7ae4167445cef80f080de5b84c6490a61c1834aa1e05fce43e611c5d054da858

Analysis

max time kernel
52s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 15:38

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4/0e60d49a967599fab179f8c885d91db2501.exe
Size

255KB
MD5

1933fed76a030529b141d032c0620117
SHA1

c55c60a23f5110e0b45fc02a09c4a64d3094809a
SHA256

0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4
SHA512

b153383ebd9919ff293896381d89a895c58985eef60f67803a4276026631184f4d85c19e9ea06351efb7230226b18ed9a17b533fb602e10ded518a7bd090dcfe
SSDEEP

3072:iBWxT8JtvyAuX3CGun8r8206BretpJwIiymE9xTRVhGT4z106OKclYQO565tgPYs:iBxrKA4CGu8V0tl9zVhM49OxlYQ8fD3

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Music\Readme.1352FF327.txt

Ransom Note

~~~ DarkRace ransomware ~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. You can install qtox to contanct us online https://tox.chat/download.html Tox ID Contact: ************************ Mail (OnionMail) Support: darkrace@onionmail.org >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

darkrace@onionmail.org

URLs

http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion

https://tox.chat/download.html

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (149) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

0e60d49a967599fab179f8c885d91db2501.exe

description ioc process

File opened (read-only) \??\F: 0e60d49a967599fab179f8c885d91db2501.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2604 4256 WerFault.exe 0e60d49a967599fab179f8c885d91db2501.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

4996 vssadmin.exe

description	ioc	process
File opened (read-only)	\??\F:	0e60d49a967599fab179f8c885d91db2501.exe

pid	pid_target	process	target process
2604	4256	WerFault.exe	0e60d49a967599fab179f8c885d91db2501.exe

pid	process
4996	vssadmin.exe

Kills process with taskkill 63 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4808	taskkill.exe
3432	taskkill.exe
3200	taskkill.exe
5088	taskkill.exe
3640	taskkill.exe
3912	taskkill.exe
1680	taskkill.exe
3540	taskkill.exe
3688	taskkill.exe
4604	taskkill.exe
4132	taskkill.exe
384	taskkill.exe
2468	taskkill.exe
4476	taskkill.exe
2284	taskkill.exe
3316	taskkill.exe
632	taskkill.exe
3852	taskkill.exe
3540	taskkill.exe
2908	taskkill.exe
912	taskkill.exe
4536	taskkill.exe
4448	taskkill.exe
4836	taskkill.exe
3640	taskkill.exe
2352	taskkill.exe
3080	taskkill.exe
4840	taskkill.exe
3496	taskkill.exe
2152	taskkill.exe
2340	taskkill.exe
284	taskkill.exe
4712	taskkill.exe
1680	taskkill.exe
3068	taskkill.exe
3568	taskkill.exe
2828	taskkill.exe
2300	taskkill.exe
1816	taskkill.exe
1720	taskkill.exe
832	taskkill.exe
4332	taskkill.exe
4984	taskkill.exe
3452	taskkill.exe
1072	taskkill.exe
3388	taskkill.exe
4176	taskkill.exe
4332	taskkill.exe
4616	taskkill.exe
3536	taskkill.exe
636	taskkill.exe
3432	taskkill.exe
4052	taskkill.exe
4388	taskkill.exe
4392	taskkill.exe
4712	taskkill.exe
884	taskkill.exe
1948	taskkill.exe
1728	taskkill.exe
2724	taskkill.exe
3988	taskkill.exe
2152	taskkill.exe
2440	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "161"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 5 IoCs

Processes:

0e60d49a967599fab179f8c885d91db2501.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.1352FF327	0e60d49a967599fab179f8c885d91db2501.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.1352FF327\ = "1352FF327file"	0e60d49a967599fab179f8c885d91db2501.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file\DefaultIcon	0e60d49a967599fab179f8c885d91db2501.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file	0e60d49a967599fab179f8c885d91db2501.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file\DefaultIcon\ = "C:\\ProgramData\\icon.ico"	0e60d49a967599fab179f8c885d91db2501.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

4616 PING.EXE
4700 PING.EXE
1948 PING.EXE
4388 PING.EXE
1784 PING.EXE
4828 PING.EXE

pid	process
4616	PING.EXE
4700	PING.EXE
1948	PING.EXE
4388	PING.EXE
1784	PING.EXE
4828	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exevssvc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1460	WMIC.exe
Token: SeSecurityPrivilege	1460	WMIC.exe
Token: SeTakeOwnershipPrivilege	1460	WMIC.exe
Token: SeLoadDriverPrivilege	1460	WMIC.exe
Token: SeSystemProfilePrivilege	1460	WMIC.exe
Token: SeSystemtimePrivilege	1460	WMIC.exe
Token: SeProfSingleProcessPrivilege	1460	WMIC.exe
Token: SeIncBasePriorityPrivilege	1460	WMIC.exe
Token: SeCreatePagefilePrivilege	1460	WMIC.exe
Token: SeBackupPrivilege	1460	WMIC.exe
Token: SeRestorePrivilege	1460	WMIC.exe
Token: SeShutdownPrivilege	1460	WMIC.exe
Token: SeDebugPrivilege	1460	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1460	WMIC.exe
Token: SeRemoteShutdownPrivilege	1460	WMIC.exe
Token: SeUndockPrivilege	1460	WMIC.exe
Token: SeManageVolumePrivilege	1460	WMIC.exe
Token: 33	1460	WMIC.exe
Token: 34	1460	WMIC.exe
Token: 35	1460	WMIC.exe
Token: 36	1460	WMIC.exe
Token: SeBackupPrivilege	824	vssvc.exe
Token: SeRestorePrivilege	824	vssvc.exe
Token: SeAuditPrivilege	824	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1460	WMIC.exe
Token: SeSecurityPrivilege	1460	WMIC.exe
Token: SeTakeOwnershipPrivilege	1460	WMIC.exe
Token: SeLoadDriverPrivilege	1460	WMIC.exe
Token: SeSystemProfilePrivilege	1460	WMIC.exe
Token: SeSystemtimePrivilege	1460	WMIC.exe
Token: SeProfSingleProcessPrivilege	1460	WMIC.exe
Token: SeIncBasePriorityPrivilege	1460	WMIC.exe
Token: SeCreatePagefilePrivilege	1460	WMIC.exe
Token: SeBackupPrivilege	1460	WMIC.exe
Token: SeRestorePrivilege	1460	WMIC.exe
Token: SeShutdownPrivilege	1460	WMIC.exe
Token: SeDebugPrivilege	1460	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1460	WMIC.exe
Token: SeRemoteShutdownPrivilege	1460	WMIC.exe
Token: SeUndockPrivilege	1460	WMIC.exe
Token: SeManageVolumePrivilege	1460	WMIC.exe
Token: 33	1460	WMIC.exe
Token: 34	1460	WMIC.exe
Token: 35	1460	WMIC.exe
Token: 36	1460	WMIC.exe
Token: SeDebugPrivilege	3540	taskkill.exe
Token: SeDebugPrivilege	4808	taskkill.exe
Token: SeDebugPrivilege	4536	taskkill.exe
Token: SeDebugPrivilege	2340	taskkill.exe
Token: SeDebugPrivilege	3080	taskkill.exe
Token: SeDebugPrivilege	2468	taskkill.exe
Token: SeDebugPrivilege	3568	taskkill.exe
Token: SeDebugPrivilege	4388	taskkill.exe
Token: SeDebugPrivilege	3536	taskkill.exe
Token: SeDebugPrivilege	4984	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	3452	taskkill.exe
Token: SeDebugPrivilege	4332	taskkill.exe
Token: SeDebugPrivilege	284	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	4712	taskkill.exe
Token: SeDebugPrivilege	3316	taskkill.exe
Token: SeDebugPrivilege	2352	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

3552 LogonUI.exe

pid	process
3552	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0e60d49a967599fab179f8c885d91db2501.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4256 wrote to memory of 5020	4256	0e60d49a967599fab179f8c885d91db2501.exe	cmd.exe
PID 4256 wrote to memory of 5020	4256	0e60d49a967599fab179f8c885d91db2501.exe	cmd.exe
PID 4256 wrote to memory of 912	4256	0e60d49a967599fab179f8c885d91db2501.exe	cmd.exe
PID 4256 wrote to memory of 912	4256	0e60d49a967599fab179f8c885d91db2501.exe	cmd.exe
PID 5020 wrote to memory of 1460	5020	cmd.exe	WMIC.exe
PID 5020 wrote to memory of 1460	5020	cmd.exe	WMIC.exe
PID 912 wrote to memory of 4996	912	cmd.exe	vssadmin.exe
PID 912 wrote to memory of 4996	912	cmd.exe	vssadmin.exe
PID 4256 wrote to memory of 4592	4256	0e60d49a967599fab179f8c885d91db2501.exe	cmd.exe
PID 4256 wrote to memory of 4592	4256	0e60d49a967599fab179f8c885d91db2501.exe	cmd.exe
PID 4256 wrote to memory of 4592	4256	0e60d49a967599fab179f8c885d91db2501.exe	cmd.exe
PID 4592 wrote to memory of 4616	4592	cmd.exe	PING.EXE
PID 4592 wrote to memory of 4616	4592	cmd.exe	PING.EXE
PID 4592 wrote to memory of 4616	4592	cmd.exe	PING.EXE
PID 4592 wrote to memory of 3540	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3540	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3540	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4808	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4808	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4808	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4536	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4536	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4536	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 2340	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 2340	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 2340	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3080	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3080	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3080	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 2468	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 2468	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 2468	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3568	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3568	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3568	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4388	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4388	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4388	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3536	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3536	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3536	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4984	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4984	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4984	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4840	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4840	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4840	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3452	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3452	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 3452	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4332	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4332	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4332	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4700	4592	cmd.exe	PING.EXE
PID 4592 wrote to memory of 4700	4592	cmd.exe	PING.EXE
PID 4592 wrote to memory of 4700	4592	cmd.exe	PING.EXE
PID 4592 wrote to memory of 284	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 284	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 284	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 1072	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 1072	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 1072	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4712	4592	cmd.exe	taskkill.exe
PID 4592 wrote to memory of 4712	4592	cmd.exe	taskkill.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4\0e60d49a967599fab179f8c885d91db2501.exe
"C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4\0e60d49a967599fab179f8c885d91db2501.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4256

C:\Windows\SYSTEM32\cmd.exe
cmd /c "wmic shadowcopy delete /nointeractive"
2⤵
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\SYSTEM32\cmd.exe
cmd /c "vssadmin Delete Shadows /All /Quiet"
2⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\system32\vssadmin.exe
vssadmin Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:4996

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\ProgramData\1.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:4592

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
3⤵
- Runs ping.exe
PID:4616

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sql*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im oracle*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysq*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im veeam*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im firefox*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msaccess*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im onenote*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im outlook*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im powerpnt*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im winword*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wuauclt*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4332

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
3⤵
- Runs ping.exe
PID:4700

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sql*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:284

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im oracle*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysq*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im veeam*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im firefox*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel*
3⤵
- Kills process with taskkill
PID:3432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msaccess*
3⤵
- Kills process with taskkill
PID:3688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im onenote*
3⤵
- Kills process with taskkill
PID:3540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im outlook*
3⤵
- Kills process with taskkill
PID:1680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im powerpnt*
3⤵
- Kills process with taskkill
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im winword*
3⤵
- Kills process with taskkill
PID:3388

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wuauclt*
3⤵
- Kills process with taskkill
PID:884

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
3⤵
- Runs ping.exe
PID:1948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sql*
3⤵
- Kills process with taskkill
PID:2300

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im oracle*
3⤵
- Kills process with taskkill
PID:636

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysq*
3⤵
- Kills process with taskkill
PID:1816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome*
3⤵
- Kills process with taskkill
PID:3200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im veeam*
3⤵
- Kills process with taskkill
PID:2440

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im firefox*
3⤵
- Kills process with taskkill
PID:1720

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel*
3⤵
- Kills process with taskkill
PID:3988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msaccess*
3⤵
- Kills process with taskkill
PID:2152

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im onenote*
3⤵
- Kills process with taskkill
PID:3432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im outlook*
3⤵
- Kills process with taskkill
PID:4604

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im powerpnt*
3⤵
- Kills process with taskkill
PID:4476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im winword*
3⤵
- Kills process with taskkill
PID:4132

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wuauclt*
3⤵
- Kills process with taskkill
PID:5088

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
3⤵
- Runs ping.exe
PID:4388

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sql*
3⤵
- Kills process with taskkill
PID:4176

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im oracle*
3⤵
- Kills process with taskkill
PID:3640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysq*
3⤵
- Kills process with taskkill
PID:2908

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome*
3⤵
- Kills process with taskkill
PID:4052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im veeam*
3⤵
- Kills process with taskkill
PID:3068

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im firefox*
3⤵
- Kills process with taskkill
PID:912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel*
3⤵
- Kills process with taskkill
PID:2724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msaccess*
3⤵
- Kills process with taskkill
PID:3852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im onenote*
3⤵
- Kills process with taskkill
PID:4448

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im outlook*
3⤵
- Kills process with taskkill
PID:832

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im powerpnt*
3⤵
- Kills process with taskkill
PID:3496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im winword*
3⤵
- Kills process with taskkill
PID:632

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wuauclt*
3⤵
- Kills process with taskkill
PID:2284

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
3⤵
- Runs ping.exe
PID:1784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sql*
3⤵
- Kills process with taskkill
PID:4836

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im oracle*
3⤵
- Kills process with taskkill
PID:384

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysq*
3⤵
- Kills process with taskkill
PID:3912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome*
3⤵
- Kills process with taskkill
PID:1680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im veeam*
3⤵
- Kills process with taskkill
PID:1948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im firefox*
3⤵
- Kills process with taskkill
PID:4392

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel*
3⤵
- Kills process with taskkill
PID:3640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msaccess*
3⤵
- Kills process with taskkill
PID:4332

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im onenote*
3⤵
- Kills process with taskkill
PID:4712

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im outlook*
3⤵
- Kills process with taskkill
PID:4616

C:\Windows\SysWOW64\cmd.exe
cmd /c "taskkill /f /im cmd.exe & taskkill /f /im conhost.exe"
2⤵
PID:4680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im cmd.exe
3⤵
- Kills process with taskkill
PID:2152

C:\Windows\SysWOW64\cmd.exe
cmd /c "ping 127.0.0.1 & del C:\ProgramData\1.bat & del C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4\0e60d49a967599fab179f8c885d91db2501.exe & shutdown -r -f -t 0"
2⤵
PID:4032

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:4828

C:\Windows\SysWOW64\shutdown.exe
shutdown -r -f -t 0
3⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 704
2⤵
- Program crash
PID:2604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4256 -ip 4256
1⤵
PID:3288

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\1.bat
Filesize
385B

MD5
4a4d03743fd3a7ee1d03d89d0e3b8011

SHA1
127d72408c87d866c72331fb0f16d13fef6a92ec

SHA256
2b15e09b98bc2835a4430c4560d3f5b25011141c9efa4331f66e9a707e2a23c0

SHA512
d26e5865bef6a7c7a5991c34ef8c0ae7e4c78c40b5f0c68f3490e89de50401e13e53321ee98def52ee7da390bcd3eb895f3ec1485a50cd63c94f0b640e1cfa60

Download Submit
C:\Users\Admin\Music\Readme.1352FF327.txt
Filesize
1KB

MD5
4b88b5a8f74421f9c61671ec61b8eb02

SHA1
3b0534af339c362b889ba49888e61cbbb260427f

SHA256
4f8a200177e621e534dba2f5a09247a35ac47711c1f9e40f0a65649afb0ae5ac

SHA512
1fe8c1fb63a3668718ce89f822abece8a770d14e9f4ef70d702eaee0309dd34f42056eca77df242ed781259bb198b30604376a1a7fb1958e3bcb07b295a6341e

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads