hakbit | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

max time kernel
34s
max time network
38s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit evasion execution ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: sj/cHPvaiLt7Q037MH3vu3Kd9nUYvn5wx7A45uKIcZ1qwb6OcgDu5B8e9UXeUHA2TdEN+Aapr5xwTtrlVTGb84xFdafIw5lGYGbGrwBIRxv82qNKw7kVkm0NAnKgBTY/wh0CfFM6ZeidtZHas5elt2TeTbpC6Cu1vF8abn8yfvhuOMakRQl9Ek5XXoWhyqsUWoOMWAw63VHO3erPFUU220qk0PdcjjfnO9W6wi0wR0mAnNi8Oo4ETIIzD4hBTT1A7sDSiuKBMmvwdfYMpWje+74gpsoKRnXA11vL4rHaCHk0DpxZrBrgSfjlH5pUOtqraaYn/fCOUnSE6CQGu7DPOc/gS2PgzkG7FBznXyI2rp4ZrU83bgmGweFur54VuId1rNzEcUh2Kl7Vb9wWbiyWVi0tIXIQCydh0zyRcDyh7YKDNLGr9fRGE7VmuZ511Orw/OQlUu/zCmC/rXD6xmHBTlELkDQ9E/18HYtCFRV7xDS3nHearyhxMIKeZ3UEmxxtMKqvgKS75zoWY19tVbWJnui7j2gPbgtDq9RHs1CgGNK37EpI6lxmfzvcJ1eYKTupHxvXFlDSNkoyMCpewThLOcUrF3igXnK5m7u/FHBhA1csaFzbMmHcV4kpbukqbI1jEYFN1xmQkg6NyGWyQc36pU6bgJH7dVad4zniAn5SNTM= Number of files that were processed is: 465

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2516	sc.exe
2524	sc.exe
2744	sc.exe
2560	sc.exe

Kills process with taskkill 47 IoCs

evasion

pid	Process
1260	taskkill.exe
564	taskkill.exe
1768	taskkill.exe
1064	taskkill.exe
1492	taskkill.exe
1124	taskkill.exe
1940	taskkill.exe
948	taskkill.exe
2216	taskkill.exe
2572	taskkill.exe
2100	taskkill.exe
1840	taskkill.exe
2056	taskkill.exe
1708	taskkill.exe
760	taskkill.exe
2100	taskkill.exe
2364	taskkill.exe
2888	taskkill.exe
2044	taskkill.exe
2412	taskkill.exe
2476	taskkill.exe
1464	taskkill.exe
2248	taskkill.exe
1844	taskkill.exe
1768	taskkill.exe
1664	taskkill.exe
3060	taskkill.exe
1348	taskkill.exe
2480	taskkill.exe
2584	taskkill.exe
2508	taskkill.exe
2260	taskkill.exe
788	taskkill.exe
1932	taskkill.exe
1916	taskkill.exe
1916	taskkill.exe
2488	taskkill.exe
1668	taskkill.exe
2892	taskkill.exe
2340	taskkill.exe
1508	taskkill.exe
1748	taskkill.exe
1760	taskkill.exe
2628	taskkill.exe
2316	taskkill.exe
2364	taskkill.exe
1120	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1252	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3024	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	2480	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1152	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 2772 wrote to memory of 1152	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 2772 wrote to memory of 1152	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 2772 wrote to memory of 2560	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	29
PID 2772 wrote to memory of 2560	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	29
PID 2772 wrote to memory of 2560	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	29
PID 2772 wrote to memory of 2744	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 2772 wrote to memory of 2744	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 2772 wrote to memory of 2744	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 2772 wrote to memory of 2516	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 2772 wrote to memory of 2516	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 2772 wrote to memory of 2516	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 2772 wrote to memory of 2524	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 2772 wrote to memory of 2524	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 2772 wrote to memory of 2524	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 2772 wrote to memory of 2572	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 2772 wrote to memory of 2572	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 2772 wrote to memory of 2572	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 2772 wrote to memory of 2584	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 2772 wrote to memory of 2584	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 2772 wrote to memory of 2584	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 2772 wrote to memory of 2216	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 2772 wrote to memory of 2216	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 2772 wrote to memory of 2216	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 2772 wrote to memory of 2488	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 2772 wrote to memory of 2488	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 2772 wrote to memory of 2488	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 2772 wrote to memory of 2480	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 2772 wrote to memory of 2480	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 2772 wrote to memory of 2480	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 2772 wrote to memory of 2476	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 2772 wrote to memory of 2476	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 2772 wrote to memory of 2476	2772	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:1152
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:2560
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2744
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:2516
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2524
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:1664
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  PID:1940
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  PID:1760
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:1916
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  PID:1932
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  PID:2892
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  PID:2248
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  PID:1768
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  PID:1668
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  PID:1120
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  PID:1124
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  PID:1464
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  PID:1492
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  PID:1064
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:1508
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  PID:2340
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  PID:2364
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  PID:1844
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  PID:2056
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:2316
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  PID:2100
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  PID:2508
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  PID:788
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  PID:2628
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  PID:1768
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  PID:2260
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  PID:760
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:1916
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  PID:1840
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  PID:2412
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  PID:948
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  PID:1348
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  PID:564
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  PID:1260
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  PID:1708
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  PID:2044
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  PID:1748
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  PID:3060
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  PID:2888
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  PID:2364
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  PID:1796
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1252
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:2124
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:3024
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:2860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  2⤵
  PID:904
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.Lck.energy[[email protected]]

Filesize
16B

MD5
ba4c3179e92ebb45be52e9b528d87169

SHA1
819af3e9d9e7df6aad2fe0552e076d95046c83f4

SHA256
18cd9a7fcbfd5a4ca7c0cb2ac85014aed5fe5cf3de702c6600951ea8895ebcbb

SHA512
75cc9ba1ffa1bd4d09c868b8a7c283f880a92ea0cbdee416f4f709c41ecb6fd483ec1ff2cbcaf002df691cc0734c21f4b95b083371af0a0f093e27959d9b2893

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
6539f6a99ac7d37feae87703161478ed

SHA1
7d6dc5d621ad2ad24a63ab8b5e334e3cda9a52e4

SHA256
e47063cf10544b903a30c9eb89f9ed60f00f466206cd11d9a29fd372274f85bf

SHA512
f05b9ec217576ffe4344807765eb53feb9fef222f18e09f62ad4b66ee1a0c65c6f1fd9fdfb96c5371bf204a6bee763dc2532718dab0569bff861f3383a1b9937

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
cd9cae6f593a5e807553e7a2d3506501

SHA1
f54805b922417651dbff2fe210554fa6d81f0691

SHA256
d4da27355cdda1344f058dced0ad96b3fe3a8fff588e00291b6ce37cd9ef19ba

SHA512
a3f8215683e8656ecd7d2357dd38b6857e5fdb6022d1aa99b4246800b86cd40c68b0193de284e70bcf6c3c78abb3654e7a880f4a9156baa5d53196646e0385d7

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
1c9f8ee33262b588deddc26181cbdead

SHA1
b7987d06513314c3c61185f503c818d547603e56

SHA256
9df2e522e6041d1f7390ce682a8726bc54354b4cd2a6ee23441d920650a100e3

SHA512
8838eead883c4043aa1628f4d72e69c9880114a80a70278a0212dbf0127956a2802da66a31fb7aca269fcadc0ec4d8acd06a974e761beec0f37e130d0056100a

Download Submit
memory/1796-9-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

Filesize
2.9MB

Download
memory/1796-10-0x00000000024F0000-0x00000000024F8000-memory.dmp

Filesize
32KB

Download
memory/2772-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2772-1-0x00000000010A0000-0x00000000010BA000-memory.dmp

Filesize
104KB

Download
memory/2772-8-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2772-311-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2772-372-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2772-586-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download