hakbit | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit evasion execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: JQ6OQZf96FDgq3PUEyZj+N426fSKCcVKTdCV5F6HZwlA3MYvs99mZfN5+zVvHN3EM55ixFNAvm0swLQjg0iTpACxr7tKY0SFMQ/TlduTmfcnC9dGrzDKeL7r2K4749O1UtYDGetZx30hbEr+tFKXRxSe4KT2fpPVt5jLLCW9VFJd8xdMWkB7BfeDwk0DtVuJ/vBn9cv70FKSBxPFl7ITX44HU0WJbZesYUp/OO69P8q5j7q9QChbKxK3OE2zhBnvL9xGd3NB4lij/0FZtY5LCvPBmg6J1flsfQRprjh6B5xtrC2Vyhge/CEWHk2b3CMoG+qxOOauq3E0h8/Uib5EebU/ny8ri63by53f99eTC5AWoowQ8IGeQLH72kkNXqNtc819oxj+UsAQWeqD76PncC5utoA5uoO4GwNiNY2Pz2sqW6aQkBQ0u0LRzmW9UzIAKHiHQT9GMWdDTRqiwZFZ2cIzYHq71uH63uwS2Pc16OuPq/nA8Zy5RaaRmT+23bNhm+VBgImf4NRTHhovpAGFHrUc+rPgzyrvnHzCcp03Y6ws3orXmxRMNIG1a+EOcl9VBd4aP4/yqXTbJuei7YQt1SmGWh81QgUpCe/xBJJ2I3LX+cpeEswUrJ4Wbu9WAtPtY4RP0uOM0zOiKXoCVkuQK4x/10XCYrOwAyUuUSrJ0bE= Number of files that were processed is: 468

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit

Deletes itself 1 IoCs

pid	Process
1740	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2972	sc.exe
2624	sc.exe
2612	sc.exe
2572	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 47 IoCs

evasion

pid	Process
2468	taskkill.exe
2524	taskkill.exe
2720	taskkill.exe
796	taskkill.exe
2120	taskkill.exe
1708	taskkill.exe
2852	taskkill.exe
2196	taskkill.exe
1576	taskkill.exe
2536	taskkill.exe
2584	taskkill.exe
1240	taskkill.exe
2348	taskkill.exe
1844	taskkill.exe
2888	taskkill.exe
2632	taskkill.exe
1244	taskkill.exe
2844	taskkill.exe
1568	taskkill.exe
2600	taskkill.exe
1628	taskkill.exe
2732	taskkill.exe
320	taskkill.exe
352	taskkill.exe
1872	taskkill.exe
2668	taskkill.exe
2460	taskkill.exe
2728	taskkill.exe
2940	taskkill.exe
2776	taskkill.exe
1936	taskkill.exe
2124	taskkill.exe
2680	taskkill.exe
2856	taskkill.exe
2700	taskkill.exe
2464	taskkill.exe
2780	taskkill.exe
1968	taskkill.exe
2016	taskkill.exe
1748	taskkill.exe
2500	taskkill.exe
2148	taskkill.exe
2548	taskkill.exe
2488	taskkill.exe
1932	taskkill.exe
1432	taskkill.exe
2024	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1736	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3000	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	1844	taskkill.exe
Token: SeDebugPrivilege	352	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	1872	taskkill.exe
Token: SeDebugPrivilege	320	taskkill.exe
Token: SeDebugPrivilege	2016	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	2856	taskkill.exe
Token: SeDebugPrivilege	1628	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	2668	taskkill.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeDebugPrivilege	2500	taskkill.exe
Token: SeDebugPrivilege	1432	taskkill.exe
Token: SeDebugPrivilege	2468	taskkill.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	2024	taskkill.exe
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	1240	taskkill.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	1932	taskkill.exe
Token: SeDebugPrivilege	308	powershell.exe
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeDebugPrivilege	2680	taskkill.exe
Token: SeDebugPrivilege	2852	taskkill.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	796	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2984	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 1508 wrote to memory of 2984	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 1508 wrote to memory of 2984	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 1508 wrote to memory of 2972	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 1508 wrote to memory of 2972	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 1508 wrote to memory of 2972	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 1508 wrote to memory of 2572	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 1508 wrote to memory of 2572	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 1508 wrote to memory of 2572	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 1508 wrote to memory of 2612	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 1508 wrote to memory of 2612	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 1508 wrote to memory of 2612	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 1508 wrote to memory of 2624	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	34
PID 1508 wrote to memory of 2624	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	34
PID 1508 wrote to memory of 2624	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	34
PID 1508 wrote to memory of 2632	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 1508 wrote to memory of 2632	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 1508 wrote to memory of 2632	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 1508 wrote to memory of 2700	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 1508 wrote to memory of 2700	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 1508 wrote to memory of 2700	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 1508 wrote to memory of 2780	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 1508 wrote to memory of 2780	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 1508 wrote to memory of 2780	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 1508 wrote to memory of 2776	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	39
PID 1508 wrote to memory of 2776	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	39
PID 1508 wrote to memory of 2776	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	39
PID 1508 wrote to memory of 2548	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 1508 wrote to memory of 2548	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 1508 wrote to memory of 2548	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 1508 wrote to memory of 2940	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 1508 wrote to memory of 2940	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 1508 wrote to memory of 2940	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 1508 wrote to memory of 2732	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 1508 wrote to memory of 2732	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 1508 wrote to memory of 2732	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 1508 wrote to memory of 2584	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 1508 wrote to memory of 2584	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 1508 wrote to memory of 2584	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 1508 wrote to memory of 2728	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 1508 wrote to memory of 2728	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 1508 wrote to memory of 2728	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 1508 wrote to memory of 2460	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	46
PID 1508 wrote to memory of 2460	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	46
PID 1508 wrote to memory of 2460	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	46
PID 1508 wrote to memory of 2720	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 1508 wrote to memory of 2720	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 1508 wrote to memory of 2720	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 1508 wrote to memory of 2524	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 1508 wrote to memory of 2524	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 1508 wrote to memory of 2524	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 1508 wrote to memory of 2600	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	49
PID 1508 wrote to memory of 2600	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	49
PID 1508 wrote to memory of 2600	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	49
PID 1508 wrote to memory of 2464	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	51
PID 1508 wrote to memory of 2464	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	51
PID 1508 wrote to memory of 2464	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	51
PID 1508 wrote to memory of 2468	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 1508 wrote to memory of 2468	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 1508 wrote to memory of 2468	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 1508 wrote to memory of 2536	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 1508 wrote to memory of 2536	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 1508 wrote to memory of 2536	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 1508 wrote to memory of 2488	1508	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:2984
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:2972
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2572
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:2612
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2624
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2888
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1844
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1748
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1872
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1432
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:352
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2120
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:796
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:308
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1736
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:1840
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:3000
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:1748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  2⤵
  - Deletes itself
  PID:1740
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]

Filesize
4KB

MD5
af927d6ac45602057e5ecbd821a1eab2

SHA1
d0721809cf47164d3db6424d3c94c3c8c4ef24cc

SHA256
73b0f1e1094d2bcf540de5d96ccefdf4e52b66df1427e12ea06da5e5910402e8

SHA512
d5071373db2ec0d4fcb344dfab1c45bbc350b76946ed1cca4e326f0bdca336a599fc7164fca98ddcffe58af7ee5ef4c0cd2cfa74eb80fba9a4fb0ced95b124bd

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
5fad349f0e0745bb9faf8f765e0d7868

SHA1
df78475fcbae590e7b995d4c2918b60cd06a18e1

SHA256
ed99bc5caf8e39bc24b63078bb9e2ae31e776bb7744bd95f56cf94ce51acb583

SHA512
f6a1fa42ae8e3aa6f6c51cc056a36e650bdde31c3553ba2f0767969119a7906cc6469dea799cfc586fb7f76c479abe48c6ac7c1f02183c1acd77f14f868bc4e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f6d8529de12e0f0cdeb587920756310d

SHA1
03ec979830a451f39b41a416019f2802873aee0a

SHA256
d92c759e493239513b2a8bbed696ed737ac4a3e81b90d0ca4249a821ab7cdbc4

SHA512
c2a64b63f03365c260f97347fe41c4e239af3b5aca4826381cbba9539638ccdfb3c3efd2923b81a5aaf82e8846d4297d85afd3c564d3329ee1a1ea97ae28c29c

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
a9c42589db292e53a1e59f91b8f79227

SHA1
21f88b09320b5128cd592f29a10c64f0b2670325

SHA256
3a423f7600d469827fce2e46deec0ec82f4dbe7851b578253f9d9494724803d3

SHA512
b3c60d845b9d262641de60c985f24796f1af9474ec35c744351c14aa8d8d1492faca68a07088fc0134a3d1c4902a4e3550358c083c985418a85fc2e965305d0e

Download Submit
memory/308-10-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/308-9-0x000000001B820000-0x000000001BB02000-memory.dmp

Filesize
2.9MB

Download
memory/1508-0-0x000007FEF5ED3000-0x000007FEF5ED4000-memory.dmp

Filesize
4KB

Download
memory/1508-1-0x0000000000EE0000-0x0000000000EFA000-memory.dmp

Filesize
104KB

Download
memory/1508-3-0x000007FEF5ED0000-0x000007FEF68BC000-memory.dmp

Filesize
9.9MB

Download
memory/1508-577-0x000007FEF5ED0000-0x000007FEF68BC000-memory.dmp

Filesize
9.9MB

Download