilege 2388 taskkill.exe Token: SeDebugPrivilege 4764 powershell.exe Token: SeDebugPrivilege 4584 taskkill.exe Token: SeDebugPrivilege 1448 taskkill.exe Token: SeDebugPrivilege 1908 taskkill.exe Token: SeDebugPrivilege 4396 taskkill.exe Token: SeDebugPrivilege 4536 svchost.exe Token: SeDebugPrivilege 4276 taskkill.exe Token: SeDebugPrivilege 844 taskkill.exe Token: SeDebugPrivilege 4260 taskkill.exe Token: SeDebugPrivilege 3032 taskkill.exe Token: SeDebugPrivilege 4028 taskkill.exe Token: SeDebugPrivilege 2444 taskkill.exe Token: SeDebugPrivilege 4020 taskkill.exe Token: SeDebugPrivilege 2588 taskkill.exe Token: SeDebugPrivilege 616 taskkill.exe Token: SeDebugPrivilege 3768 taskkill.exe Token: SeDebugPrivilege 3752 taskkill.exe Token: SeDebugPrivilege 4820 taskkill.exe Token: SeDebugPrivilege 2960 taskkill.exe Token: SeDebugPrivilege 1072 taskkill.exe Token: SeDebugPrivilege 2028 taskkill.exe Token: SeDebugPrivilege 4764 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exepid process 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exepid process 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exedescription pid process target process PID 3304 wrote to memory of 2960 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 2960 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 2960 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1564 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 3304 wrote to memory of 1564 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 3304 wrote to memory of 1564 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 3304 wrote to memory of 4888 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 3304 wrote to memory of 4888 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 3304 wrote to memory of 4888 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe reg.exe PID 3304 wrote to memory of 1340 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe schtasks.exe PID 3304 wrote to memory of 1340 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe schtasks.exe PID 3304 wrote to memory of 1340 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe schtasks.exe PID 3304 wrote to memory of 264 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 264 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 264 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 3596 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 3596 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 3596 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 980 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 980 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 980 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 1832 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe cmd.exe PID 3304 wrote to memory of 1832 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe cmd.exe PID 3304 wrote to memory of 1832 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe cmd.exe PID 3304 wrote to memory of 4072 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 4072 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 4072 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 4660 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 4660 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 4660 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 436 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 436 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 436 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 1072 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 1072 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 1072 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 4192 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 4192 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 4192 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe sc.exe PID 3304 wrote to memory of 1440 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1440 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1440 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1784 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1784 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1784 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4128 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4128 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4128 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4612 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4612 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4612 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4732 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4732 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4732 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1044 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1044 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1044 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1516 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1516 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 1516 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4748 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4748 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4748 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe taskkill.exe PID 3304 wrote to memory of 4500 3304 f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe Conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe"C:\Users\Admin\AppData\Local\Temp\f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM RaccineSettings.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2960 -
C:\Windows\SysWOW64\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F2⤵PID:1564
-
C:\Windows\SysWOW64\reg.exe"reg" delete HKCU\Software\Raccine /F2⤵
- Modifies registry key
PID:4888 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F2⤵PID:1340
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:3596 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config SSDPSRV start= auto2⤵
- Launches sc.exe
PID:980 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config Dnscache start= auto2⤵
- Launches sc.exe
PID:264 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin2⤵PID:1832
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config upnphost start= auto2⤵
- Launches sc.exe
PID:4072 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config FDResPub start= auto2⤵
- Launches sc.exe
PID:4660 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:436 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:1072 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:4192 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1784 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1440 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4128 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4612 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4732 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1044 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4748 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
PID:4500 -
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵
- Modifies Windows Firewall
PID:2204 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2772 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
PID:1296 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3332 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4244 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3524 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1652 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1108 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4772 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
PID:3704 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3780 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3696 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1820 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
PID:3500 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2388 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
PID:4764 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4584 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1448 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1908 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:1372 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4396 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
PID:4536 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4276 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4260 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:844 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3032 -
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵
- Modifies Windows Firewall
PID:2216 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4028 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2444 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4020 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2588 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:616 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3768 -
C:\Windows\SysWOW64\arp.exe"arp" -a2⤵PID:2872
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3752 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4820 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2960 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Suspicious use of AdjustPrivilegeToken
PID:4500 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1072 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Suspicious use of AdjustPrivilegeToken
PID:1296 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4764 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4028 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵PID:4628
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:32 -
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:4796
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\f6108f33ce141564f1989471bd4e9747a1bc37e6c7d242caa3163a4495c85b8a.exe2⤵PID:4260
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵PID:3340
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3704
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2KB
MD53f6565f4d1d0dbf630b2e3408b563677
SHA1fd352b27cc5192b10cc371530a4589c324c90a36
SHA256ab816bb89b275bc85821d11155ce87dc7eb75ce4cb1fcbe8413b61b1e8ed3ef0
SHA512f191ff5b5b7315be328e32fa21400498bdd6e2de6ca4d4c4e165d68e8bd3a4aadcf5f9022e67f1ebdcb980a5e84d12b9629f26fdf231e1b905d314b5fc9b86be
-
Filesize
2KB
MD53f6565f4d1d0dbf630b2e3408b563677
SHA1fd352b27cc5192b10cc371530a4589c324c90a36
SHA256ab816bb89b275bc85821d11155ce87dc7eb75ce4cb1fcbe8413b61b1e8ed3ef0
SHA512f191ff5b5b7315be328e32fa21400498bdd6e2de6ca4d4c4e165d68e8bd3a4aadcf5f9022e67f1ebdcb980a5e84d12b9629f26fdf231e1b905d314b5fc9b86be