hakbit | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit evasion execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: wBgeHnLeUkiME2teMSK1C6rVyxfsRqTSA2+IZBfVCHNy/yaM9PMeQUNYaAueSjXoBvgCs/2b7mSRGs/lXdLAS6888Zo/la1I9t3AR30WmLouOotoHvhwYu9RfOWbbySlalujvavmQc+s3xSqtQqRjyl0qBFmUCbMyw/QqiDn773eifz4ZRIMw0zBxyZY7NV6WhsOrpmT1eSVr68y2VExHdiQVQFXXbnxKdNw7bTiupwsXbwHY7oooE0eYwql9xh3yEdI+tg/61mtEcgn4Q7H5yUtx2EJzyZfABZEgBd16YNOAtpcqyjibxy8Gy58GlMHycptBPPJCQWWvwkFDyWPR3OpyTgnNI1vAVKlI32Wbwp4mFNZEOxJwIA58EZgT6L5u+kTXHeQf1FAGXK3ipYMclybSpEe+WdwmnHC7CjTinrm+Suc6in48N7o6qANun9+xO2rOYaNc/R1TeopyprL3Dv+1xiL/0g0knsQi4gKgl1HOZcuqU0wpouZE2ypBHqmtKY/ekXLkTtZIuha+MkrERYcjkCCvDqJCmjNBMQ0200OLzDWVdBnL3DBTAXiClb//9pfkyiSKYi3lCVnLZcXgIo2KED7EH9ja2+8pnWfxjyyxr+enfztJMpeICi5FPxdyMIOChnFHr4c71OsFlUa1T2+1PPb2iSPK73Il7iJ4CU= Number of files that were processed is: 512

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit

Deletes itself 1 IoCs

pid	Process
3896	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2956	sc.exe
3004	sc.exe
2924	sc.exe
2072	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 47 IoCs

evasion

pid	Process
860	taskkill.exe
2184	taskkill.exe
2216	taskkill.exe
2848	taskkill.exe
2640	taskkill.exe
1864	taskkill.exe
2752	taskkill.exe
2488	taskkill.exe
656	taskkill.exe
1684	taskkill.exe
2704	taskkill.exe
1080	taskkill.exe
2392	taskkill.exe
264	taskkill.exe
2560	taskkill.exe
1516	taskkill.exe
2648	taskkill.exe
1224	taskkill.exe
344	taskkill.exe
2688	taskkill.exe
1624	taskkill.exe
1152	taskkill.exe
2744	taskkill.exe
2092	taskkill.exe
1268	taskkill.exe
1628	taskkill.exe
2728	taskkill.exe
1248	taskkill.exe
2388	taskkill.exe
2764	taskkill.exe
2296	taskkill.exe
2952	taskkill.exe
1296	taskkill.exe
1944	taskkill.exe
1244	taskkill.exe
2128	taskkill.exe
2660	taskkill.exe
1760	taskkill.exe
1488	taskkill.exe
1564	taskkill.exe
1772	taskkill.exe
1880	taskkill.exe
2736	taskkill.exe
1748	taskkill.exe
1808	taskkill.exe
1676	taskkill.exe
1752	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3884	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3956	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Token: SeDebugPrivilege	2752	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	1152	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2640	taskkill.exe
Token: SeDebugPrivilege	2848	taskkill.exe
Token: SeDebugPrivilege	2744	taskkill.exe
Token: SeDebugPrivilege	2388	taskkill.exe
Token: SeDebugPrivilege	1752	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	1488	taskkill.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	1080	taskkill.exe
Token: SeDebugPrivilege	264	taskkill.exe
Token: SeDebugPrivilege	1296	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	1248	taskkill.exe
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	1624	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	1516	taskkill.exe
Token: SeDebugPrivilege	2952	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	344	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	1944	taskkill.exe
Token: SeDebugPrivilege	1268	taskkill.exe
Token: SeDebugPrivilege	1628	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	2184	taskkill.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	1564	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	860	taskkill.exe
Token: SeDebugPrivilege	1684	taskkill.exe
Token: SeDebugPrivilege	656	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2956	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 1756 wrote to memory of 2956	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 1756 wrote to memory of 2956	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 1756 wrote to memory of 1616	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 1756 wrote to memory of 1616	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 1756 wrote to memory of 1616	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 1756 wrote to memory of 2072	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	31
PID 1756 wrote to memory of 2072	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	31
PID 1756 wrote to memory of 2072	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	31
PID 1756 wrote to memory of 2924	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 1756 wrote to memory of 2924	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 1756 wrote to memory of 2924	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 1756 wrote to memory of 3004	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 1756 wrote to memory of 3004	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 1756 wrote to memory of 3004	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 1756 wrote to memory of 2648	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	38
PID 1756 wrote to memory of 2648	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	38
PID 1756 wrote to memory of 2648	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	38
PID 1756 wrote to memory of 2752	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	40
PID 1756 wrote to memory of 2752	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	40
PID 1756 wrote to memory of 2752	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	40
PID 1756 wrote to memory of 2764	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 1756 wrote to memory of 2764	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 1756 wrote to memory of 2764	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 1756 wrote to memory of 2744	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 1756 wrote to memory of 2744	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 1756 wrote to memory of 2744	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 1756 wrote to memory of 2660	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 1756 wrote to memory of 2660	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 1756 wrote to memory of 2660	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 1756 wrote to memory of 1152	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	46
PID 1756 wrote to memory of 1152	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	46
PID 1756 wrote to memory of 1152	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	46
PID 1756 wrote to memory of 2848	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 1756 wrote to memory of 2848	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 1756 wrote to memory of 2848	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 1756 wrote to memory of 2388	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	49
PID 1756 wrote to memory of 2388	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	49
PID 1756 wrote to memory of 2388	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	49
PID 1756 wrote to memory of 2640	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 1756 wrote to memory of 2640	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 1756 wrote to memory of 2640	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 1756 wrote to memory of 2128	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	56
PID 1756 wrote to memory of 2128	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	56
PID 1756 wrote to memory of 2128	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	56
PID 1756 wrote to memory of 1752	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 1756 wrote to memory of 1752	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 1756 wrote to memory of 1752	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 1756 wrote to memory of 1624	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	58
PID 1756 wrote to memory of 1624	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	58
PID 1756 wrote to memory of 1624	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	58
PID 1756 wrote to memory of 1808	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 1756 wrote to memory of 1808	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 1756 wrote to memory of 1808	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 1756 wrote to memory of 1248	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	60
PID 1756 wrote to memory of 1248	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	60
PID 1756 wrote to memory of 1248	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	60
PID 1756 wrote to memory of 1516	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	61
PID 1756 wrote to memory of 1516	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	61
PID 1756 wrote to memory of 1516	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	61
PID 1756 wrote to memory of 1748	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	63
PID 1756 wrote to memory of 1748	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	63
PID 1756 wrote to memory of 1748	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	63
PID 1756 wrote to memory of 1864	1756	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	64

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:2956
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:1616
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2072
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:2924
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3004
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1752
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1748
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2704
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:344
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1880
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:264
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1564
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1684
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:656
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1080
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:860
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3884
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:3904
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:3956
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:4044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  2⤵
  - Deletes itself
  PID:3896
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]

Filesize
4KB

MD5
fc44f5cf827c908fcbfafa895acb3ff7

SHA1
ed80673241b8ca1bb13b8296702ec833d2e06e5f

SHA256
b28914b23a12769fccdda2823b6e7954ca492603b91160edf2c8212b7538fae4

SHA512
10407f789ad523d79f04f02a8ae406a34c0a4274483f801284c204d7df21d0161fde20d375b553f502eedacf5834c66d8611f7dcab3a4d1a641cddc5f6aad817

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
a62920883c0942001c18991458290cd1

SHA1
ce16fe1183d23bb62b365926884142eb0a975362

SHA256
efd857645d940326e3ee87a10f0f28450efd186af6c7cd81f2c0936df2302de2

SHA512
8b4abb05cecd304d2b2709f42b066bd4d89942a3cd869e00a7530d864e8d51ffa33586cc80b62907ab423973dee9b01e27bfeb8912ff97cf98e03a1eb03c06c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
732c9020be6b5ae64899cf91fbe44667

SHA1
f639006ce3a99fdccfca2fa1b0738f5f1d071e3f

SHA256
2a88fc503688b65f3c335392957760cb4d2255f9cf5f19281084f85c4f8d8d6f

SHA512
88705500bbae911f4dbc0efd7b7ee850ae010fefba75a28633d38465dae80b48d980226305458e301b358a755868b6a1147d54122309d5ef92aece464034db1a

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
eaff4a951b2cadaccab8731b251dcee6

SHA1
c6871386b5ae41090ddaea7584d8461dc5379622

SHA256
b2f6abc254977e703508484ee722d38e1d05a0e130c4592ec48f9f72668a1028

SHA512
e05826cbd370da61dd68b4ddf084cecb375b54ae23425d00f509a3af6473c5ea97a76c347da061c66c54164717b67a18ecee3c262b75e48f762d6206c0e0a996

Download Submit
memory/1756-0-0x000007FEF5E93000-0x000007FEF5E94000-memory.dmp

Filesize
4KB

Download
memory/1756-1-0x0000000001220000-0x000000000123A000-memory.dmp

Filesize
104KB

Download
memory/1756-3-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/1756-636-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2300-10-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/2300-9-0x000000001B810000-0x000000001BAF2000-memory.dmp

Filesize
2.9MB

Download