a5047e2bd000d3bfef58cb259a3d86cf192118349e0154fa2d8bef7789d9e1a2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update.hta
Size 1.7MB
Sample240530-e7ptfseg6s
SHA256 a5047e2bd000d3bfef58cb259a3d86cf192118349e0154fa2d8bef7789d9e1a2
MD5 aa2f60e1fd83bfebcbf6291715428542
SHA1 bed074cdf12de08929a81f757847351a9e597507
SHA512 8db09e7ed21ebebbdcd56946e6b1920e47ae43209ce02fec3e833ae16f3536ccf835f746f74ca833aaca570f97b52e3c18ff788c731de31316beebd43726b5e9
SSDEEP 24576:syNPGVxAxkN+Z6Ok/OY1nlDJGr4JgSn0mBtDgWGC5DVvt0WsG8JjsR:sys/gWGC5DVvtB8s
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (500) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Blocklisted process makes network request 4 IoCs

flow	pid	Process
21	4680	mshta.exe
35	4680	mshta.exe
43	4680	mshta.exe
50	4680	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
2456	0a6f0b10.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\ado\adovbs.inc	0a6f0b10.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.locked	0a6f0b10.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzdb.dat.locked	0a6f0b10.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.locked	0a6f0b10.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	0a6f0b10.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\READ_ME6.html	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c	0a6f0b10.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.locked	0a6f0b10.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\READ_ME6.html	0a6f0b10.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.locked	0a6f0b10.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.locked	0a6f0b10.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\READ_ME6.html	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md	0a6f0b10.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.locked	0a6f0b10.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	0a6f0b10.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.locked	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md	0a6f0b10.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoBeta.png	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md	0a6f0b10.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml	0a6f0b10.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\READ_ME6.html	0a6f0b10.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.locked	0a6f0b10.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml	0a6f0b10.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.locked	0a6f0b10.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\READ_ME6.html	0a6f0b10.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.locked	0a6f0b10.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml	0a6f0b10.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.locked	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\asm.md	0a6f0b10.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\READ_ME6.html	0a6f0b10.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.locked	0a6f0b10.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	0a6f0b10.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	0a6f0b10.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\READ_ME6.html	0a6f0b10.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml	0a6f0b10.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\READ_ME6.html	0a6f0b10.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif	0a6f0b10.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.locked	0a6f0b10.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml	0a6f0b10.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\READ_ME6.html	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md	0a6f0b10.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.locked	0a6f0b10.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\READ_ME6.html	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	0a6f0b10.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.locked	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md	0a6f0b10.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	0a6f0b10.exe
File created	C:\Program Files\7-Zip\Lang\READ_ME6.html	0a6f0b10.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.locked	0a6f0b10.exe
File created	C:\Program Files\Common Files\microsoft shared\TextConv\en-US\READ_ME6.html	0a6f0b10.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.locked	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md	0a6f0b10.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md	0a6f0b10.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\READ_ME6.html	0a6f0b10.exe
File opened for modification	C:\Program Files\SetUpdate.potx	0a6f0b10.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.locked	0a6f0b10.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.locked	0a6f0b10.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\READ_ME6.html	0a6f0b10.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
264	3744	WerFault.exe	99
3680	1140	WerFault.exe	104

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1376	vssadmin.exe

Kills process with taskkill 40 IoCs

evasion

pid	Process
624	taskkill.exe
3092	taskkill.exe
3324	taskkill.exe
1544	taskkill.exe
404	taskkill.exe
2232	taskkill.exe
2356	taskkill.exe
3476	taskkill.exe
1748	taskkill.exe
3428	taskkill.exe
2452	taskkill.exe
2968	taskkill.exe
932	taskkill.exe
2800	taskkill.exe
4888	taskkill.exe
2792	taskkill.exe
1328	taskkill.exe
2796	taskkill.exe
1716	taskkill.exe
4528	taskkill.exe
2264	taskkill.exe
428	taskkill.exe
3892	taskkill.exe
4124	taskkill.exe
468	taskkill.exe
3704	taskkill.exe
3976	taskkill.exe
1476	taskkill.exe
2616	taskkill.exe
4580	taskkill.exe
4900	taskkill.exe
2148	taskkill.exe
4420	taskkill.exe
4404	taskkill.exe
1232	taskkill.exe
1016	taskkill.exe
1020	taskkill.exe
3188	taskkill.exe
3708	taskkill.exe
2672	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	4680	mshta.exe
Token: SeBackupPrivilege	2880	vssvc.exe
Token: SeRestorePrivilege	2880	vssvc.exe
Token: SeAuditPrivilege	2880	vssvc.exe
Token: SeDebugPrivilege	468	taskkill.exe
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	3704	taskkill.exe
Token: SeDebugPrivilege	4888	taskkill.exe
Token: SeDebugPrivilege	1020	taskkill.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeDebugPrivilege	1476	taskkill.exe
Token: SeDebugPrivilege	624	taskkill.exe
Token: SeDebugPrivilege	3188	taskkill.exe
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	3092	taskkill.exe
Token: SeDebugPrivilege	4900	taskkill.exe
Token: SeDebugPrivilege	404	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	3324	taskkill.exe
Token: SeDebugPrivilege	1328	taskkill.exe
Token: SeDebugPrivilege	3708	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	4420	taskkill.exe
Token: SeDebugPrivilege	428	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	2616	taskkill.exe
Token: SeDebugPrivilege	3892	taskkill.exe
Token: SeDebugPrivilege	3428	taskkill.exe
Token: SeDebugPrivilege	4528	taskkill.exe
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	2452	taskkill.exe
Token: SeDebugPrivilege	2356	taskkill.exe
Token: SeDebugPrivilege	2796	taskkill.exe
Token: SeDebugPrivilege	4404	taskkill.exe
Token: SeDebugPrivilege	4124	taskkill.exe
Token: SeDebugPrivilege	932	taskkill.exe
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	1232	taskkill.exe
Token: SeDebugPrivilege	1016	taskkill.exe
Token: SeDebugPrivilege	2800	taskkill.exe
Token: SeDebugPrivilege	2968	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3744	4680	mshta.exe	99
PID 4680 wrote to memory of 3744	4680	mshta.exe	99
PID 4680 wrote to memory of 3744	4680	mshta.exe	99
PID 4680 wrote to memory of 3744	4680	mshta.exe	99
PID 4680 wrote to memory of 1140	4680	mshta.exe	104
PID 4680 wrote to memory of 1140	4680	mshta.exe	104
PID 4680 wrote to memory of 1140	4680	mshta.exe	104
PID 4680 wrote to memory of 1140	4680	mshta.exe	104
PID 4680 wrote to memory of 1848	4680	mshta.exe	107
PID 4680 wrote to memory of 1848	4680	mshta.exe	107
PID 4680 wrote to memory of 1848	4680	mshta.exe	107
PID 1848 wrote to memory of 2456	1848	cmd.exe	109
PID 1848 wrote to memory of 2456	1848	cmd.exe	109
PID 2456 wrote to memory of 4700	2456	0a6f0b10.exe	117
PID 2456 wrote to memory of 4700	2456	0a6f0b10.exe	117
PID 4700 wrote to memory of 1480	4700	cmd.exe	119
PID 4700 wrote to memory of 1480	4700	cmd.exe	119
PID 1480 wrote to memory of 4252	1480	net.exe	120
PID 1480 wrote to memory of 4252	1480	net.exe	120
PID 2456 wrote to memory of 1612	2456	0a6f0b10.exe	121
PID 2456 wrote to memory of 1612	2456	0a6f0b10.exe	121
PID 1612 wrote to memory of 4352	1612	cmd.exe	123
PID 1612 wrote to memory of 4352	1612	cmd.exe	123
PID 4352 wrote to memory of 428	4352	net.exe	124
PID 4352 wrote to memory of 428	4352	net.exe	124
PID 2456 wrote to memory of 4020	2456	0a6f0b10.exe	125
PID 2456 wrote to memory of 4020	2456	0a6f0b10.exe	125
PID 4020 wrote to memory of 4608	4020	cmd.exe	127
PID 4020 wrote to memory of 4608	4020	cmd.exe	127
PID 4608 wrote to memory of 4404	4608	net.exe	128
PID 4608 wrote to memory of 4404	4608	net.exe	128
PID 2456 wrote to memory of 1324	2456	0a6f0b10.exe	129
PID 2456 wrote to memory of 1324	2456	0a6f0b10.exe	129
PID 1324 wrote to memory of 2024	1324	cmd.exe	131
PID 1324 wrote to memory of 2024	1324	cmd.exe	131
PID 2024 wrote to memory of 1328	2024	net.exe	132
PID 2024 wrote to memory of 1328	2024	net.exe	132
PID 2456 wrote to memory of 2160	2456	0a6f0b10.exe	133
PID 2456 wrote to memory of 2160	2456	0a6f0b10.exe	133
PID 2160 wrote to memory of 3392	2160	cmd.exe	135
PID 2160 wrote to memory of 3392	2160	cmd.exe	135
PID 3392 wrote to memory of 4884	3392	net.exe	136
PID 3392 wrote to memory of 4884	3392	net.exe	136
PID 2456 wrote to memory of 4720	2456	0a6f0b10.exe	137
PID 2456 wrote to memory of 4720	2456	0a6f0b10.exe	137
PID 4720 wrote to memory of 4960	4720	cmd.exe	139
PID 4720 wrote to memory of 4960	4720	cmd.exe	139
PID 4960 wrote to memory of 1540	4960	net.exe	140
PID 4960 wrote to memory of 1540	4960	net.exe	140
PID 2456 wrote to memory of 2080	2456	0a6f0b10.exe	141
PID 2456 wrote to memory of 2080	2456	0a6f0b10.exe	141
PID 2080 wrote to memory of 3680	2080	cmd.exe	143
PID 2080 wrote to memory of 3680	2080	cmd.exe	143
PID 3680 wrote to memory of 672	3680	net.exe	144
PID 3680 wrote to memory of 672	3680	net.exe	144
PID 2456 wrote to memory of 1100	2456	0a6f0b10.exe	145
PID 2456 wrote to memory of 1100	2456	0a6f0b10.exe	145
PID 1100 wrote to memory of 4648	1100	cmd.exe	147
PID 1100 wrote to memory of 4648	1100	cmd.exe	147
PID 4648 wrote to memory of 4660	4648	net.exe	148
PID 4648 wrote to memory of 4660	4648	net.exe	148
PID 2456 wrote to memory of 2772	2456	0a6f0b10.exe	149
PID 2456 wrote to memory of 2772	2456	0a6f0b10.exe	149
PID 2772 wrote to memory of 4152	2772	cmd.exe	151

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\update.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\System32\rundll32.exe c:\windows\temp\d9cec697.bin 1 clear
  2⤵
  PID:3744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 552
    3⤵
    - Program crash
    PID:264
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\System32\rundll32.exe c:\windows\temp\b0751cf4.bin 3 clear
  2⤵
  PID:1140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 552
    3⤵
    - Program crash
    PID:3680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start c:\windows\temp\0a6f0b10.exe c:\windows\temp\0a6f0b10.bin aAuVXEbZ6p1krGwrJLgSnuimwzJU9VEd aAuVXEbZ6p1krGwr
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1848
- - \??\c:\windows\temp\0a6f0b10.exe
    c:\windows\temp\0a6f0b10.exe c:\windows\temp\0a6f0b10.bin aAuVXEbZ6p1krGwrJLgSnuimwzJU9VEd aAuVXEbZ6p1krGwr
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop SQLTELEMETRY
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4700
    - - C:\Windows\system32\net.exe
        
        net stop SQLTELEMETRY
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1480
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLTELEMETRY
        6⤵
        
        PID:4252
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop ReportServer
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1612
    - - C:\Windows\system32\net.exe
        
        net stop ReportServer
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4352
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop ReportServer
        6⤵
        
        PID:428
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop SQLSERVERAGENT
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4020
    - - C:\Windows\system32\net.exe
        
        net stop SQLSERVERAGENT
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4608
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLSERVERAGENT
        6⤵
        
