ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db

Resubmissions

03/08/2023, 10:09

230803-l66h5scg59 9

03/08/2023, 08:13

230803-j4rabscb95 9

03/08/2023, 08:07

230803-jz65zscb64 9

Analysis

max time kernel
363s
max time network
369s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
03/08/2023, 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
Size

6.1MB
MD5

a0fea954561663f60059420e6c78fa5c
SHA1

d5d37ae269008e9bfddc171c3b05bd3d43a5cd4d
SHA256

ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db
SHA512

bda26b069df556e88a763c3fc77990d13c73b2d314333db60ec8fc06091fd656c235fbd46eb8c2ea5287fcdbbb413cb3a550f2475a4ad95894a67ae5b130df50
SSDEEP

196608:iMa/eLKguAgyc2gcnhcPQwjQwX746VYx:zuAs2guc4FfNx

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Loads dropped DLL 31 IoCs

pid	Process
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3060	sc.exe
2272	sc.exe
2192	sc.exe
1516	sc.exe
1140	sc.exe
756	sc.exe
2236	sc.exe
2496	sc.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
968	vssadmin.exe

Kills process with taskkill 30 IoCs

evasion

pid	Process
2412	taskkill.exe
2948	taskkill.exe
852	taskkill.exe
540	taskkill.exe
2560	taskkill.exe
2940	taskkill.exe
1472	taskkill.exe
2316	taskkill.exe
1708	taskkill.exe
1788	taskkill.exe
2844	taskkill.exe
528	taskkill.exe
1724	taskkill.exe
1480	taskkill.exe
1444	taskkill.exe
1608	taskkill.exe
2764	taskkill.exe
1920	taskkill.exe
2160	taskkill.exe
2436	taskkill.exe
2700	taskkill.exe
400	taskkill.exe
1668	taskkill.exe
2216	taskkill.exe
1532	taskkill.exe
2736	taskkill.exe
2592	taskkill.exe
1116	taskkill.exe
992	taskkill.exe
1596	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11DEF6C1-31E6-11EE-AD27-CEA1BEF6F4E2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b02100000000020000000000106600000001000020000000a0dfd634411e5de54fb499d22269293f167daa61dad829de8d124420b9eec4dc000000000e80000000020000200000008f74ab08998b6eca1fe981030aac7ca61feb88e4c1d9a68894219ee69debd906900000002973329f5ce043590ae75691af5b3345761e9819e7af188dfae14601e988feee66d369029ac3e7123dd984c83d20cc59e391f565a2b8b3c5412c29be66ea3350d360114b5c9a1ee4969eb8db7412ee2c0f9cdcd1a77bf99020c527d254c3f6a932eded211a3d8ac703688c4a8e8e530de020a12003675ab3ca8db12c3be91d9938af8cb9e6d1e728b5f3159be0a850984000000075b2f39944a9b45890bdd7fefa097bc32cef193f47b677792e422a9810ae2a0c39ad17325083b36cb3005093da145c73ae8a46212b04ca4c97aa3e246b05648b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409eb5e6f2c5d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397219343"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b021000000000200000000001066000000010000200000004a3929ce56a102a5fdf0275ab769020e6c6e25c6c3d8e433eb43bbea5e36c799000000000e80000000020000200000006207cf61cd8a118544126b532e696add65effa2a397b911539dd8b1898881f4320000000e8b854f92ecf6c2c1d32f8ff6bcef8dcdad52b1582b6397c9c0cb52902b420e840000000b1615fe6a7bbf5868fc9bec85d374988058f78ced9cdd32591e68fa1829773c761ba6846a4272f02b0afab723285c255454b3f4a5ddeb7ccc2ad93bb61cb9cbc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	taskkill.exe
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeDebugPrivilege	1116	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	400	taskkill.exe
Token: SeDebugPrivilege	1480	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeDebugPrivilege	992	taskkill.exe
Token: SeDebugPrivilege	1444	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	2160	taskkill.exe
Token: SeDebugPrivilege	1596	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	2436	taskkill.exe
Token: SeDebugPrivilege	2948	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	1472	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	528	taskkill.exe
Token: SeDebugPrivilege	852	taskkill.exe
Token: SeDebugPrivilege	1920	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2864	2420	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	29
PID 2420 wrote to memory of 2864	2420	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	29
PID 2420 wrote to memory of 2864	2420	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	29
PID 2420 wrote to memory of 2864	2420	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	29
PID 2864 wrote to memory of 1104	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	30
PID 2864 wrote to memory of 1104	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	30
PID 2864 wrote to memory of 1104	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	30
PID 2864 wrote to memory of 1104	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	30
PID 1104 wrote to memory of 2536	1104	cmd.exe	31
PID 1104 wrote to memory of 2536	1104	cmd.exe	31
PID 1104 wrote to memory of 2536	1104	cmd.exe	31
PID 1104 wrote to memory of 2536	1104	cmd.exe	31
PID 2536 wrote to memory of 2336	2536	net.exe	32
PID 2536 wrote to memory of 2336	2536	net.exe	32
PID 2536 wrote to memory of 2336	2536	net.exe	32
PID 2536 wrote to memory of 2336	2536	net.exe	32
PID 2864 wrote to memory of 2512	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	33
PID 2864 wrote to memory of 2512	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	33
PID 2864 wrote to memory of 2512	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	33
PID 2864 wrote to memory of 2512	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	33
PID 2512 wrote to memory of 2236	2512	cmd.exe	34
PID 2512 wrote to memory of 2236	2512	cmd.exe	34
PID 2512 wrote to memory of 2236	2512	cmd.exe	34
PID 2512 wrote to memory of 2236	2512	cmd.exe	34
PID 2864 wrote to memory of 2556	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	35
PID 2864 wrote to memory of 2556	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	35
PID 2864 wrote to memory of 2556	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	35
PID 2864 wrote to memory of 2556	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	35
PID 2556 wrote to memory of 2584	2556	cmd.exe	36
PID 2556 wrote to memory of 2584	2556	cmd.exe	36
PID 2556 wrote to memory of 2584	2556	cmd.exe	36
PID 2556 wrote to memory of 2584	2556	cmd.exe	36
PID 2584 wrote to memory of 2596	2584	net.exe	37
PID 2584 wrote to memory of 2596	2584	net.exe	37
PID 2584 wrote to memory of 2596	2584	net.exe	37
PID 2584 wrote to memory of 2596	2584	net.exe	37
PID 2864 wrote to memory of 2988	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	38
PID 2864 wrote to memory of 2988	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	38
PID 2864 wrote to memory of 2988	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	38
PID 2864 wrote to memory of 2988	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	38
PID 2988 wrote to memory of 2496	2988	cmd.exe	39
PID 2988 wrote to memory of 2496	2988	cmd.exe	39
PID 2988 wrote to memory of 2496	2988	cmd.exe	39
PID 2988 wrote to memory of 2496	2988	cmd.exe	39
PID 2864 wrote to memory of 2284	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	40
PID 2864 wrote to memory of 2284	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	40
PID 2864 wrote to memory of 2284	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	40
PID 2864 wrote to memory of 2284	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	40
PID 2284 wrote to memory of 2660	2284	cmd.exe	41
PID 2284 wrote to memory of 2660	2284	cmd.exe	41
PID 2284 wrote to memory of 2660	2284	cmd.exe	41
PID 2284 wrote to memory of 2660	2284	cmd.exe	41
PID 2660 wrote to memory of 2688	2660	net.exe	42
PID 2660 wrote to memory of 2688	2660	net.exe	42
PID 2660 wrote to memory of 2688	2660	net.exe	42
PID 2660 wrote to memory of 2688	2660	net.exe	42
PID 2864 wrote to memory of 2952	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	43
PID 2864 wrote to memory of 2952	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	43
PID 2864 wrote to memory of 2952	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	43
PID 2864 wrote to memory of 2952	2864	ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe	43
PID 2952 wrote to memory of 3060	2952	cmd.exe	44
PID 2952 wrote to memory of 3060	2952	cmd.exe	44
PID 2952 wrote to memory of 3060	2952	cmd.exe	44
PID 2952 wrote to memory of 3060	2952	cmd.exe	44

C:\Users\Admin\AppData\Local\Temp\ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
"C:\Users\Admin\AppData\Local\Temp\ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe
  "C:\Users\Admin\AppData\Local\Temp\ce5cf3b964e636d546bf2c52423296bda06b7fe47e6f8a757f165a3be93c88db.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop svc$ 2> NUL 1> NUL
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\SysWOW64\net.exe
      net stop svc$
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop svc$
        5⤵
        
        PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config svc$ start= disabled 2> NUL 1> NUL
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\SysWOW64\sc.exe
      sc config svc$ start= disabled
      4⤵
      Launches sc.exe
      PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop vss 2> NUL 1> NUL
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\net.exe
      net stop vss
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop vss
        5⤵
        
        PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config vss start= disabled 2> NUL 1> NUL
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\SysWOW64\sc.exe
      sc config vss start= disabled
      4⤵
      Launches sc.exe
      PID:2496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop sophos 2> NUL 1> NUL
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\SysWOW64\net.exe
      net stop sophos
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sophos
        5⤵
        
        PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config sophos start= disabled 2> NUL 1> NUL
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\SysWOW64\sc.exe
      sc config sophos start= disabled
      4⤵
      Launches sc.exe
      PID:3060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop mepocs 2> NUL 1> NUL
    3⤵
    PID:3064
  - - C:\Windows\SysWOW64\net.exe
      net stop mepocs
      4⤵
      PID:2156
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop mepocs
        5⤵
        
        PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config mepocs start= disabled 2> NUL 1> NUL
    3⤵
    PID:2768
  - - C:\Windows\SysWOW64\sc.exe
      sc config mepocs start= disabled
      4⤵
      Launches sc.exe
      PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop backup 2> NUL 1> NUL
    3⤵
    PID:3040
  - - C:\Windows\SysWOW64\net.exe
      net stop backup
      4⤵
      PID:2788
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop backup
        5⤵
        
        PID:2992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config backup start= disabled 2> NUL 1> NUL
    3⤵
    PID:2140
  - - C:\Windows\SysWOW64\sc.exe
      sc config backup start= disabled
      4⤵
      Launches sc.exe
      PID:2192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop sql 2> NUL 1> NUL
    3⤵
    PID:2248
  - - C:\Windows\SysWOW64\net.exe
      net stop sql
      4⤵
      PID:2144
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sql
        5⤵
        
        PID:2148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config sql start= disabled 2> NUL 1> NUL
    3⤵
    PID:2616
  - - C:\Windows\SysWOW64\sc.exe
      sc config sql start= disabled
      4⤵
      Launches sc.exe
      PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop memtas 2> NUL 1> NUL
    3⤵
    PID:1420
  - - C:\Windows\SysWOW64\net.exe
      net stop memtas
      4⤵
      PID:2304
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop memtas
        5⤵
        
        PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config memtas start= disabled 2> NUL 1> NUL
    3⤵
    PID:1136
  - - C:\Windows\SysWOW64\sc.exe
      sc config memtas start= disabled
      4⤵
      Launches sc.exe
      PID:1140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop veeam 2> NUL 1> NUL
    3⤵
    PID:1108
  - - C:\Windows\SysWOW64\net.exe
      net stop veeam
      4⤵
      PID:1780
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop veeam
        5⤵
        
        PID:2624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config veeam start= disabled 2> NUL 1> NUL
    3⤵
    PID:1076
  - - C:\Windows\SysWOW64\sc.exe
      sc config veeam start= disabled
      4⤵
      Launches sc.exe
      PID:756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im outlook.exe 2> NUL 1> NUL
    3⤵
    PID:1768
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im outlook.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im agntsvc.exe 2> NUL 1> NUL
    3⤵
    PID:2064
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im agntsvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im infopath.exe 2> NUL 1> NUL
    3⤵
    PID:2176
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im infopath.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im sqbcoreservice.exe 2> NUL 1> NUL
    3⤵
    PID:1276
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqbcoreservice.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im steam.exe 2> NUL 1> NUL
    3⤵
    PID:820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im steam.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im firefox.exe 2> NUL 1> NUL
    3⤵
    PID:1740
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ocomm.exe 2> NUL 1> NUL
    3⤵
    PID:1540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ocomm.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ocssd.exe 2> NUL 1> NUL
    3⤵
    PID:696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ocssd.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im mydesktopqos.exe 2> NUL 1> NUL
    3⤵
    PID:2052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mydesktopqos.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im oracle.exe 2> NUL 1> NUL
    3⤵
    PID:1820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im oracle.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im powerpnt.exe 2> NUL 1> NUL
    3⤵
    PID:1416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im powerpnt.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im wordpad.exe 2> NUL 1> NUL
    3⤵
    PID:888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wordpad.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im synctime.exe 2> NUL 1> NUL
    3⤵
    PID:1896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im synctime.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im sql.exe 2> NUL 1> NUL
    3⤵
    PID:1096
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sql.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im thebat.exe 2> NUL 1> NUL
    3⤵
    PID:2488
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im thebat.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im onenote.exe 2> NUL 1> NUL
    3⤵
    PID:2676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im onenote.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im excel.exe 2> NUL 1> NUL
    3⤵
    PID:2332
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im excel.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im visio.exe 2> NUL 1> NUL
    3⤵
    PID:1980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im visio.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im encsvc.exe 2> NUL 1> NUL
    3⤵
    PID:2808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im encsvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im winword.exe 2> NUL 1> NUL
    3⤵
    PID:2912
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im winword.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im mydesktopservice.exe 2> NUL 1> NUL
    3⤵
    PID:2852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mydesktopservice.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im dbsnmp.exe 2> NUL 1> NUL
    3⤵
    PID:2932
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im dbsnmp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im isqlplussvc.exe 2> NUL 1> NUL
    3⤵
    PID:1584
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im isqlplussvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im tbirdconfig.exe 2> NUL 1> NUL
    3⤵
    PID:2868
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tbirdconfig.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im mspub.exe 2> NUL 1> NUL
    3⤵
    PID:2664
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mspub.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im msaccess.exe 2> NUL 1> NUL
    3⤵
    PID:2744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im msaccess.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im thunderbird.exe 2> NUL 1> NUL
    3⤵
    PID:1500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im thunderbird.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ocautoupds.exe 2> NUL 1> NUL
    3⤵
    PID:380
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ocautoupds.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im xfssvccon.exe 2> NUL 1> NUL
    3⤵
    PID:1192
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im xfssvccon.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im dbeng50.exe 2> NUL 1> NUL
    3⤵
    PID:300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im dbeng50.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all 2> NUL 1> NUL
    3⤵
    PID:1432
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all
      4⤵
      Interacts with shadow copies
      PID:968

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\9448bf8fef4c8642124a6ba091cebe8a-readme.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact