hakbit | f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

Resubmissions

03/07/2024, 22:59 UTC

240703-2yn7wszhlp 10

03/07/2024, 16:13 UTC

240703-tn93lsyglf 10

03/07/2024, 16:11 UTC

240703-tm84xsyfma 10

10/05/2024, 16:25 UTC

240510-tw1h5shh47 10

24/08/2023, 11:16 UTC

230824-nda8msdf8z 10

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 16:11 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit evasion execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below potentialenergy@mail.ru Key Identifier: yVh8CnTuD4UuwCAva8nymLuopR0O77p3Kie8eMPpDIw9FFfL0A82sWGuE93WMTIylYiQ7rWTa4U6w8dfikztoeaVNEJYCSX0wHgW5EpZy6OROZLNWUxR8LCJ2afXkq05Sa982oAKlri00oHD681T5zT4Rs1L2an+qveNUPBbtstD8MVu+bkbnqNG/+1OD0iv/PTonUfh0L7H4yrmdEx76sf3WVgMv/utMsmKQjbeL+UYxzwpwamoIq8ctN1i6iwUnVFb6rZg1buKU+52F1DTVBQwkJC9qEkKMl2rB7+dKDZq0KYvIztgoXy7FWYNsnePpgmEtZLOvqckA65ZIf1Zg/5Kosj5Kmg6CxzgLHnRxviLOe3yP4l5drnBghHHw5LI9MzDreWsi0DruOFJ6A4q95JSOVdE17qmYhDjEGmOpRYaKZzdD9sKmKkyjzEGKyItPmeH97ue/1kL8LZzFJxievZLN5CvykydE7tti13IpRpkBz1geRs1Q0U8BcHTXbNpC+oG44F/XrOK6qvCJ0PDAqbUGFw0xrCcAP568WY/BpQAuzpjCDi1ZcHQl72wCzLCWlyKnuvgcAkoxQL61IprLLCF7oySi9TNBtYTHgju1LAB0UU2T5fwW2y+OZki9icMaLdQCIG7qNZKCl5z6NOlEDKmUEJu2YTZ29jkQTDAUK8= Number of files that were processed is: 480

Emails

potentialenergy@mail.ru

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit

Deletes itself 1 IoCs

pid	Process
3336	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3012	sc.exe
2548	sc.exe
3000	sc.exe
2328	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 47 IoCs

evasion

pid	Process
2684	taskkill.exe
2400	taskkill.exe
1776	taskkill.exe
2596	taskkill.exe
2512	taskkill.exe
3028	taskkill.exe
2948	taskkill.exe
2656	taskkill.exe
2564	taskkill.exe
264	taskkill.exe
1200	taskkill.exe
2028	taskkill.exe
964	taskkill.exe
2144	taskkill.exe
1636	taskkill.exe
2532	taskkill.exe
2468	taskkill.exe
2520	taskkill.exe
2712	taskkill.exe
3032	taskkill.exe
1796	taskkill.exe
1160	taskkill.exe
580	taskkill.exe
2576	taskkill.exe
2688	taskkill.exe
2408	taskkill.exe
1720	taskkill.exe
1736	taskkill.exe
2628	taskkill.exe
2924	taskkill.exe
2084	taskkill.exe
2008	taskkill.exe
2268	taskkill.exe
2152	taskkill.exe
1844	taskkill.exe
2460	taskkill.exe
1520	taskkill.exe
1624	taskkill.exe
952	taskkill.exe
300	taskkill.exe
2896	taskkill.exe
2476	taskkill.exe
2484	taskkill.exe
1272	taskkill.exe
2360	taskkill.exe
1940	taskkill.exe
2404	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3504	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2088	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Token: SeDebugPrivilege	3032	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	1844	taskkill.exe
Token: SeDebugPrivilege	1736	taskkill.exe
Token: SeDebugPrivilege	2948	taskkill.exe
Token: SeDebugPrivilege	2520	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	1272	taskkill.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	2468	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	580	taskkill.exe
Token: SeDebugPrivilege	2400	taskkill.exe
Token: SeDebugPrivilege	2484	taskkill.exe
Token: SeDebugPrivilege	264	taskkill.exe
Token: SeDebugPrivilege	2532	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	300	taskkill.exe
Token: SeDebugPrivilege	2008	taskkill.exe
Token: SeDebugPrivilege	2360	taskkill.exe
Token: SeDebugPrivilege	1160	taskkill.exe
Token: SeDebugPrivilege	2084	taskkill.exe
Token: SeDebugPrivilege	1796	taskkill.exe
Token: SeDebugPrivilege	1624	taskkill.exe
Token: SeDebugPrivilege	2896	taskkill.exe
Token: SeDebugPrivilege	2408	taskkill.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	1720	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	964	taskkill.exe
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	856	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2300	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 3020 wrote to memory of 2300	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 3020 wrote to memory of 2300	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	28
PID 3020 wrote to memory of 2328	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	29
PID 3020 wrote to memory of 2328	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	29
PID 3020 wrote to memory of 2328	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	29
PID 3020 wrote to memory of 3000	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 3020 wrote to memory of 3000	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 3020 wrote to memory of 3000	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 3020 wrote to memory of 3012	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 3020 wrote to memory of 3012	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 3020 wrote to memory of 3012	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 3020 wrote to memory of 2548	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 3020 wrote to memory of 2548	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 3020 wrote to memory of 2548	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 3020 wrote to memory of 1272	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	34
PID 3020 wrote to memory of 1272	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	34
PID 3020 wrote to memory of 1272	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	34
PID 3020 wrote to memory of 1200	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 3020 wrote to memory of 1200	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 3020 wrote to memory of 1200	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 3020 wrote to memory of 3032	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 3020 wrote to memory of 3032	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 3020 wrote to memory of 3032	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 3020 wrote to memory of 2712	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 3020 wrote to memory of 2712	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 3020 wrote to memory of 2712	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 3020 wrote to memory of 2656	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 3020 wrote to memory of 2656	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 3020 wrote to memory of 2656	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 3020 wrote to memory of 2596	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 3020 wrote to memory of 2596	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 3020 wrote to memory of 2596	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 3020 wrote to memory of 2564	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 3020 wrote to memory of 2564	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 3020 wrote to memory of 2564	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 3020 wrote to memory of 2484	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	52
PID 3020 wrote to memory of 2484	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	52
PID 3020 wrote to memory of 2484	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	52
PID 3020 wrote to memory of 2924	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 3020 wrote to memory of 2924	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 3020 wrote to memory of 2924	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 3020 wrote to memory of 2400	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 3020 wrote to memory of 2400	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 3020 wrote to memory of 2400	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 3020 wrote to memory of 2688	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	55
PID 3020 wrote to memory of 2688	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	55
PID 3020 wrote to memory of 2688	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	55
PID 3020 wrote to memory of 2628	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	56
PID 3020 wrote to memory of 2628	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	56
PID 3020 wrote to memory of 2628	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	56
PID 3020 wrote to memory of 1736	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 3020 wrote to memory of 1736	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 3020 wrote to memory of 1736	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 3020 wrote to memory of 2684	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	58
PID 3020 wrote to memory of 2684	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	58
PID 3020 wrote to memory of 2684	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	58
PID 3020 wrote to memory of 2520	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 3020 wrote to memory of 2520	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 3020 wrote to memory of 2520	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 3020 wrote to memory of 2460	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	60
PID 3020 wrote to memory of 2460	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	60
PID 3020 wrote to memory of 2460	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	60
PID 3020 wrote to memory of 2468	3020	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	61

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:2300
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:2328
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:3000
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:3012
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2548
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2576
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1844
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:264
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:580
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:300
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:952
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:964
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:856
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3504
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:3324
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:2088
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:1892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  2⤵
  - Deletes itself
  PID:3336
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[potentialenergy@mail.ru]

Filesize
180KB

MD5
6f5027aaa4bbbb24f251706abd5baa4f

SHA1
45a817bb22035be27d8f930bc93b43692d83e6b3

SHA256
d564b195b920d31bd0ee5c8ba383499154e658fdb7903b2085e0550249fd3c54

SHA512
cc67c050aaa9825f71aeb958c0cba8d2c325f6ed7b1d116855f476121d3681bd64729c9417d7351356437c3685374e81284ad30f888ef9e6ac86e313f133c8e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
20990e9559d345e7bcff900644171279

SHA1
35c50f71e96f4cd46808e44b9f67b3488612e786

SHA256
2697a84f6785fbd7f28527c20fe770e2e7cf1e241c27d345482e747dfdca5b67

SHA512
bef2d19a77a8318afec5291608da90785daf72dba6cee019de277327ab847885a94ee97a30602b6bc5e9c60d580741ff686c0987a0fed0076da412c3faa49ed5

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
039a1fa6086c2ff342a3d77cb3500464

SHA1
8681e63c0c9315376400bc6722d198d69fad5aef

SHA256
8075de2e745c17b788390f33de4a9a3634c0691f1afe66a70afec33941e4844d

SHA512
a27886d2a255b8763829c88dc1e76d832e4c7e5e9f85423f73d18a4835d21dfa45fbf09b909816edfca49400363d7e9a31cdf6af11af8b5b6a585f16331fd736

Download Submit
memory/856-9-0x000000001B360000-0x000000001B642000-memory.dmp

Filesize
2.9MB

Download
memory/856-10-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/3020-0-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

Filesize
4KB

Download
memory/3020-1-0x00000000012B0000-0x00000000012CA000-memory.dmp

Filesize
104KB

Download
memory/3020-8-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Filesize
9.9MB

Download
memory/3020-320-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

Filesize
4KB

Download
memory/3020-346-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Filesize
9.9MB

Download
memory/3020-593-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Filesize
9.9MB

Download