hakbit | 60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

max time kernel
95s
max time network
84s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware/Client-2.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit credential_access discovery evasion execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: Ms7e1M1HWOddXpnvzInhOXw7dSPPN5fA9eoK4HrNAk/YjbRBtkZGNh20NubuThVhf6zfZjEEzlhlzezf06PIUyyyw6Slx9pn5P/OVw4NVKPnwNmmVXwjv11BKtbFdSCxJM3YJc4a6S4Zy7zQ06h2QKvI439Yk58dsJOe4caAPZrBysuauzgEqGnU9N+c9XRe0HPsr5WZFQ+WPCXsfd8lTzrblT0WDTGQCJbtgzwECphcBrYpYCjAm6uKkdH6MwIj4KBxn/1IAZm2ZatIFFAVuQYYGECrYH4EtwKXHWurygEAeQLW8JavsWg9rICWrzvaXFGx8Eah/+Lw0dO2+jGCPUJKvVyG5fE0zJN1F1w1UHqHB09DDB0Y7MmP9i4mDd0la1dKOb6SbbEyNglA+PsyzYLYEUDfiMboXsVcvirhzolTrTlJsTt5LgMDlw394kgY5R5QWh7qLrxDDj0X+tFYAm0MRLkxQPm5kBuicwnTelMuNr3tXNK2uxxH4M0hNCo+PLXPapr7AT9RLOT5Xh8Z29R9+a0jYYDiVhEOz1gwYh3BI1KNF97CZ1h9jck0HXApnt5mK6DFULOelfPijyvB51Qb+YMZVFosf5+ev3peOz16l7FXcCMNudy/6g1K5ZMYaASiMk28Elwi1glFyJeFfJEojOjXZvryIc4VLq/O0gM= Number of files that were processed is: 469

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
4516	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	Client-2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3064	sc.exe
2328	sc.exe
756	sc.exe
2428	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2820	cmd.exe
4524	PING.EXE

Kills process with taskkill 47 IoCs

evasion

pid	Process
2432	taskkill.exe
1208	taskkill.exe
284	taskkill.exe
1644	taskkill.exe
2832	taskkill.exe
2340	taskkill.exe
1052	taskkill.exe
2404	taskkill.exe
2136	taskkill.exe
2240	taskkill.exe
2824	taskkill.exe
2816	taskkill.exe
2980	taskkill.exe
1836	taskkill.exe
2444	taskkill.exe
952	taskkill.exe
2668	taskkill.exe
2184	taskkill.exe
396	taskkill.exe
2760	taskkill.exe
2052	taskkill.exe
2036	taskkill.exe
2660	taskkill.exe
2972	taskkill.exe
2864	taskkill.exe
2544	taskkill.exe
2456	taskkill.exe
2924	taskkill.exe
2652	taskkill.exe
2672	taskkill.exe
2496	taskkill.exe
2464	taskkill.exe
2336	taskkill.exe
2156	taskkill.exe
2792	taskkill.exe
1584	taskkill.exe
2696	taskkill.exe
2484	taskkill.exe
2772	taskkill.exe
2716	taskkill.exe
2692	taskkill.exe
2656	taskkill.exe
2124	taskkill.exe
2200	taskkill.exe
1928	taskkill.exe
2236	taskkill.exe
1704	taskkill.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\ru]_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\ru]_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\ru]_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\ru]_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\ru]_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\ru]_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.ru]	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.ru]\ = "ru]_auto_file"	rundll32.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2248	notepad.exe
3756	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4524	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe
488	Client-2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4776	rundll32.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	488	Client-2.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	2760	taskkill.exe
Token: SeDebugPrivilege	2652	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	2496	taskkill.exe
Token: SeDebugPrivilege	2236	taskkill.exe
Token: SeDebugPrivilege	396	taskkill.exe
Token: SeDebugPrivilege	2972	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	284	taskkill.exe
Token: SeDebugPrivilege	2668	taskkill.exe
Token: SeDebugPrivilege	2136	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	2816	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	2484	taskkill.exe
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	2340	taskkill.exe
Token: SeDebugPrivilege	1704	taskkill.exe
Token: SeDebugPrivilege	2184	taskkill.exe
Token: SeDebugPrivilege	1208	taskkill.exe
Token: SeDebugPrivilege	1644	taskkill.exe
Token: SeDebugPrivilege	2036	taskkill.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	2456	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	2432	taskkill.exe
Token: SeDebugPrivilege	2336	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	2156	taskkill.exe
Token: SeDebugPrivilege	1584	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	2200	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	1836	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
488	Client-2.exe
2248	notepad.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
488	Client-2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1368	AcroRd32.exe
1368	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 3064	488	Client-2.exe	29
PID 488 wrote to memory of 3064	488	Client-2.exe	29
PID 488 wrote to memory of 3064	488	Client-2.exe	29
PID 488 wrote to memory of 2428	488	Client-2.exe	30
PID 488 wrote to memory of 2428	488	Client-2.exe	30
PID 488 wrote to memory of 2428	488	Client-2.exe	30
PID 488 wrote to memory of 756	488	Client-2.exe	31
PID 488 wrote to memory of 756	488	Client-2.exe	31
PID 488 wrote to memory of 756	488	Client-2.exe	31
PID 488 wrote to memory of 2328	488	Client-2.exe	32
PID 488 wrote to memory of 2328	488	Client-2.exe	32
PID 488 wrote to memory of 2328	488	Client-2.exe	32
PID 488 wrote to memory of 2052	488	Client-2.exe	33
PID 488 wrote to memory of 2052	488	Client-2.exe	33
PID 488 wrote to memory of 2052	488	Client-2.exe	33
PID 488 wrote to memory of 2760	488	Client-2.exe	34
PID 488 wrote to memory of 2760	488	Client-2.exe	34
PID 488 wrote to memory of 2760	488	Client-2.exe	34
PID 488 wrote to memory of 2792	488	Client-2.exe	41
PID 488 wrote to memory of 2792	488	Client-2.exe	41
PID 488 wrote to memory of 2792	488	Client-2.exe	41
PID 488 wrote to memory of 2864	488	Client-2.exe	43
PID 488 wrote to memory of 2864	488	Client-2.exe	43
PID 488 wrote to memory of 2864	488	Client-2.exe	43
PID 488 wrote to memory of 2656	488	Client-2.exe	44
PID 488 wrote to memory of 2656	488	Client-2.exe	44
PID 488 wrote to memory of 2656	488	Client-2.exe	44
PID 488 wrote to memory of 2832	488	Client-2.exe	45
PID 488 wrote to memory of 2832	488	Client-2.exe	45
PID 488 wrote to memory of 2832	488	Client-2.exe	45
PID 488 wrote to memory of 1704	488	Client-2.exe	48
PID 488 wrote to memory of 1704	488	Client-2.exe	48
PID 488 wrote to memory of 1704	488	Client-2.exe	48
PID 488 wrote to memory of 2972	488	Client-2.exe	49
PID 488 wrote to memory of 2972	488	Client-2.exe	49
PID 488 wrote to memory of 2972	488	Client-2.exe	49
PID 488 wrote to memory of 2924	488	Client-2.exe	50
PID 488 wrote to memory of 2924	488	Client-2.exe	50
PID 488 wrote to memory of 2924	488	Client-2.exe	50
PID 488 wrote to memory of 2980	488	Client-2.exe	51
PID 488 wrote to memory of 2980	488	Client-2.exe	51
PID 488 wrote to memory of 2980	488	Client-2.exe	51
PID 488 wrote to memory of 2672	488	Client-2.exe	52
PID 488 wrote to memory of 2672	488	Client-2.exe	52
PID 488 wrote to memory of 2672	488	Client-2.exe	52
PID 488 wrote to memory of 2236	488	Client-2.exe	53
PID 488 wrote to memory of 2236	488	Client-2.exe	53
PID 488 wrote to memory of 2236	488	Client-2.exe	53
PID 488 wrote to memory of 2816	488	Client-2.exe	54
PID 488 wrote to memory of 2816	488	Client-2.exe	54
PID 488 wrote to memory of 2816	488	Client-2.exe	54
PID 488 wrote to memory of 2824	488	Client-2.exe	55
PID 488 wrote to memory of 2824	488	Client-2.exe	55
PID 488 wrote to memory of 2824	488	Client-2.exe	55
PID 488 wrote to memory of 2696	488	Client-2.exe	56
PID 488 wrote to memory of 2696	488	Client-2.exe	56
PID 488 wrote to memory of 2696	488	Client-2.exe	56
PID 488 wrote to memory of 396	488	Client-2.exe	57
PID 488 wrote to memory of 396	488	Client-2.exe	57
PID 488 wrote to memory of 396	488	Client-2.exe	57
PID 488 wrote to memory of 2652	488	Client-2.exe	59
PID 488 wrote to memory of 2652	488	Client-2.exe	59
PID 488 wrote to memory of 2652	488	Client-2.exe	59
PID 488 wrote to memory of 2660	488	Client-2.exe	60

C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:488
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:3064
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2428
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:756
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2328
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2716
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1928
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:2912
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:284
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:952
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2444
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1044
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  - Suspicious use of FindShellTrayWindow
  PID:2248
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2820
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4524
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:4568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
  2⤵
  - Deletes itself
  PID:4516
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:628

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:4624

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Documents\BackupRemove.ppsm.energy[[email protected]]
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4776
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Documents\BackupRemove.ppsm.energy[[email protected]]"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1368

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.Lck.energy[[email protected]]

Filesize
16B

MD5
2e3502afcfae5636c6eb7c2d183d3432

SHA1
2515e4229e5439b284e655eb6cdd70ef387fa4a8

SHA256
c64b1fdb266f1322ac9327bbebb36b71b5862159293cd2736630555218550f8e

SHA512
109beb35291742361acf4c5b8592b620a63d64bd273ee655796ac8b7d7c844f249be16b21e9981dec892ca937276cabc70d8317f895b4930a58e7eaca6a201c6

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
1e26183129ef79c789762f2c6ae5b65e

SHA1
185580edf900f6cbe46bad933c05c50b005b15fd

SHA256
ac435f6340174caa10920fd7c6d6d5edc8c234e5878bbf3b57e2c37f5646cf48

SHA512
3313827e4d0952e857d40e5ff6d76919a6e2a950850faa7a25e1cf7b4624577b5264fe28fce2dc771508386cb8159801335585c5fe6612cee4c4ce93cad52b9c

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d6a9d78f71c4c0eef868296b5b9a1a45

SHA1
46c49b9cfa241b1012cb7b768815a7f54b423962

SHA256
6cd41b0762cc708df685eaf0e9577f52120ab037c0e7e33fe76a8e59ddf30850

SHA512
659c6747b3a2992f79804dd8c7fe981996b39d7a67fb398063eea70d3650fe9567e4938d9708de16853e97340a94bfc149a939f2c78209741c240c33bdf4a350

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
39d66a9af4e6096b85f5f8bbbec1d8c6

SHA1
91e50353a1926ed65e8771a3013148d807249024

SHA256
ef5f0a113a3bed1afccd9c0fe58565c74825eaf649bb39b619152bf9b9ce0410

SHA512
acb3deeeaf426c855271eb1b617b939a2d2147bb38f576431bb06cd49d8c796972d1f291f57f257a2b7eedf54046e36ea6085ff0c522325c947c77e3e10c20cb

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
f8f3d641791f07b3379fc93aa9f04880

SHA1
130d453fbafa8471563725e4ae7a2a904b8b624a

SHA256
caa0dcb12c4c80f9a587e671398587772482b4a82ad7c43c8ea37e47f0ecd2b5

SHA512
d9f9fa77db30dd8304ce7699cb41a5375b800801a61ed328a878f260e031daade60b9d45e9dc17fb8afd606649945490314051c03823936fd5b7d61b73b549b3

Download Submit
C:\Users\Admin\Documents\BackupRemove.ppsm.energy[[email protected]]

Filesize
816KB

MD5
60e3affbbf44ef12e2e88ddd99ee5715

SHA1
4e6660c15d8b6cddfeaf296efda8cc686d2e8faf

SHA256
fb321cdb8fd6e89f5285b6791dc9df4417b61f8bd92c296d59375e3961623989

SHA512
14a901079877c396b53e63958085f99acd5262b66f2baea557580c9c0aec18d98d0cf85aab3015636ebf5d2498b356a68e2316e6270cff697d72bc0efa6cb164

Download Submit
memory/488-145-0x000007FEF6360000-0x000007FEF6D4C000-memory.dmp

Filesize
9.9MB

Download
memory/488-0-0x000007FEF6363000-0x000007FEF6364000-memory.dmp

Filesize
4KB

Download
memory/488-126-0x000007FEF6363000-0x000007FEF6364000-memory.dmp

Filesize
4KB

Download
memory/488-631-0x000007FEF6360000-0x000007FEF6D4C000-memory.dmp

Filesize
9.9MB

Download
memory/488-3-0x000007FEF6360000-0x000007FEF6D4C000-memory.dmp

Filesize
9.9MB

Download
memory/488-1-0x0000000000CC0000-0x0000000000CDA000-memory.dmp

Filesize
104KB

Download
memory/1044-10-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download
memory/1044-9-0x000000001B1B0000-0x000000001B492000-memory.dmp

Filesize
2.9MB

Download