0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca

Analysis

max time kernel
59s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 19:15

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
Size

224KB
MD5

8a23347b733420472a1ec0a1eeada597
SHA1

21eae7e488b145fa3618627da99c3234696c0f15
SHA256

0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca
SHA512

f667fe8d23482226241fd7a9cae66327a4bc2317ec01bffddb1243b936a44e0ec7a2a809f75e3e3cb02c3b9415df2401a6b2fe598251079472481114e0ce9b5e
SSDEEP

3072:FnS2A9r4wpzL3syZUmMkZFfAQ2FUAElR8MRC3KevxEwYSidYj6zxe8pxU4iR:ZSFr4EzLvC1kP4Q7XlR8MRCXYZR5c/R

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Music\Readme.f58A66B51.txt

Ransom Note

!!! DoNex ransomware warning !!! >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://g3h3klsev3eiofxhykmtenmdpi67wzmaixredk5pjuttbx7okcfkftqd.onion >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. You can install qtox to contanct us online https://tox.chat/download.html Tox ID Contact: 2793D009872AF80ED9B1A461F7B9BD6209744047DC1707A42CB622053716AD4BA624193606C9 Mail (OnionMail) Support: [email protected] >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

[email protected]

URLs

http://g3h3klsev3eiofxhykmtenmdpi67wzmaixredk5pjuttbx7okcfkftqd.onion

https://tox.chat/download.html

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (150) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4196	2736	WerFault.exe	87

