52420eb3e32aa15b0c58d0a681b45acf124e0a79fc73c8e32222027eeceaf1b8

Analysis

max time kernel
43s
max time network
51s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/06/2023, 14:34

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Size

255KB
MD5

1933fed76a030529b141d032c0620117
SHA1

c55c60a23f5110e0b45fc02a09c4a64d3094809a
SHA256

0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4
SHA512

b153383ebd9919ff293896381d89a895c58985eef60f67803a4276026631184f4d85c19e9ea06351efb7230226b18ed9a17b533fb602e10ded518a7bd090dcfe
SSDEEP

3072:iBWxT8JtvyAuX3CGun8r8206BretpJwIiymE9xTRVhGT4z106OKclYQO565tgPYs:iBxrKA4CGu8V0tl9zVhM49OxlYQ8fD3

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\Readme.1352FF327.txt

Ransom Note

~~~ DarkRace ransomware ~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. You can install qtox to contanct us online https://tox.chat/download.html Tox ID Contact: ************************ Mail (OnionMail) Support: [email protected] >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

[email protected]

URLs

http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion

https://tox.chat/download.html

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Renames multiple (146) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\UnlockRename.tif => C:\Users\Admin\Pictures\UnlockRename.tif.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
File renamed	C:\Users\Admin\Pictures\ConvertMerge.tiff => C:\Users\Admin\Pictures\ConvertMerge.tiff.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertMerge.tiff.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
File opened for modification	C:\Users\Admin\Pictures\MeasureRemove.crw.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
File renamed	C:\Users\Admin\Pictures\ReceiveEnable.tif => C:\Users\Admin\Pictures\ReceiveEnable.tif.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
File opened for modification	C:\Users\Admin\Pictures\ReceiveEnable.tif.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
File opened for modification	C:\Users\Admin\Pictures\UnlockRename.tif.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
File renamed	C:\Users\Admin\Pictures\UnregisterPublish.tif => C:\Users\Admin\Pictures\UnregisterPublish.tif.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
File opened for modification	C:\Users\Admin\Pictures\UnregisterPublish.tif.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertMerge.tiff	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
File renamed	C:\Users\Admin\Pictures\MeasureRemove.crw => C:\Users\Admin\Pictures\MeasureRemove.crw.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe

Deletes itself 1 IoCs

pid	Process
1068	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1052	vssadmin.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
1616	taskkill.exe
1220	taskkill.exe
1612	taskkill.exe
1672	taskkill.exe
1068	taskkill.exe
268	taskkill.exe
920	taskkill.exe
212	taskkill.exe
828	taskkill.exe
1620	taskkill.exe
540	taskkill.exe
1044	taskkill.exe
820	taskkill.exe
1568	taskkill.exe
228	taskkill.exe
1440	taskkill.exe
1180	taskkill.exe
284	taskkill.exe
1900	taskkill.exe
604	taskkill.exe
1036	taskkill.exe
1748	taskkill.exe
1992	taskkill.exe
920	taskkill.exe
2044	taskkill.exe
808	taskkill.exe
1256	taskkill.exe
540	taskkill.exe
1564	taskkill.exe
1924	taskkill.exe
968	taskkill.exe
1408	taskkill.exe
1408	taskkill.exe
1084	taskkill.exe
1904	taskkill.exe
1456	taskkill.exe
1180	taskkill.exe
284	taskkill.exe
236	taskkill.exe
1728	taskkill.exe
844	taskkill.exe
1728	taskkill.exe
1620	taskkill.exe
1748	taskkill.exe
212	taskkill.exe
1924	taskkill.exe
432	taskkill.exe
480	taskkill.exe
1924	taskkill.exe
1616	taskkill.exe
1360	taskkill.exe
1440	taskkill.exe
1068	taskkill.exe
1220	taskkill.exe
1896	taskkill.exe
1584	taskkill.exe
1220	taskkill.exe
900	taskkill.exe
1088	taskkill.exe
1816	taskkill.exe
1212	taskkill.exe
232	taskkill.exe
1036	taskkill.exe
844	taskkill.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.1352FF327\ = "1352FF327file"	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file\DefaultIcon	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file\DefaultIcon\ = "C:\\ProgramData\\icon.ico"	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1356	NOTEPAD.EXE

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
820	PING.EXE
1612	PING.EXE
528	PING.EXE
296	PING.EXE
1052	PING.EXE
844	PING.EXE
520	PING.EXE
828	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	964	WMIC.exe
Token: SeSecurityPrivilege	964	WMIC.exe
Token: SeTakeOwnershipPrivilege	964	WMIC.exe
Token: SeLoadDriverPrivilege	964	WMIC.exe
Token: SeSystemProfilePrivilege	964	WMIC.exe
Token: SeSystemtimePrivilege	964	WMIC.exe
Token: SeProfSingleProcessPrivilege	964	WMIC.exe
Token: SeIncBasePriorityPrivilege	964	WMIC.exe
Token: SeCreatePagefilePrivilege	964	WMIC.exe
Token: SeBackupPrivilege	964	WMIC.exe
Token: SeRestorePrivilege	964	WMIC.exe
Token: SeShutdownPrivilege	964	WMIC.exe
Token: SeDebugPrivilege	964	WMIC.exe
Token: SeSystemEnvironmentPrivilege	964	WMIC.exe
Token: SeRemoteShutdownPrivilege	964	WMIC.exe
Token: SeUndockPrivilege	964	WMIC.exe
Token: SeManageVolumePrivilege	964	WMIC.exe
Token: 33	964	WMIC.exe
Token: 34	964	WMIC.exe
Token: 35	964	WMIC.exe
Token: SeBackupPrivilege	1468	vssvc.exe
Token: SeRestorePrivilege	1468	vssvc.exe
Token: SeAuditPrivilege	1468	vssvc.exe
Token: SeIncreaseQuotaPrivilege	964	WMIC.exe
Token: SeSecurityPrivilege	964	WMIC.exe
Token: SeTakeOwnershipPrivilege	964	WMIC.exe
Token: SeLoadDriverPrivilege	964	WMIC.exe
Token: SeSystemProfilePrivilege	964	WMIC.exe
Token: SeSystemtimePrivilege	964	WMIC.exe
Token: SeProfSingleProcessPrivilege	964	WMIC.exe
Token: SeIncBasePriorityPrivilege	964	WMIC.exe
Token: SeCreatePagefilePrivilege	964	WMIC.exe
Token: SeBackupPrivilege	964	WMIC.exe
Token: SeRestorePrivilege	964	WMIC.exe
Token: SeShutdownPrivilege	964	WMIC.exe
Token: SeDebugPrivilege	964	WMIC.exe
Token: SeSystemEnvironmentPrivilege	964	WMIC.exe
Token: SeRemoteShutdownPrivilege	964	WMIC.exe
Token: SeUndockPrivilege	964	WMIC.exe
Token: SeManageVolumePrivilege	964	WMIC.exe
Token: 33	964	WMIC.exe
Token: 34	964	WMIC.exe
Token: 35	964	WMIC.exe
Token: SeDebugPrivilege	1924	taskkill.exe
Token: SeDebugPrivilege	1592	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	808	taskkill.exe
Token: SeDebugPrivilege	1068	taskkill.exe
Token: SeDebugPrivilege	1456	taskkill.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	1896	taskkill.exe
Token: SeDebugPrivilege	1256	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeDebugPrivilege	1584	taskkill.exe
Token: SeDebugPrivilege	1440	taskkill.exe
Token: SeDebugPrivilege	480	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	1212	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1992	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	28
PID 1732 wrote to memory of 1992	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	28
PID 1732 wrote to memory of 1992	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	28
PID 1732 wrote to memory of 1992	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	28
PID 1732 wrote to memory of 1980	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	29
PID 1732 wrote to memory of 1980	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	29
PID 1732 wrote to memory of 1980	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	29
PID 1732 wrote to memory of 1980	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	29
PID 1992 wrote to memory of 964	1992	cmd.exe	32
PID 1992 wrote to memory of 964	1992	cmd.exe	32
PID 1992 wrote to memory of 964	1992	cmd.exe	32
PID 1980 wrote to memory of 1052	1980	cmd.exe	33
PID 1980 wrote to memory of 1052	1980	cmd.exe	33
PID 1980 wrote to memory of 1052	1980	cmd.exe	33
PID 1732 wrote to memory of 1960	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	38
PID 1732 wrote to memory of 1960	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	38
PID 1732 wrote to memory of 1960	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	38
PID 1732 wrote to memory of 1960	1732	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	38
PID 1960 wrote to memory of 296	1960	cmd.exe	40
PID 1960 wrote to memory of 296	1960	cmd.exe	40
PID 1960 wrote to memory of 296	1960	cmd.exe	40
PID 1960 wrote to memory of 296	1960	cmd.exe	40
PID 1960 wrote to memory of 1924	1960	cmd.exe	41
PID 1960 wrote to memory of 1924	1960	cmd.exe	41
PID 1960 wrote to memory of 1924	1960	cmd.exe	41
PID 1960 wrote to memory of 1924	1960	cmd.exe	41
PID 1960 wrote to memory of 1592	1960	cmd.exe	42
PID 1960 wrote to memory of 1592	1960	cmd.exe	42
PID 1960 wrote to memory of 1592	1960	cmd.exe	42
PID 1960 wrote to memory of 1592	1960	cmd.exe	42
PID 1960 wrote to memory of 1612	1960	cmd.exe	43
PID 1960 wrote to memory of 1612	1960	cmd.exe	43
PID 1960 wrote to memory of 1612	1960	cmd.exe	43
PID 1960 wrote to memory of 1612	1960	cmd.exe	43
PID 1960 wrote to memory of 1672	1960	cmd.exe	44
PID 1960 wrote to memory of 1672	1960	cmd.exe	44
PID 1960 wrote to memory of 1672	1960	cmd.exe	44
PID 1960 wrote to memory of 1672	1960	cmd.exe	44
PID 1960 wrote to memory of 808	1960	cmd.exe	45
PID 1960 wrote to memory of 808	1960	cmd.exe	45
PID 1960 wrote to memory of 808	1960	cmd.exe	45
PID 1960 wrote to memory of 808	1960	cmd.exe	45
PID 1960 wrote to memory of 1068	1960	cmd.exe	46
PID 1960 wrote to memory of 1068	1960	cmd.exe	46
PID 1960 wrote to memory of 1068	1960	cmd.exe	46
PID 1960 wrote to memory of 1068	1960	cmd.exe	46
PID 1960 wrote to memory of 1456	1960	cmd.exe	47
PID 1960 wrote to memory of 1456	1960	cmd.exe	47
PID 1960 wrote to memory of 1456	1960	cmd.exe	47
PID 1960 wrote to memory of 1456	1960	cmd.exe	47
PID 1960 wrote to memory of 1088	1960	cmd.exe	48
PID 1960 wrote to memory of 1088	1960	cmd.exe	48
PID 1960 wrote to memory of 1088	1960	cmd.exe	48
PID 1960 wrote to memory of 1088	1960	cmd.exe	48
PID 1960 wrote to memory of 1896	1960	cmd.exe	49
PID 1960 wrote to memory of 1896	1960	cmd.exe	49
PID 1960 wrote to memory of 1896	1960	cmd.exe	49
PID 1960 wrote to memory of 1896	1960	cmd.exe	49
PID 1960 wrote to memory of 1256	1960	cmd.exe	50
PID 1960 wrote to memory of 1256	1960	cmd.exe	50
PID 1960 wrote to memory of 1256	1960	cmd.exe	50
PID 1960 wrote to memory of 1256	1960	cmd.exe	50
PID 1960 wrote to memory of 1708	1960	cmd.exe	51
PID 1960 wrote to memory of 1708	1960	cmd.exe	51

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
"C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe"
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\cmd.exe
  cmd /c "wmic shadowcopy delete /nointeractive"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:964
- C:\Windows\system32\cmd.exe
  cmd /c "vssadmin Delete Shadows /All /Quiet"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\ProgramData\1.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1584
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:1620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:1408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:852
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:1180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:1748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:1036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:1440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:1044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:1924
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:1568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:1220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:1564
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:1408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:1992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:1924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:1900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:1068
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:1360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:1220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:1036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:1084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:1904
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:2044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:1220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "taskkill /f /im cmd.exe & taskkill /f /im conhost.exe"
  2⤵
  PID:1360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:1620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "ping 127.0.0.1 & del C:\ProgramData\1.bat & del C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe & shutdown -r -f -t 0"
  2⤵
  - Deletes itself
  PID:1068
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:528
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -f -t 0
    3⤵
    PID:212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\UnlockPing.ps1xml
1⤵
- Opens file in notepad (likely ransom note)
PID:1356

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1448

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\1.bat

Filesize
385B

MD5
4a4d03743fd3a7ee1d03d89d0e3b8011

SHA1
127d72408c87d866c72331fb0f16d13fef6a92ec

SHA256
2b15e09b98bc2835a4430c4560d3f5b25011141c9efa4331f66e9a707e2a23c0

SHA512
d26e5865bef6a7c7a5991c34ef8c0ae7e4c78c40b5f0c68f3490e89de50401e13e53321ee98def52ee7da390bcd3eb895f3ec1485a50cd63c94f0b640e1cfa60

Download Submit
C:\Users\Admin\Documents\Readme.1352FF327.txt

Filesize
1KB

MD5
4b88b5a8f74421f9c61671ec61b8eb02

SHA1
3b0534af339c362b889ba49888e61cbbb260427f

SHA256
4f8a200177e621e534dba2f5a09247a35ac47711c1f9e40f0a65649afb0ae5ac

SHA512
1fe8c1fb63a3668718ce89f822abece8a770d14e9f4ef70d702eaee0309dd34f42056eca77df242ed781259bb198b30604376a1a7fb1958e3bcb07b295a6341e

Download Submit
memory/604-76-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/1448-75-0x00000000028C0000-0x00000000028C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads