Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
31.bin/1.exe
windows7-x64
101.bin/1.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102b5e50bc30...ba.dll
windows7-x64
102b5e50bc30...ba.dll
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
92c01b00772...eb.exe
windows10-2004-x64
931.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
1042f9729255...1).exe
windows7-x64
1042f9729255...1).exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
106a9e7107c9...91.exe
windows7-x64
106a9e7107c9...91.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
1Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:02
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
1.bin/1.exe
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
1.bin/1.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
31.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
31.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240508-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Deletes itself 1 IoCs
pid Process 3396 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2244 sc.exe 2064 sc.exe 1296 sc.exe 2444 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 47 IoCs
pid Process 1192 taskkill.exe 1668 taskkill.exe 2836 taskkill.exe 1456 taskkill.exe 1712 taskkill.exe 1652 taskkill.exe 2796 taskkill.exe 2340 taskkill.exe 1428 taskkill.exe 2596 taskkill.exe 2684 taskkill.exe 1376 taskkill.exe 2332 taskkill.exe 2468 taskkill.exe 2160 taskkill.exe 2612 taskkill.exe 2416 taskkill.exe 2588 taskkill.exe 1244 taskkill.exe 552 taskkill.exe 2956 taskkill.exe 2188 taskkill.exe 1348 taskkill.exe 2772 taskkill.exe 3040 taskkill.exe 2328 taskkill.exe 2608 taskkill.exe 1980 taskkill.exe 812 taskkill.exe 1004 taskkill.exe 1028 taskkill.exe 2988 taskkill.exe 2204 taskkill.exe 2788 taskkill.exe 2688 taskkill.exe 2552 taskkill.exe 2568 taskkill.exe 1252 taskkill.exe 2960 taskkill.exe 3048 taskkill.exe 2640 taskkill.exe 1664 taskkill.exe 904 taskkill.exe 2024 taskkill.exe 1396 taskkill.exe 2784 taskkill.exe 3016 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 936 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3408 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 544 powershell.exe Token: SeDebugPrivilege 3016 taskkill.exe Token: SeDebugPrivilege 2188 taskkill.exe Token: SeDebugPrivilege 2960 taskkill.exe Token: SeDebugPrivilege 1980 taskkill.exe Token: SeDebugPrivilege 1376 taskkill.exe Token: SeDebugPrivilege 1456 taskkill.exe Token: SeDebugPrivilege 2340 taskkill.exe Token: SeDebugPrivilege 2332 taskkill.exe Token: SeDebugPrivilege 2788 taskkill.exe Token: SeDebugPrivilege 904 taskkill.exe Token: SeDebugPrivilege 812 taskkill.exe Token: SeDebugPrivilege 2024 taskkill.exe Token: SeDebugPrivilege 2596 taskkill.exe Token: SeDebugPrivilege 2608 taskkill.exe Token: SeDebugPrivilege 2588 taskkill.exe Token: SeDebugPrivilege 3040 taskkill.exe Token: SeDebugPrivilege 1348 taskkill.exe Token: SeDebugPrivilege 1396 taskkill.exe Token: SeDebugPrivilege 2956 taskkill.exe Token: SeDebugPrivilege 1428 taskkill.exe Token: SeDebugPrivilege 2772 taskkill.exe Token: SeDebugPrivilege 552 taskkill.exe Token: SeDebugPrivilege 2416 taskkill.exe Token: SeDebugPrivilege 1192 taskkill.exe Token: SeDebugPrivilege 2640 taskkill.exe Token: SeDebugPrivilege 2796 taskkill.exe Token: SeDebugPrivilege 1668 taskkill.exe Token: SeDebugPrivilege 2328 taskkill.exe Token: SeDebugPrivilege 2684 taskkill.exe Token: SeDebugPrivilege 1004 taskkill.exe Token: SeDebugPrivilege 1252 taskkill.exe Token: SeDebugPrivilege 2160 taskkill.exe Token: SeDebugPrivilege 2468 taskkill.exe Token: SeDebugPrivilege 2688 taskkill.exe Token: SeDebugPrivilege 1664 taskkill.exe Token: SeDebugPrivilege 2836 taskkill.exe Token: SeDebugPrivilege 2552 taskkill.exe Token: SeDebugPrivilege 1028 taskkill.exe Token: SeDebugPrivilege 1712 taskkill.exe Token: SeDebugPrivilege 2784 taskkill.exe Token: SeDebugPrivilege 1244 taskkill.exe Token: SeDebugPrivilege 2568 taskkill.exe Token: SeDebugPrivilege 2204 taskkill.exe Token: SeDebugPrivilege 2612 taskkill.exe Token: SeDebugPrivilege 3048 taskkill.exe Token: SeDebugPrivilege 1652 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1216 wrote to memory of 2228 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 28 PID 1216 wrote to memory of 2228 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 28 PID 1216 wrote to memory of 2228 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 28 PID 1216 wrote to memory of 2244 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 29 PID 1216 wrote to memory of 2244 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 29 PID 1216 wrote to memory of 2244 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 29 PID 1216 wrote to memory of 2444 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 30 PID 1216 wrote to memory of 2444 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 30 PID 1216 wrote to memory of 2444 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 30 PID 1216 wrote to memory of 2064 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 31 PID 1216 wrote to memory of 2064 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 31 PID 1216 wrote to memory of 2064 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 31 PID 1216 wrote to memory of 1296 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 32 PID 1216 wrote to memory of 1296 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 32 PID 1216 wrote to memory of 1296 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 32 PID 1216 wrote to memory of 1348 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 33 PID 1216 wrote to memory of 1348 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 33 PID 1216 wrote to memory of 1348 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 33 PID 1216 wrote to memory of 2204 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 34 PID 1216 wrote to memory of 2204 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 34 PID 1216 wrote to memory of 2204 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 34 PID 1216 wrote to memory of 2188 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 36 PID 1216 wrote to memory of 2188 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 36 PID 1216 wrote to memory of 2188 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 36 PID 1216 wrote to memory of 2340 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 37 PID 1216 wrote to memory of 2340 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 37 PID 1216 wrote to memory of 2340 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 37 PID 1216 wrote to memory of 3016 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 39 PID 1216 wrote to memory of 3016 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 39 PID 1216 wrote to memory of 3016 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 39 PID 1216 wrote to memory of 2612 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 40 PID 1216 wrote to memory of 2612 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 40 PID 1216 wrote to memory of 2612 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 40 PID 1216 wrote to memory of 3040 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 42 PID 1216 wrote to memory of 3040 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 42 PID 1216 wrote to memory of 3040 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 42 PID 1216 wrote to memory of 2160 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 43 PID 1216 wrote to memory of 2160 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 43 PID 1216 wrote to memory of 2160 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 43 PID 1216 wrote to memory of 2784 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 48 PID 1216 wrote to memory of 2784 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 48 PID 1216 wrote to memory of 2784 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 48 PID 1216 wrote to memory of 2788 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 49 PID 1216 wrote to memory of 2788 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 49 PID 1216 wrote to memory of 2788 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 49 PID 1216 wrote to memory of 2796 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 50 PID 1216 wrote to memory of 2796 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 50 PID 1216 wrote to memory of 2796 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 50 PID 1216 wrote to memory of 2772 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 59 PID 1216 wrote to memory of 2772 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 59 PID 1216 wrote to memory of 2772 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 59 PID 1216 wrote to memory of 1428 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 60 PID 1216 wrote to memory of 1428 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 60 PID 1216 wrote to memory of 1428 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 60 PID 1216 wrote to memory of 2684 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 61 PID 1216 wrote to memory of 2684 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 61 PID 1216 wrote to memory of 2684 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 61 PID 1216 wrote to memory of 2688 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 62 PID 1216 wrote to memory of 2688 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 62 PID 1216 wrote to memory of 2688 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 62 PID 1216 wrote to memory of 2568 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 63 PID 1216 wrote to memory of 2568 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 63 PID 1216 wrote to memory of 2568 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 63 PID 1216 wrote to memory of 2552 1216 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\system32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:2228
-
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:2244
-
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:2444
-
-
C:\Windows\system32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:2064
-
-
C:\Windows\system32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:1296
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1348
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:2988
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1028
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:904
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1244
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:812
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1004
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:544
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:936
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵PID:2036
-
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:3408
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:3904
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵
- Deletes itself
PID:3396 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1488
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]
Filesize4KB
MD524883c3e8c688a309e6f0f7a2fa82f17
SHA164353c90c2c18b3956321ce1da9fa419c6ff3a17
SHA256c5fe78d596a96da8204530ec1cb81d4bd055f5252d7f27651dfa2882eb8fd769
SHA5127aadf82b8446208fc85e0398a4cfbdece6913c044226b53d77d2493a84cca44e681b012e22370bb125255553ba7f3eab83e2ff73bc56e51279d0d954abf6fe00
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD504c6d1ced935d8afc460bdb0ff160ed3
SHA1ac174067d543d912e62aa02e01d68eca5719de74
SHA25630874e6d1c808af738dbb72a102f4a887c54f4e16ccaacc21cfe792558d5f21a
SHA512c903c17cb671e34dcca79e7a2de346ec00b2c32bf0ca02729b7132dc4528c9a24d32a4dd44cfe8508a4af7a11762324963a5c3cccdff2c78fb04b1647df5493b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5cfb430a1c97b78c7d493e34a1eb33218
SHA157b201d188a645fd4bc01f3f001bdf541dc521c4
SHA256bbeb0d923c4d33d27e896e4564d9993c2e5083009b59d646ba08bd12c0e06749
SHA51248d8e0ec4e9eb24950222e433786c5f101800de9f71949c1af9629648e8b0c332cd5462f1205e7d39faac59fde9e8f26190d457e03a75a0b4b2e11d829be7fa2
-
Filesize
828B
MD598b9942a572faf4a4ba90ad43c1c16c8
SHA1557a877e935c4cddd66584d3e690ed3cefece42c
SHA256526ed352b765f99da127ebf23a746a701e53936fe0733e9ed04596a92e31d29a
SHA512624fdd4a75bdee565bcd420c2931ec491c5f687b8fffbd79171c42b2c0b80636b90607cfa4283e205909d31fa444332056e82fe597474241746b43e2beb33db3