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2360	vssadmin.exe

Kills process with taskkill 48 IoCs

evasion

pid	Process
4032	taskkill.exe
5020	taskkill.exe
1660	taskkill.exe
3204	taskkill.exe
2184	taskkill.exe
4472	taskkill.exe
4476	taskkill.exe
4912	taskkill.exe
4396	taskkill.exe
3044	taskkill.exe
2240	taskkill.exe
4592	taskkill.exe
4380	taskkill.exe
2456	taskkill.exe
3876	taskkill.exe
3644	taskkill.exe
3052	taskkill.exe
4480	taskkill.exe
5016	taskkill.exe
1660	taskkill.exe
112	taskkill.exe
4128	taskkill.exe
2600	taskkill.exe
1196	taskkill.exe
3568	taskkill.exe
1176	taskkill.exe
4376	taskkill.exe
3048	taskkill.exe
3220	taskkill.exe
4088	taskkill.exe
2192	taskkill.exe
4652	taskkill.exe
4328	taskkill.exe
4132	taskkill.exe
4964	taskkill.exe
5092	taskkill.exe
2264	taskkill.exe
3428	taskkill.exe
4768	taskkill.exe
2696	taskkill.exe
952	taskkill.exe
3604	taskkill.exe
4176	taskkill.exe
2224	taskkill.exe
4628	taskkill.exe
1580	taskkill.exe
456	taskkill.exe
2104	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "124"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\f58A66B51file\DefaultIcon	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\f58A66B51file	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\f58A66B51file\DefaultIcon\ = "C:\\ProgramData\\icon.ico"	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.f58A66B51	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f58A66B51\ = "f58A66B51file"	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
3304	PING.EXE
2472	PING.EXE
3648	PING.EXE
272	PING.EXE
3224	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1724	WMIC.exe
Token: SeSecurityPrivilege	1724	WMIC.exe
Token: SeTakeOwnershipPrivilege	1724	WMIC.exe
Token: SeLoadDriverPrivilege	1724	WMIC.exe
Token: SeSystemProfilePrivilege	1724	WMIC.exe
Token: SeSystemtimePrivilege	1724	WMIC.exe
Token: SeProfSingleProcessPrivilege	1724	WMIC.exe
Token: SeIncBasePriorityPrivilege	1724	WMIC.exe
Token: SeCreatePagefilePrivilege	1724	WMIC.exe
Token: SeBackupPrivilege	1724	WMIC.exe
Token: SeRestorePrivilege	1724	WMIC.exe
Token: SeShutdownPrivilege	1724	WMIC.exe
Token: SeDebugPrivilege	1724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1724	WMIC.exe
Token: SeRemoteShutdownPrivilege	1724	WMIC.exe
Token: SeUndockPrivilege	1724	WMIC.exe
Token: SeManageVolumePrivilege	1724	WMIC.exe
Token: 33	1724	WMIC.exe
Token: 34	1724	WMIC.exe
Token: 35	1724	WMIC.exe
Token: 36	1724	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1724	WMIC.exe
Token: SeSecurityPrivilege	1724	WMIC.exe
Token: SeTakeOwnershipPrivilege	1724	WMIC.exe
Token: SeLoadDriverPrivilege	1724	WMIC.exe
Token: SeSystemProfilePrivilege	1724	WMIC.exe
Token: SeSystemtimePrivilege	1724	WMIC.exe
Token: SeProfSingleProcessPrivilege	1724	WMIC.exe
Token: SeIncBasePriorityPrivilege	1724	WMIC.exe
Token: SeCreatePagefilePrivilege	1724	WMIC.exe
Token: SeBackupPrivilege	1724	WMIC.exe
Token: SeRestorePrivilege	1724	WMIC.exe
Token: SeShutdownPrivilege	1724	WMIC.exe
Token: SeDebugPrivilege	1724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1724	WMIC.exe
Token: SeRemoteShutdownPrivilege	1724	WMIC.exe
Token: SeUndockPrivilege	1724	WMIC.exe
Token: SeManageVolumePrivilege	1724	WMIC.exe
Token: 33	1724	WMIC.exe
Token: 34	1724	WMIC.exe
Token: 35	1724	WMIC.exe
Token: 36	1724	WMIC.exe
Token: SeBackupPrivilege	5104	vssvc.exe
Token: SeRestorePrivilege	5104	vssvc.exe
Token: SeAuditPrivilege	5104	vssvc.exe
Token: SeDebugPrivilege	4628	taskkill.exe
Token: SeDebugPrivilege	5092	taskkill.exe
Token: SeDebugPrivilege	1580	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	3204	taskkill.exe
Token: SeDebugPrivilege	4480	taskkill.exe
Token: SeDebugPrivilege	3428	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	456	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	4328	taskkill.exe
Token: SeDebugPrivilege	3604	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	3220	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
412	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2420	2736	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	90
PID 2736 wrote to memory of 2420	2736	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	90
PID 2736 wrote to memory of 1828	2736	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	91
PID 2736 wrote to memory of 1828	2736	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	91
PID 2420 wrote to memory of 1724	2420	cmd.exe	94
PID 2420 wrote to memory of 1724	2420	cmd.exe	94
PID 1828 wrote to memory of 2360	1828	cmd.exe	95
PID 1828 wrote to memory of 2360	1828	cmd.exe	95
PID 2736 wrote to memory of 1572	2736	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	101
PID 2736 wrote to memory of 1572	2736	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	101
PID 2736 wrote to memory of 1572	2736	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	101
PID 1572 wrote to memory of 3648	1572	cmd.exe	103
PID 1572 wrote to memory of 3648	1572	cmd.exe	103
PID 1572 wrote to memory of 3648	1572	cmd.exe	103
PID 1572 wrote to memory of 4628	1572	cmd.exe	104
PID 1572 wrote to memory of 4628	1572	cmd.exe	104
PID 1572 wrote to memory of 4628	1572	cmd.exe	104
PID 1572 wrote to memory of 5092	1572	cmd.exe	105
PID 1572 wrote to memory of 5092	1572	cmd.exe	105
PID 1572 wrote to memory of 5092	1572	cmd.exe	105
PID 1572 wrote to memory of 1580	1572	cmd.exe	106
PID 1572 wrote to memory of 1580	1572	cmd.exe	106
PID 1572 wrote to memory of 1580	1572	cmd.exe	106
PID 1572 wrote to memory of 2264	1572	cmd.exe	107
PID 1572 wrote to memory of 2264	1572	cmd.exe	107
PID 1572 wrote to memory of 2264	1572	cmd.exe	107
PID 1572 wrote to memory of 4592	1572	cmd.exe	109
PID 1572 wrote to memory of 4592	1572	cmd.exe	109
PID 1572 wrote to memory of 4592	1572	cmd.exe	109
PID 1572 wrote to memory of 3204	1572	cmd.exe	110
PID 1572 wrote to memory of 3204	1572	cmd.exe	110
PID 1572 wrote to memory of 3204	1572	cmd.exe	110
PID 1572 wrote to memory of 4480	1572	cmd.exe	111
PID 1572 wrote to memory of 4480	1572	cmd.exe	111
PID 1572 wrote to memory of 4480	1572	cmd.exe	111
PID 1572 wrote to memory of 3428	1572	cmd.exe	112
PID 1572 wrote to memory of 3428	1572	cmd.exe	112
PID 1572 wrote to memory of 3428	1572	cmd.exe	112
PID 1572 wrote to memory of 4768	1572	cmd.exe	113
PID 1572 wrote to memory of 4768	1572	cmd.exe	113
PID 1572 wrote to memory of 4768	1572	cmd.exe	113
PID 1572 wrote to memory of 5016	1572	cmd.exe	114
PID 1572 wrote to memory of 5016	1572	cmd.exe	114
PID 1572 wrote to memory of 5016	1572	cmd.exe	114
PID 1572 wrote to memory of 4652	1572	cmd.exe	115
PID 1572 wrote to memory of 4652	1572	cmd.exe	115
PID 1572 wrote to memory of 4652	1572	cmd.exe	115
PID 1572 wrote to memory of 456	1572	cmd.exe	116
PID 1572 wrote to memory of 456	1572	cmd.exe	116
PID 1572 wrote to memory of 456	1572	cmd.exe	116
PID 1572 wrote to memory of 4128	1572	cmd.exe	117
PID 1572 wrote to memory of 4128	1572	cmd.exe	117
PID 1572 wrote to memory of 4128	1572	cmd.exe	117
PID 1572 wrote to memory of 272	1572	cmd.exe	118
PID 1572 wrote to memory of 272	1572	cmd.exe	118
PID 1572 wrote to memory of 272	1572	cmd.exe	118
PID 1572 wrote to memory of 2104	1572	cmd.exe	119
PID 1572 wrote to memory of 2104	1572	cmd.exe	119
PID 1572 wrote to memory of 2104	1572	cmd.exe	119
PID 1572 wrote to memory of 4328	1572	cmd.exe	120
PID 1572 wrote to memory of 4328	1572	cmd.exe	120
PID 1572 wrote to memory of 4328	1572	cmd.exe	120
PID 1572 wrote to memory of 3604	1572	cmd.exe	121
PID 1572 wrote to memory of 3604	1572	cmd.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
"C:\Users\Admin\AppData\Local\Temp\0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "wmic shadowcopy delete /nointeractive"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "vssadmin Delete Shadows /All /Quiet"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\ProgramData\1.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:4132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:3644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:1660
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:2184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:4380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:4472
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:2456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:4964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:2192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:3876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:4176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:3052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:3568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:4396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:4476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:2696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:1196
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:1176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:4032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:5020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:1660
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:2224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:3044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:4376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "taskkill /f /im cmd.exe & taskkill /f /im conhost.exe"
  2⤵
  PID:1452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "ping 127.0.0.1 & del C:\ProgramData\1.bat & del C:\Users\Admin\AppData\Local\Temp\0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe & shutdown -r -f -t 0"
  2⤵
  PID:3552
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2472
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -f -t 0
    3⤵
    PID:2320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1028
  2⤵
  - Program crash
  PID:4196

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2736 -ip 2736
1⤵
PID:2948

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3961055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact