hakbit | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22-11-2023 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: uXgpTF+wZSDz6vOofNei7UPlGakMVqdsaeoyjbP0IZKlxCM7PUmUJYBEqOxY0sHVG/XiBrAmwS9ptvZk8+HGx6LMfwAVhG8YKpKKmXM3NRm9Jw7O1KZAxAWc2qO4X8beh+Zdtc9JPkj5XZn+3DyT3QPuaf90HyTixroqsA+imni1/a/z59xQc8g0LLgduuaicqM+XkiVJPPSyPMxEdJuVsTh3FhFYiaFDoGmj5d2PjzXm8HtwxoVqb2c8hlXuyc1pUw4EGCN3A7R8OAkes3vGfKTpHkaGyJcO+FkNXuKH7UxxCSv5qucz8FJmslYlfB0a/Gq8zuN3E+ECfCR5WW67QohlEIc6Pt6/QC03eat6zfk6/ib5cmsgohDMUc8FMvVgl5gVttk9VijX9HxvKbR1mIhKPI4uCzETcl2u2D0qLmlU1ImGUovy8HxZJ22FVuYE1oFE5UF8BHNjiR8ezaeITszr/vLG5Z3OFCK1wu7ne5fKeA7BgsMUZRDsduWCRXsqpj8jYa5zx7EUC15mtPFGJvLyro/5fbBZ1Msb9aPNc91LUMQaLlTtg42SeA20NXtWqXX2zPGXmGi8RWc7vBwMRqXqSpGtA1R85oku0wIxirgYIO9rtQAgEzP46jVUxQ+3pP96O2HrmtlrJLvT/HukH8ePzR/05n2vMTDlJk76xk= Number of files that were processed is: 505

Emails

[email protected]

Signatures

Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Renames multiple (54) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

3988 cmd.exe

pid	process
3988	cmd.exe

Drops startup file 1 IoCs

Processes:

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

2728 sc.exe
2736 sc.exe
2840 sc.exe
2844 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2728	sc.exe
2736	sc.exe
2840	sc.exe
2844	sc.exe

Kills process with taskkill 47 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1144	taskkill.exe
2844	taskkill.exe
1648	taskkill.exe
2764	taskkill.exe
2956	taskkill.exe
2656	taskkill.exe
2732	taskkill.exe
2476	taskkill.exe
2420	taskkill.exe
1320	taskkill.exe
1452	taskkill.exe
2924	taskkill.exe
336	taskkill.exe
1716	taskkill.exe
2832	taskkill.exe
2720	taskkill.exe
2884	taskkill.exe
2464	taskkill.exe
2628	taskkill.exe
2828	taskkill.exe
2836	taskkill.exe
2620	taskkill.exe
2684	taskkill.exe
680	taskkill.exe
2028	taskkill.exe
2472	taskkill.exe
1324	taskkill.exe
468	taskkill.exe
2164	taskkill.exe
1508	taskkill.exe
2948	taskkill.exe
780	taskkill.exe
572	taskkill.exe
2992	taskkill.exe
2748	taskkill.exe
576	taskkill.exe
2724	taskkill.exe
2616	taskkill.exe
2688	taskkill.exe
3036	taskkill.exe
552	taskkill.exe
2008	taskkill.exe
2624	taskkill.exe
2796	taskkill.exe
1108	taskkill.exe
2576	taskkill.exe
2716	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

3620 notepad.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

436 PING.EXE

pid	process
3620	notepad.exe

pid	process
436	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

pid	process
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Token: SeDebugPrivilege	2008	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	2836	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	2616	taskkill.exe
Token: SeDebugPrivilege	1508	taskkill.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	2620	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	1452	taskkill.exe
Token: SeDebugPrivilege	576	taskkill.exe
Token: SeDebugPrivilege	680	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	552	taskkill.exe
Token: SeDebugPrivilege	2948	taskkill.exe
Token: SeDebugPrivilege	1648	taskkill.exe
Token: SeDebugPrivilege	1108	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	336	taskkill.exe
Token: SeDebugPrivilege	2576	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	780	taskkill.exe
Token: SeDebugPrivilege	2796	taskkill.exe
Token: SeDebugPrivilege	1324	taskkill.exe
Token: SeDebugPrivilege	3096	powershell.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	468	taskkill.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	2716	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	1144	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	2884	taskkill.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

pid process

2516 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

pid process

2516 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

description	pid	process	target process
PID 2516 wrote to memory of 2376	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	cmd.exe
PID 2516 wrote to memory of 2376	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	cmd.exe
PID 2516 wrote to memory of 2376	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	cmd.exe
PID 2516 wrote to memory of 2728	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2728	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2728	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2736	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2736	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2736	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2840	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2840	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2840	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2844	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2844	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2844	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	sc.exe
PID 2516 wrote to memory of 2836	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2836	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2836	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 1648	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 1648	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 1648	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2828	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2828	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2828	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2796	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2796	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2796	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2720	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2720	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2720	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 1320	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 1320	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 1320	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2764	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2764	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2764	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2748	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2748	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2748	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2616	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2616	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2616	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2724	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2724	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2724	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2628	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2628	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2628	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2576	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2576	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2576	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2624	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2624	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2624	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2656	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2656	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2656	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 1452	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 1452	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 1452	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2472	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2472	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2472	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe
PID 2516 wrote to memory of 2008	2516	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:2376
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2736
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:2840
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2844
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:2728
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:576
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:780
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:680
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:572
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:336
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1716
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3096
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  2⤵
  - Deletes itself
  PID:3988
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:2212
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:2992
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:436
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]

Filesize
16B

MD5
3872e6da3e3df247ddb1285a5fbba9bd

SHA1
23d65171f1f7a75720917cfbc5cf009726d8b444

SHA256
812d0382c254cdc5ea1c20d1a83c15e9f30f755a414e05ff6f0e9b9962283ab7

SHA512
67f5002c8d6538fc0589706cf8f45a7ae3da4671d0b1bddaa0e23173c4a31e5f1876904b38e2be81feded29393d24940348a15b10da68896194758dc6f1d9742

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
051cbed4f831d56c95b5ece4d122de80

SHA1
39ee561052710f8c460e12e893c33b128f12acab

SHA256
acc2b099608e4ebd4e89ff087421782e7ed29067f1258dcbceb494e0adf63863

SHA512
8afb14b8bc891a8c6589ce16831d4d02e8a58ba2aeb4c3638bf8e5f7095a8bbc1e0e33e458d77ed86008695e0e96ea6866c6a7ffb8fe9a38040e36004e904684

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f38825da0a00e4976f8b3eb36cc7660

SHA1
3fa2d2d6ec83059711e834c97581c9821bdfda07

SHA256
41310d964fff62e611af056896f8e1ec1b1f088342a2f4631c45c583c8484005

SHA512
b7e98f310bdf659f1126cc91f4e366f8889b68935b29a06a36a62a5841eb3318579506d2d599e83cc960ce810edc5e6529b4295dae8f870292c3cb2f50afd101

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
1600d1b29c8af566db265b7e81472a38

SHA1
f9061fc93921e42d7623abec4ae551debe2e482c

SHA256
8f99c1e0a0fab100c54241f46e6ee5165d580956eff125dc8cd1c956a5e72b46

SHA512
956cff967f2fb00e532cdc61764783a1a7e7ca2566495f87bfa10216298c89a05c9f656b8b9745ed1e4c7b8fc345b3411c83640d5c3507abe4766a70ebb75e68

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
1600d1b29c8af566db265b7e81472a38

SHA1
f9061fc93921e42d7623abec4ae551debe2e482c

SHA256
8f99c1e0a0fab100c54241f46e6ee5165d580956eff125dc8cd1c956a5e72b46

SHA512
956cff967f2fb00e532cdc61764783a1a7e7ca2566495f87bfa10216298c89a05c9f656b8b9745ed1e4c7b8fc345b3411c83640d5c3507abe4766a70ebb75e68

Download Submit
memory/2516-458-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2516-1-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2516-2-0x000000001ACE0000-0x000000001AD60000-memory.dmp

Filesize
512KB

Download
memory/2516-0-0x00000000000F0000-0x000000000010A000-memory.dmp

Filesize
104KB

Download
memory/2516-655-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2516-481-0x000000001ACE0000-0x000000001AD60000-memory.dmp

Filesize
512KB

Download
memory/3096-10-0x0000000002470000-0x0000000002478000-memory.dmp

Filesize
32KB

Download
memory/3096-17-0x0000000002554000-0x0000000002557000-memory.dmp

Filesize
12KB

Download
memory/3096-14-0x000007FEF1BE0000-0x000007FEF257D000-memory.dmp

Filesize
9.6MB

Download
memory/3096-18-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/3096-16-0x000007FEF1BE0000-0x000007FEF257D000-memory.dmp

Filesize
9.6MB

Download
memory/3096-9-0x000000001B380000-0x000000001B662000-memory.dmp

Filesize
2.9MB

Download