        PID:4404
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop MSSQLServerOLAPService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1324
    - - C:\Windows\system32\net.exe
        
        net stop MSSQLServerOLAPService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQLServerOLAPService
        6⤵
        
        PID:1328
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop SQLBrowser
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2160
    - - C:\Windows\system32\net.exe
        
        net stop SQLBrowser
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3392
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLBrowser
        6⤵
        
        PID:4884
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop SQLWriter
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Windows\system32\net.exe
        
        net stop SQLWriter
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4960
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLWriter
        6⤵
        
        PID:1540
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop mssqlserver
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\Windows\system32\net.exe
        
        net stop mssqlserver
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3680
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop mssqlserver
        6⤵
        
        PID:672
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop msmq
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1100
    - - C:\Windows\system32\net.exe
        
        net stop msmq
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4648
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop msmq
        6⤵
        
        PID:4660
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop mssql
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\system32\net.exe
        
        net stop mssql
        5⤵
        
        PID:4152
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop mssql
        6⤵
        
        PID:2076
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop mysql
      4⤵
      PID:4488
    - - C:\Windows\system32\net.exe
        
        net stop mysql
        5⤵
        
        PID:5112
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop mysql
        6⤵
        
        PID:1012
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop mongodb
      4⤵
      PID:452
    - - C:\Windows\system32\net.exe
        
        net stop mongodb
        5⤵
        
        PID:1460
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop mongodb
        6⤵
        
        PID:212
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c net stop rabbitmq
      4⤵
      PID:1632
    - - C:\Windows\system32\net.exe
        
        net stop rabbitmq
        5⤵
        
        PID:2000
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop rabbitmq
        6⤵
        
        PID:4016
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c vssadmin delete shadows /all
      4⤵
      PID:3888
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all
        5⤵
        Interacts with shadow copies
        
        PID:1376
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im msftesql.exe
      4⤵
      PID:1856
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msftesql.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:468
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im sqlagent.exe
      4⤵
      PID:4124
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im sqlagent.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im sqlbrowser.exe
      4⤵
      PID:3620
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im sqlbrowser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3704
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im sqlservr.exe
      4⤵
      PID:2652
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im sqlservr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im sqlwriter.exe
      4⤵
      PID:1560
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im sqlwriter.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im oracle.exe
      4⤵
      PID:2764
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im oracle.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4580
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im ocssd.exe
      4⤵
      PID:1204
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ocssd.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3976
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im dbsnmp.exe
      4⤵
      PID:1168
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dbsnmp.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im synctime.exe
      4⤵
      PID:632
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im synctime.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im mydesktopqos.exe
      4⤵
      PID:3680
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im mydesktopqos.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3188
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im agntsvc.exeisqlplussvc.exe
      4⤵
      PID:4648
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im agntsvc.exeisqlplussvc.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im xfssvccon.exe
      4⤵
      PID:4152
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im xfssvccon.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3092
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im mydesktopservice.exe
      4⤵
      PID:5112
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im mydesktopservice.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4900
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im ocautoupds.exe
      4⤵
      PID:1460
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ocautoupds.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:404
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im agntsvc.exeagntsvc.exe
      4⤵
      PID:2000
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im agntsvc.exeagntsvc.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im agntsvc.exeencsvc.exe
      4⤵
      PID:5060
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im agntsvc.exeencsvc.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im firefoxconfig.exe
      4⤵
      PID:3608
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im firefoxconfig.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im tbirdconfig.exe
      4⤵
      PID:4884
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tbirdconfig.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3708
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im ocomm.exe
      4⤵
      PID:432
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im ocomm.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im mysqld.exe
      4⤵
      PID:3140
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im mysqld.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im mysqld-nt.exe
      4⤵
      PID:4352
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im mysqld-nt.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im mysqld-opt.exe
      4⤵
      PID:4776
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im mysqld-opt.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4420
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im dbeng50.exe
      4⤵
      PID:4396
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dbeng50.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:428
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im sqbcoreservice.exe
      4⤵
      PID:1768
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im sqbcoreservice.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im excel.exe
      4⤵
      PID:1104
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im excel.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im infopath.exe
      4⤵
      PID:4980
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im infopath.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3892
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im msaccess.exe
      4⤵
      PID:1128
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msaccess.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3428
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im mspub.exe
      4⤵
      PID:4196
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im mspub.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im onenote.exe
      4⤵
      PID:3732
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im onenote.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im outlook.exe
      4⤵
      PID:2528
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im outlook.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im powerpnt.exe
      4⤵
      PID:4640
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im powerpnt.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im steam.exe
      4⤵
      PID:4188
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im sqlservr.exe
      4⤵
      PID:3628
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im sqlservr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4404
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im thebat.exe
      4⤵
      PID:4144
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im thebat.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4124
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im thebat64.exe
      4⤵
      PID:2480
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im thebat64.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:932
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im thunderbird.exe
      4⤵
      PID:3708
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im thunderbird.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im visio.exe
      4⤵
      PID:1480
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im visio.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1232
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im winword.exe
      4⤵
      PID:4252
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im winword.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im wordpad.exe
      4⤵
      PID:4020
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im wordpad.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im tnslsnr.exe
      4⤵
      PID:3704
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tnslsnr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3744 -ip 3744
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1140 -ip 1140
1⤵
PID:1640

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

READ_ME6.html

Path C:\Users\Admin\Desktop\READ_ME6.html
Size 1KB
SHA256 f7ba0908ef09805b736e33b24aadb2a87187ba40d7a7b0756c8723d6db2e675d
MD5 5a01f3b18ffac7d9a1a19d8bdd3f2565
SHA1 23968a6500e2bc8ea8be1ec8426dd896883f338a
SHA512 927a9563e2f9f7a87200938a2f8ce41dd005da8d50f81619e4a0f235ef6a2fcdd3f1e248814786506f60b4b40e72ae371890539b8d9166c1002c1430436fed2c
MD5 SHA1 SHA512

Submit Download

0a6f0b10.exe

Path C:\Windows\Temp\0a6f0b10.exe
Size 5KB
SHA256 8dd57542571bf4c4d6b384069578f829a5a7fc89da3affbfdeb1f5fa9e39d79f
MD5 6d448cba987a24c3ddbde760d76c5a15
SHA1 16482e6c3ad97f048851f87b67446a64340eeb8e
SHA512 2f74d3af8cecc05d71eb2315fe63ddd06722fc183b08b5fe2ba7b308d3ee3f48b8de3806d2ced948232d8f3902d16716e11a71f5cd3ded92cda17a6b5618b40d
SSDEEP 48:6/YMkW/yURIgvai/+lbdIWZ7dPj4MMXj44Ytbnq6ixy2GVFSW0itptzlXaae6WFT:5QvP+nIU7webM0FVZbMGBzNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

0a6f0b10.bin

Path \??\c:\windows\temp\0a6f0b10.bin
Size 28KB
SHA256 02e70e6a162a071fb3deebc56c6f126468330b32638bfab0fd18607c32f753aa
MD5 1a028000316e576d12e49b2e4b66d895
SHA1 f117c3329c3d33a67eede8f7cb9a0dabaa7e275a
SHA512 ba881bea9c90631208a97734b1a413f416831adf2edcaa5ce08c62dec91b23c9a1833ad2cd0541d6e66ad2eb6fcd860a77930e952569f1ebc2d252c428c7208b
SSDEEP 768:d5VqAjfqFB/sweqlbnTY0RFUigT79a+AeAPM2rcf:5qAjfqFJ9rbEpAearq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1140-8-0x0000000000A00000-0x0000000000AB5000-memory.dmp

Download

memory/2456-15-0x0000000000010000-0x0000000000018000-memory.dmp

Download

memory/2456-17-0x00000000007E0000-0x00000000007EE000-memory.dmp

Download

memory/3744-5-0x00000000006C0000-0x0000000000775000-memory.dmp

Download

memory/4680-0-0x0000000071D4E000-0x0000000071D4F000-memory.dmp

Download

memory/4680-1-0x0000000008D60000-0x0000000008E80000-memory.dmp

Download

memory/4680-2-0x0000000071D40000-0x00000000724F0000-memory.dmp

Download

memory/4680-3-0x0000000071D40000-0x00000000724F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads