60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

max time kernel
14s
max time network
2s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware/Client-2.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

evasion execution spyware stealer

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Drops startup file 1 IoCs

Processes:

Client-2.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk Client-2.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

2344 sc.exe
1256 sc.exe
2280 sc.exe
2328 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	Client-2.exe

pid	process
2344	sc.exe
1256	sc.exe
2280	sc.exe
2328	sc.exe

Kills process with taskkill 47 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2888	taskkill.exe
1524	taskkill.exe
2020	taskkill.exe
2064	taskkill.exe
2660	taskkill.exe
2772	taskkill.exe
1528	taskkill.exe
1704	taskkill.exe
1852	taskkill.exe
360	taskkill.exe
2000	taskkill.exe
2636	taskkill.exe
2728	taskkill.exe
2652	taskkill.exe
2560	taskkill.exe
2748	taskkill.exe
2624	taskkill.exe
2752	taskkill.exe
2468	taskkill.exe
2564	taskkill.exe
2600	taskkill.exe
2640	taskkill.exe
2784	taskkill.exe
2696	taskkill.exe
2884	taskkill.exe
2516	taskkill.exe
2724	taskkill.exe
2520	taskkill.exe
2316	taskkill.exe
2472	taskkill.exe
2556	taskkill.exe
2688	taskkill.exe
2448	taskkill.exe
2436	taskkill.exe
1492	taskkill.exe
2984	taskkill.exe
2620	taskkill.exe
2704	taskkill.exe
2184	taskkill.exe
1424	taskkill.exe
2500	taskkill.exe
2264	taskkill.exe
1640	taskkill.exe
1512	taskkill.exe
2536	taskkill.exe
2648	taskkill.exe
2552	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Client-2.exe

pid	process
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe
1976	Client-2.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

Client-2.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1976	Client-2.exe
Token: SeDebugPrivilege	2500	taskkill.exe
Token: SeDebugPrivilege	2000	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	1640	taskkill.exe
Token: SeDebugPrivilege	1852	taskkill.exe
Token: SeDebugPrivilege	2520	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeDebugPrivilege	1704	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	360	taskkill.exe
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	1424	taskkill.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	1524	taskkill.exe
Token: SeDebugPrivilege	2640	taskkill.exe
Token: SeDebugPrivilege	2064	taskkill.exe
Token: SeDebugPrivilege	2620	taskkill.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeDebugPrivilege	2448	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	2652	taskkill.exe
Token: SeDebugPrivilege	2436	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	2556	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	1528	taskkill.exe
Token: SeDebugPrivilege	2184	taskkill.exe
Token: SeDebugPrivilege	2516	taskkill.exe
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	2752	taskkill.exe
Token: SeDebugPrivilege	2884	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	2468	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Client-2.exe

pid process

1976 Client-2.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Client-2.exe

pid process

1976 Client-2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Client-2.exe

description	pid	process	target process
PID 1976 wrote to memory of 2280	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 2280	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 2280	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 2320	1976	Client-2.exe	cmd.exe
PID 1976 wrote to memory of 2320	1976	Client-2.exe	cmd.exe
PID 1976 wrote to memory of 2320	1976	Client-2.exe	cmd.exe
PID 1976 wrote to memory of 2328	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 2328	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 2328	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 2344	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 2344	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 2344	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 1256	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 1256	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 1256	1976	Client-2.exe	sc.exe
PID 1976 wrote to memory of 2020	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2020	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2020	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2520	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2520	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2520	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2000	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2000	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2000	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2984	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2984	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2984	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2536	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2536	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2536	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2620	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2620	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2620	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2636	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2636	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2636	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2640	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2640	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2640	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2652	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2652	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2652	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2648	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2648	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2648	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2624	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2624	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2624	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2560	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2560	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2560	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2064	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2064	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2064	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2784	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2784	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2784	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2704	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2704	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2704	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2556	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2556	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2556	1976	Client-2.exe	taskkill.exe
PID 1976 wrote to memory of 2552	1976	Client-2.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:2280
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:2320
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2328
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:2344
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1256
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2688
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:360
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
7cf3c3b1ae7b68140500946af442968a

SHA1
09e3373b91a379eb678550aff14314b5cf213652

SHA256
43c795f28e6ada5c5a2ac224ce1e6891f2bd60ac4ca870cba474f198d8fa7bf1

SHA512
d09f518448c92803593370eef557117870d1535cb5da6aec168f6a23ce103fe300db62753c898f14a3ecf940945572f0f5302755e8642eebba9105c37a711da8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d8cfda33a1aa6df90a53b44b8cc63e26

SHA1
e42b1e8d24915f90acd05e5ea7de5f84f82c6bd8

SHA256
33ed777895540919eac70c6e0c3150c0ee45851c30078f32da29ea30bf2ecc26

SHA512
d4da256d5025346e17df48de0131506f50c5626724edafdc8921dd8ac84d24ed6dab4408206a8e4c5eedea9f2dbacaac37f157b84b33c1a1e38deffd4a2d7b64

Download Submit
memory/1420-8-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/1420-9-0x0000000002760000-0x0000000002768000-memory.dmp

Filesize
32KB

Download
memory/1976-0-0x000007FEF5D43000-0x000007FEF5D44000-memory.dmp

Filesize
4KB

Download
memory/1976-1-0x0000000000C30000-0x0000000000C4A000-memory.dmp

Filesize
104KB

Download
memory/1976-2-0x000007FEF5D40000-0x000007FEF672C000-memory.dmp

Filesize
9.9MB

Download