0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4

Analysis

max time kernel
45s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2024, 05:27

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Size

255KB
MD5

1933fed76a030529b141d032c0620117
SHA1

c55c60a23f5110e0b45fc02a09c4a64d3094809a
SHA256

0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4
SHA512

b153383ebd9919ff293896381d89a895c58985eef60f67803a4276026631184f4d85c19e9ea06351efb7230226b18ed9a17b533fb602e10ded518a7bd090dcfe
SSDEEP

3072:iBWxT8JtvyAuX3CGun8r8206BretpJwIiymE9xTRVhGT4z106OKclYQO565tgPYs:iBxrKA4CGu8V0tl9zVhM49OxlYQ8fD3

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Music\Readme.1352FF327.txt

Ransom Note

~~~ DarkRace ransomware ~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. You can install qtox to contanct us online https://tox.chat/download.html Tox ID Contact: ************************ Mail (OnionMail) Support: [email protected] >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

[email protected]

URLs

http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion

https://tox.chat/download.html

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (136) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
780	vssadmin.exe

Kills process with taskkill 41 IoCs

evasion

pid	Process
4772	taskkill.exe
3700	taskkill.exe
536	taskkill.exe
944	taskkill.exe
776	taskkill.exe
4116	taskkill.exe
1672	taskkill.exe
1520	taskkill.exe
3280	taskkill.exe
4172	taskkill.exe
4032	taskkill.exe
3324	taskkill.exe
3588	taskkill.exe
3300	taskkill.exe
4520	taskkill.exe
2096	taskkill.exe
3608	taskkill.exe
1724	taskkill.exe
4416	taskkill.exe
216	taskkill.exe
2096	taskkill.exe
2312	taskkill.exe
4516	taskkill.exe
4348	taskkill.exe
1272	taskkill.exe
312	taskkill.exe
1884	taskkill.exe
2896	taskkill.exe
2516	taskkill.exe
4328	taskkill.exe
2016	taskkill.exe
3236	taskkill.exe
3780	taskkill.exe
2464	taskkill.exe
4420	taskkill.exe
2356	taskkill.exe
3344	taskkill.exe
2716	taskkill.exe
1916	taskkill.exe
368	taskkill.exe
1600	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "235"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file\DefaultIcon\ = "C:\\ProgramData\\icon.ico"	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.1352FF327	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.1352FF327\ = "1352FF327file"	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1352FF327file\DefaultIcon	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
5040	PING.EXE
3468	PING.EXE
2928	PING.EXE
3476	PING.EXE
4328	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4556	WMIC.exe
Token: SeSecurityPrivilege	4556	WMIC.exe
Token: SeTakeOwnershipPrivilege	4556	WMIC.exe
Token: SeLoadDriverPrivilege	4556	WMIC.exe
Token: SeSystemProfilePrivilege	4556	WMIC.exe
Token: SeSystemtimePrivilege	4556	WMIC.exe
Token: SeProfSingleProcessPrivilege	4556	WMIC.exe
Token: SeIncBasePriorityPrivilege	4556	WMIC.exe
Token: SeCreatePagefilePrivilege	4556	WMIC.exe
Token: SeBackupPrivilege	4556	WMIC.exe
Token: SeRestorePrivilege	4556	WMIC.exe
Token: SeShutdownPrivilege	4556	WMIC.exe
Token: SeDebugPrivilege	4556	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4556	WMIC.exe
Token: SeRemoteShutdownPrivilege	4556	WMIC.exe
Token: SeUndockPrivilege	4556	WMIC.exe
Token: SeManageVolumePrivilege	4556	WMIC.exe
Token: 33	4556	WMIC.exe
Token: 34	4556	WMIC.exe
Token: 35	4556	WMIC.exe
Token: 36	4556	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4556	WMIC.exe
Token: SeSecurityPrivilege	4556	WMIC.exe
Token: SeTakeOwnershipPrivilege	4556	WMIC.exe
Token: SeLoadDriverPrivilege	4556	WMIC.exe
Token: SeSystemProfilePrivilege	4556	WMIC.exe
Token: SeSystemtimePrivilege	4556	WMIC.exe
Token: SeProfSingleProcessPrivilege	4556	WMIC.exe
Token: SeIncBasePriorityPrivilege	4556	WMIC.exe
Token: SeCreatePagefilePrivilege	4556	WMIC.exe
Token: SeBackupPrivilege	4556	WMIC.exe
Token: SeRestorePrivilege	4556	WMIC.exe
Token: SeShutdownPrivilege	4556	WMIC.exe
Token: SeDebugPrivilege	4556	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4556	WMIC.exe
Token: SeRemoteShutdownPrivilege	4556	WMIC.exe
Token: SeUndockPrivilege	4556	WMIC.exe
Token: SeManageVolumePrivilege	4556	WMIC.exe
Token: 33	4556	WMIC.exe
Token: 34	4556	WMIC.exe
Token: 35	4556	WMIC.exe
Token: 36	4556	WMIC.exe
Token: SeBackupPrivilege	2752	vssvc.exe
Token: SeRestorePrivilege	2752	vssvc.exe
Token: SeAuditPrivilege	2752	vssvc.exe
Token: SeDebugPrivilege	4772	taskkill.exe
Token: SeDebugPrivilege	3324	taskkill.exe
Token: SeDebugPrivilege	3700	taskkill.exe
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	2096	taskkill.exe
Token: SeDebugPrivilege	2312	taskkill.exe
Token: SeDebugPrivilege	2516	taskkill.exe
Token: SeDebugPrivilege	4328	taskkill.exe
Token: SeDebugPrivilege	3344	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	3588	taskkill.exe
Token: SeDebugPrivilege	536	taskkill.exe
Token: SeDebugPrivilege	3608	taskkill.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	4516	taskkill.exe
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeDebugPrivilege	2016	taskkill.exe
Token: SeDebugPrivilege	4348	taskkill.exe
Token: SeDebugPrivilege	776	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4128	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 4884	2976	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	84
PID 2976 wrote to memory of 4884	2976	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	84
PID 2976 wrote to memory of 4252	2976	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	85
PID 2976 wrote to memory of 4252	2976	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	85
PID 4884 wrote to memory of 4556	4884	cmd.exe	88
PID 4884 wrote to memory of 4556	4884	cmd.exe	88
PID 4252 wrote to memory of 780	4252	cmd.exe	89
PID 4252 wrote to memory of 780	4252	cmd.exe	89
PID 2976 wrote to memory of 3816	2976	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	94
PID 2976 wrote to memory of 3816	2976	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	94
PID 2976 wrote to memory of 3816	2976	0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe	94
PID 3816 wrote to memory of 5040	3816	cmd.exe	96
PID 3816 wrote to memory of 5040	3816	cmd.exe	96
PID 3816 wrote to memory of 5040	3816	cmd.exe	96
PID 3816 wrote to memory of 4772	3816	cmd.exe	97
PID 3816 wrote to memory of 4772	3816	cmd.exe	97
PID 3816 wrote to memory of 4772	3816	cmd.exe	97
PID 3816 wrote to memory of 3324	3816	cmd.exe	98
PID 3816 wrote to memory of 3324	3816	cmd.exe	98
PID 3816 wrote to memory of 3324	3816	cmd.exe	98
PID 3816 wrote to memory of 3700	3816	cmd.exe	99
PID 3816 wrote to memory of 3700	3816	cmd.exe	99
PID 3816 wrote to memory of 3700	3816	cmd.exe	99
PID 3816 wrote to memory of 4520	3816	cmd.exe	100
PID 3816 wrote to memory of 4520	3816	cmd.exe	100
PID 3816 wrote to memory of 4520	3816	cmd.exe	100
PID 3816 wrote to memory of 2096	3816	cmd.exe	101
PID 3816 wrote to memory of 2096	3816	cmd.exe	101
PID 3816 wrote to memory of 2096	3816	cmd.exe	101
PID 3816 wrote to memory of 2312	3816	cmd.exe	102
PID 3816 wrote to memory of 2312	3816	cmd.exe	102
PID 3816 wrote to memory of 2312	3816	cmd.exe	102
PID 3816 wrote to memory of 2516	3816	cmd.exe	103
PID 3816 wrote to memory of 2516	3816	cmd.exe	103
PID 3816 wrote to memory of 2516	3816	cmd.exe	103
PID 3816 wrote to memory of 4328	3816	cmd.exe	104
PID 3816 wrote to memory of 4328	3816	cmd.exe	104
PID 3816 wrote to memory of 4328	3816	cmd.exe	104
PID 3816 wrote to memory of 3344	3816	cmd.exe	105
PID 3816 wrote to memory of 3344	3816	cmd.exe	105
PID 3816 wrote to memory of 3344	3816	cmd.exe	105
PID 3816 wrote to memory of 1672	3816	cmd.exe	106
PID 3816 wrote to memory of 1672	3816	cmd.exe	106
PID 3816 wrote to memory of 1672	3816	cmd.exe	106
PID 3816 wrote to memory of 3588	3816	cmd.exe	108
PID 3816 wrote to memory of 3588	3816	cmd.exe	108
PID 3816 wrote to memory of 3588	3816	cmd.exe	108
PID 3816 wrote to memory of 536	3816	cmd.exe	109
PID 3816 wrote to memory of 536	3816	cmd.exe	109
PID 3816 wrote to memory of 536	3816	cmd.exe	109
PID 3816 wrote to memory of 3608	3816	cmd.exe	110
PID 3816 wrote to memory of 3608	3816	cmd.exe	110
PID 3816 wrote to memory of 3608	3816	cmd.exe	110
PID 3816 wrote to memory of 3468	3816	cmd.exe	111
PID 3816 wrote to memory of 3468	3816	cmd.exe	111
PID 3816 wrote to memory of 3468	3816	cmd.exe	111
PID 3816 wrote to memory of 944	3816	cmd.exe	112
PID 3816 wrote to memory of 944	3816	cmd.exe	112
PID 3816 wrote to memory of 944	3816	cmd.exe	112
PID 3816 wrote to memory of 4516	3816	cmd.exe	113
PID 3816 wrote to memory of 4516	3816	cmd.exe	113
PID 3816 wrote to memory of 4516	3816	cmd.exe	113
PID 3816 wrote to memory of 1520	3816	cmd.exe	114
PID 3816 wrote to memory of 1520	3816	cmd.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe
"C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "wmic shadowcopy delete /nointeractive"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "vssadmin Delete Shadows /All /Quiet"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\ProgramData\1.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:5040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3608
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:1272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:1724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:3280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:2716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:3300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:1884
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:1916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:4416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:3236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:4172
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:3780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:2464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:4116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:1600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:4032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:4420
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:2356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "taskkill /f /im cmd.exe & taskkill /f /im conhost.exe"
  2⤵
  PID:100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "ping 127.0.0.1 & del C:\ProgramData\1.bat & del C:\Users\Admin\AppData\Local\Temp\0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe & shutdown -r -f -t 0"
  2⤵
  PID:4232
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4328
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -f -t 0
    3⤵
    PID:2684

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39bf055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact