7ae4167445cef80f080de5b84c6490a61c1834aa1e05fce43e611c5d054da858

Analysis

max time kernel
52s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4/0e60d49a967599fab179f8c885d91db2501.exe
Size 255KB
Sample240101-s2944adcem
SHA256 0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4
MD5 1933fed76a030529b141d032c0620117
SHA1 c55c60a23f5110e0b45fc02a09c4a64d3094809a
SHA512 b153383ebd9919ff293896381d89a895c58985eef60f67803a4276026631184f4d85c19e9ea06351efb7230226b18ed9a17b533fb602e10ded518a7bd090dcfe
SSDEEP 3072:iBWxT8JtvyAuX3CGun8r8206BretpJwIiymE9xTRVhGT4z106OKclYQO565tgPYs:iBxrKA4CGu8V0tl9zVhM49OxlYQ8fD3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Music\Readme.1352FF327.txt

Ransom Note

~~~ DarkRace ransomware ~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. You can install qtox to contanct us online https://tox.chat/download.html Tox ID Contact: ************************ Mail (OnionMail) Support: [email protected] >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

[email protected]

URLs

http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion
https://tox.chat/download.html

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (149) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	0e60d49a967599fab179f8c885d91db2501.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	4256	WerFault.exe	13

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4996	vssadmin.exe

Kills process with taskkill 63 IoCs

evasion

pid	Process
4808	taskkill.exe
3432	taskkill.exe
3200	taskkill.exe
5088	taskkill.exe
3640	taskkill.exe
3912	taskkill.exe
1680	taskkill.exe
3540	taskkill.exe
3688	taskkill.exe
4604	taskkill.exe
4132	taskkill.exe
384	taskkill.exe
2468	taskkill.exe
4476	taskkill.exe
2284	taskkill.exe
3316	taskkill.exe
632	taskkill.exe
3852	taskkill.exe
3540	taskkill.exe
2908	taskkill.exe
912	taskkill.exe
4536	taskkill.exe
4448	taskkill.exe
4836	taskkill.exe
3640	taskkill.exe
2352	taskkill.exe
3080	taskkill.exe
4840	taskkill.exe
3496	taskkill.exe
2152	taskkill.exe
2340	taskkill.exe
284	taskkill.exe
4712	taskkill.exe
1680	taskkill.exe
3068	taskkill.exe
3568	taskkill.exe
2828	taskkill.exe
2300	taskkill.exe
1816	taskkill.exe
1720	taskkill.exe
832	taskkill.exe
4332	taskkill.exe
4984	taskkill.exe
3452	taskkill.exe
1072	taskkill.exe
3388	taskkill.exe
4176	taskkill.exe
4332	taskkill.exe
4616	taskkill.exe
3536	taskkill.exe
636	taskkill.exe
3432	taskkill.exe
4052	taskkill.exe
4388	taskkill.exe
4392	taskkill.exe
4712	taskkill.exe
884	taskkill.exe
1948	taskkill.exe
1728	taskkill.exe
2724	taskkill.exe
3988	taskkill.exe
2152	taskkill.exe
2440	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "161"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.1352FF327	0e60d49a967599fab179f8c885d91db2501.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.1352FF327\ = "1352FF327file"	0e60d49a967599fab179f8c885d91db2501.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file\DefaultIcon	0e60d49a967599fab179f8c885d91db2501.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file	0e60d49a967599fab179f8c885d91db2501.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file\DefaultIcon\ = "C:\\ProgramData\\icon.ico"	0e60d49a967599fab179f8c885d91db2501.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
4616	PING.EXE
4700	PING.EXE
1948	PING.EXE
4388	PING.EXE
1784	PING.EXE
4828	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1460	WMIC.exe
Token: SeSecurityPrivilege	1460	WMIC.exe
Token: SeTakeOwnershipPrivilege	1460	WMIC.exe
Token: SeLoadDriverPrivilege	1460	WMIC.exe
Token: SeSystemProfilePrivilege	1460	WMIC.exe
Token: SeSystemtimePrivilege	1460	WMIC.exe
Token: SeProfSingleProcessPrivilege	1460	WMIC.exe
Token: SeIncBasePriorityPrivilege	1460	WMIC.exe
Token: SeCreatePagefilePrivilege	1460	WMIC.exe
Token: SeBackupPrivilege	1460	WMIC.exe
Token: SeRestorePrivilege	1460	WMIC.exe
Token: SeShutdownPrivilege	1460	WMIC.exe
Token: SeDebugPrivilege	1460	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1460	WMIC.exe
Token: SeRemoteShutdownPrivilege	1460	WMIC.exe
Token: SeUndockPrivilege	1460	WMIC.exe
Token: SeManageVolumePrivilege	1460	WMIC.exe
Token: 33	1460	WMIC.exe
Token: 34	1460	WMIC.exe
Token: 35	1460	WMIC.exe
Token: 36	1460	WMIC.exe
Token: SeBackupPrivilege	824	vssvc.exe
Token: SeRestorePrivilege	824	vssvc.exe
Token: SeAuditPrivilege	824	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1460	WMIC.exe
Token: SeSecurityPrivilege	1460	WMIC.exe
Token: SeTakeOwnershipPrivilege	1460	WMIC.exe
Token: SeLoadDriverPrivilege	1460	WMIC.exe
Token: SeSystemProfilePrivilege	1460	WMIC.exe
Token: SeSystemtimePrivilege	1460	WMIC.exe
Token: SeProfSingleProcessPrivilege	1460	WMIC.exe
Token: SeIncBasePriorityPrivilege	1460	WMIC.exe
Token: SeCreatePagefilePrivilege	1460	WMIC.exe
Token: SeBackupPrivilege	1460	WMIC.exe
Token: SeRestorePrivilege	1460	WMIC.exe
Token: SeShutdownPrivilege	1460	WMIC.exe
Token: SeDebugPrivilege	1460	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1460	WMIC.exe
Token: SeRemoteShutdownPrivilege	1460	WMIC.exe
Token: SeUndockPrivilege	1460	WMIC.exe
Token: SeManageVolumePrivilege	1460	WMIC.exe
Token: 33	1460	WMIC.exe
Token: 34	1460	WMIC.exe
Token: 35	1460	WMIC.exe
Token: 36	1460	WMIC.exe
Token: SeDebugPrivilege	3540	taskkill.exe
Token: SeDebugPrivilege	4808	taskkill.exe
Token: SeDebugPrivilege	4536	taskkill.exe
Token: SeDebugPrivilege	2340	taskkill.exe
Token: SeDebugPrivilege	3080	taskkill.exe
Token: SeDebugPrivilege	2468	taskkill.exe
Token: SeDebugPrivilege	3568	taskkill.exe
Token: SeDebugPrivilege	4388	taskkill.exe
Token: SeDebugPrivilege	3536	taskkill.exe
Token: SeDebugPrivilege	4984	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	3452	taskkill.exe
Token: SeDebugPrivilege	4332	taskkill.exe
Token: SeDebugPrivilege	284	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	4712	taskkill.exe
Token: SeDebugPrivilege	3316	taskkill.exe
Token: SeDebugPrivilege	2352	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3552	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 5020	4256	0e60d49a967599fab179f8c885d91db2501.exe	88
PID 4256 wrote to memory of 5020	4256	0e60d49a967599fab179f8c885d91db2501.exe	88
PID 4256 wrote to memory of 912	4256	0e60d49a967599fab179f8c885d91db2501.exe	89
PID 4256 wrote to memory of 912	4256	0e60d49a967599fab179f8c885d91db2501.exe	89
PID 5020 wrote to memory of 1460	5020	cmd.exe	93
PID 5020 wrote to memory of 1460	5020	cmd.exe	93
PID 912 wrote to memory of 4996	912	cmd.exe	92
PID 912 wrote to memory of 4996	912	cmd.exe	92
PID 4256 wrote to memory of 4592	4256	0e60d49a967599fab179f8c885d91db2501.exe	99
PID 4256 wrote to memory of 4592	4256	0e60d49a967599fab179f8c885d91db2501.exe	99
PID 4256 wrote to memory of 4592	4256	0e60d49a967599fab179f8c885d91db2501.exe	99
PID 4592 wrote to memory of 4616	4592	cmd.exe	101
PID 4592 wrote to memory of 4616	4592	cmd.exe	101
PID 4592 wrote to memory of 4616	4592	cmd.exe	101
PID 4592 wrote to memory of 3540	4592	cmd.exe	104
PID 4592 wrote to memory of 3540	4592	cmd.exe	104
PID 4592 wrote to memory of 3540	4592	cmd.exe	104
PID 4592 wrote to memory of 4808	4592	cmd.exe	105
PID 4592 wrote to memory of 4808	4592	cmd.exe	105
PID 4592 wrote to memory of 4808	4592	cmd.exe	105
PID 4592 wrote to memory of 4536	4592	cmd.exe	106
PID 4592 wrote to memory of 4536	4592	cmd.exe	106
PID 4592 wrote to memory of 4536	4592	cmd.exe	106
PID 4592 wrote to memory of 2340	4592	cmd.exe	107
PID 4592 wrote to memory of 2340	4592	cmd.exe	107
PID 4592 wrote to memory of 2340	4592	cmd.exe	107
PID 4592 wrote to memory of 3080	4592	cmd.exe	108
PID 4592 wrote to memory of 3080	4592	cmd.exe	108
PID 4592 wrote to memory of 3080	4592	cmd.exe	108
PID 4592 wrote to memory of 2468	4592	cmd.exe	109
PID 4592 wrote to memory of 2468	4592	cmd.exe	109
PID 4592 wrote to memory of 2468	4592	cmd.exe	109
PID 4592 wrote to memory of 3568	4592	cmd.exe	110
PID 4592 wrote to memory of 3568	4592	cmd.exe	110
PID 4592 wrote to memory of 3568	4592	cmd.exe	110
PID 4592 wrote to memory of 4388	4592	cmd.exe	111
PID 4592 wrote to memory of 4388	4592	cmd.exe	111
PID 4592 wrote to memory of 4388	4592	cmd.exe	111
PID 4592 wrote to memory of 3536	4592	cmd.exe	112
PID 4592 wrote to memory of 3536	4592	cmd.exe	112
PID 4592 wrote to memory of 3536	4592	cmd.exe	112
PID 4592 wrote to memory of 4984	4592	cmd.exe	113
PID 4592 wrote to memory of 4984	4592	cmd.exe	113
PID 4592 wrote to memory of 4984	4592	cmd.exe	113
PID 4592 wrote to memory of 4840	4592	cmd.exe	114
PID 4592 wrote to memory of 4840	4592	cmd.exe	114
PID 4592 wrote to memory of 4840	4592	cmd.exe	114
PID 4592 wrote to memory of 3452	4592	cmd.exe	115
PID 4592 wrote to memory of 3452	4592	cmd.exe	115
PID 4592 wrote to memory of 3452	4592	cmd.exe	115
PID 4592 wrote to memory of 4332	4592	cmd.exe	117
PID 4592 wrote to memory of 4332	4592	cmd.exe	117
PID 4592 wrote to memory of 4332	4592	cmd.exe	117
PID 4592 wrote to memory of 4700	4592	cmd.exe	118
PID 4592 wrote to memory of 4700	4592	cmd.exe	118
PID 4592 wrote to memory of 4700	4592	cmd.exe	118
PID 4592 wrote to memory of 284	4592	cmd.exe	120
PID 4592 wrote to memory of 284	4592	cmd.exe	120
PID 4592 wrote to memory of 284	4592	cmd.exe	120
PID 4592 wrote to memory of 1072	4592	cmd.exe	121
PID 4592 wrote to memory of 1072	4592	cmd.exe	121
PID 4592 wrote to memory of 1072	4592	cmd.exe	121
PID 4592 wrote to memory of 4712	4592	cmd.exe	122
PID 4592 wrote to memory of 4712	4592	cmd.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4\0e60d49a967599fab179f8c885d91db2501.exe
"C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4\0e60d49a967599fab179f8c885d91db2501.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "wmic shadowcopy delete /nointeractive"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1460
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "vssadmin Delete Shadows /All /Quiet"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\ProgramData\1.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:4616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:4700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:3432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:3688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:3540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:1680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:3388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:884
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:2300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:1816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:3200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:2440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:3988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:2152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:3432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:4604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:4476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:4132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:5088
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:4388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:4176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:3640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:2908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:4052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:3068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:2724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:3852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:4448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:3496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:2284
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:4836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:3912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:1680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:1948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:4392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:3640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:4332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:4712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "taskkill /f /im cmd.exe & taskkill /f /im conhost.exe"
  2⤵
  PID:4680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:2152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "ping 127.0.0.1 & del C:\ProgramData\1.bat & del C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4\0e60d49a967599fab179f8c885d91db2501.exe & shutdown -r -f -t 0"
  2⤵
  PID:4032
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4828
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -f -t 0
    3⤵
    PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 704
  2⤵
  - Program crash
  PID:2604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4256 -ip 4256
1⤵
PID:3288

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\ProgramData\1.bat
Size 385B
SHA256 2b15e09b98bc2835a4430c4560d3f5b25011141c9efa4331f66e9a707e2a23c0
MD5 4a4d03743fd3a7ee1d03d89d0e3b8011
SHA1 127d72408c87d866c72331fb0f16d13fef6a92ec
SHA512 d26e5865bef6a7c7a5991c34ef8c0ae7e4c78c40b5f0c68f3490e89de50401e13e53321ee98def52ee7da390bcd3eb895f3ec1485a50cd63c94f0b640e1cfa60
MD5 SHA1 SHA512

Submit Download

Readme.1352FF327.txt

Path C:\Users\Admin\Music\Readme.1352FF327.txt
Size 1KB
SHA256 4f8a200177e621e534dba2f5a09247a35ac47711c1f9e40f0a65649afb0ae5ac
MD5 4b88b5a8f74421f9c61671ec61b8eb02
SHA1 3b0534af339c362b889ba49888e61cbbb260427f
SHA512 1fe8c1fb63a3668718ce89f822abece8a770d14e9f4ef70d702eaee0309dd34f42056eca77df242ed781259bb198b30604376a1a7fb1958e3bcb07b295a6341e
MD5 SHA1 SHA512