Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
Stealers/M..._2.exe
windows7-x64
9Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
12-09-2024 02:23
240912-cvfznswere 1004-09-2024 00:09
240904-afvheascla 1003-09-2024 18:57
240903-xl8csavfrb 1003-09-2024 18:12
240903-ws828asgnm 10Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03-09-2024 18:57
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240802-en
General
-
Target
Ransomware/Client-2.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Renames multiple (70) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Deletes itself 1 IoCs
pid Process 2972 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk Client-2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1724 sc.exe 1604 sc.exe 1020 sc.exe 2416 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1460 cmd.exe 2176 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 2436 taskkill.exe 2496 taskkill.exe 2636 taskkill.exe 2908 taskkill.exe 676 taskkill.exe 3004 taskkill.exe 2200 taskkill.exe 2628 taskkill.exe 1180 taskkill.exe 2296 taskkill.exe 2644 taskkill.exe 1896 taskkill.exe 1908 taskkill.exe 2740 taskkill.exe 2060 taskkill.exe 2596 taskkill.exe 1532 taskkill.exe 2528 taskkill.exe 2612 taskkill.exe 2924 taskkill.exe 2516 taskkill.exe 1728 taskkill.exe 2456 taskkill.exe 2476 taskkill.exe 2564 taskkill.exe 2084 taskkill.exe 2408 taskkill.exe 2488 taskkill.exe 2472 taskkill.exe 2844 taskkill.exe 3064 taskkill.exe 1584 taskkill.exe 3000 taskkill.exe 2936 taskkill.exe 596 taskkill.exe 2600 taskkill.exe 2728 taskkill.exe 2568 taskkill.exe 2996 taskkill.exe 2440 taskkill.exe 2704 taskkill.exe 2576 taskkill.exe 2448 taskkill.exe 3048 taskkill.exe 772 taskkill.exe 2492 taskkill.exe 2504 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4052 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2176 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe 2240 Client-2.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 2240 Client-2.exe Token: SeDebugPrivilege 2908 taskkill.exe Token: SeDebugPrivilege 2408 taskkill.exe Token: SeDebugPrivilege 2084 taskkill.exe Token: SeDebugPrivilege 1532 taskkill.exe Token: SeDebugPrivilege 3048 taskkill.exe Token: SeDebugPrivilege 772 taskkill.exe Token: SeDebugPrivilege 1896 taskkill.exe Token: SeDebugPrivilege 3064 taskkill.exe Token: SeDebugPrivilege 2296 taskkill.exe Token: SeDebugPrivilege 2996 taskkill.exe Token: SeDebugPrivilege 108 powershell.exe Token: SeDebugPrivilege 2636 taskkill.exe Token: SeDebugPrivilege 2924 taskkill.exe Token: SeDebugPrivilege 1728 taskkill.exe Token: SeDebugPrivilege 2644 taskkill.exe Token: SeDebugPrivilege 2740 taskkill.exe Token: SeDebugPrivilege 2448 taskkill.exe Token: SeDebugPrivilege 676 taskkill.exe Token: SeDebugPrivilege 2528 taskkill.exe Token: SeDebugPrivilege 2440 taskkill.exe Token: SeDebugPrivilege 3004 taskkill.exe Token: SeDebugPrivilege 2504 taskkill.exe Token: SeDebugPrivilege 2456 taskkill.exe Token: SeDebugPrivilege 2844 taskkill.exe Token: SeDebugPrivilege 2704 taskkill.exe Token: SeDebugPrivilege 2576 taskkill.exe Token: SeDebugPrivilege 1180 taskkill.exe Token: SeDebugPrivilege 596 taskkill.exe Token: SeDebugPrivilege 2596 taskkill.exe Token: SeDebugPrivilege 2612 taskkill.exe Token: SeDebugPrivilege 2568 taskkill.exe Token: SeDebugPrivilege 2492 taskkill.exe Token: SeDebugPrivilege 2488 taskkill.exe Token: SeDebugPrivilege 2436 taskkill.exe Token: SeDebugPrivilege 2564 taskkill.exe Token: SeDebugPrivilege 2600 taskkill.exe Token: SeDebugPrivilege 2728 taskkill.exe Token: SeDebugPrivilege 1908 taskkill.exe Token: SeDebugPrivilege 2628 taskkill.exe Token: SeDebugPrivilege 2516 taskkill.exe Token: SeDebugPrivilege 2200 taskkill.exe Token: SeDebugPrivilege 2496 taskkill.exe Token: SeDebugPrivilege 2472 taskkill.exe Token: SeDebugPrivilege 3000 taskkill.exe Token: SeDebugPrivilege 2060 taskkill.exe Token: SeDebugPrivilege 1584 taskkill.exe Token: SeDebugPrivilege 2936 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 Client-2.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2240 Client-2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1724 2240 Client-2.exe 28 PID 2240 wrote to memory of 1724 2240 Client-2.exe 28 PID 2240 wrote to memory of 1724 2240 Client-2.exe 28 PID 2240 wrote to memory of 2840 2240 Client-2.exe 29 PID 2240 wrote to memory of 2840 2240 Client-2.exe 29 PID 2240 wrote to memory of 2840 2240 Client-2.exe 29 PID 2240 wrote to memory of 1604 2240 Client-2.exe 32 PID 2240 wrote to memory of 1604 2240 Client-2.exe 32 PID 2240 wrote to memory of 1604 2240 Client-2.exe 32 PID 2240 wrote to memory of 1020 2240 Client-2.exe 34 PID 2240 wrote to memory of 1020 2240 Client-2.exe 34 PID 2240 wrote to memory of 1020 2240 Client-2.exe 34 PID 2240 wrote to memory of 2416 2240 Client-2.exe 36 PID 2240 wrote to memory of 2416 2240 Client-2.exe 36 PID 2240 wrote to memory of 2416 2240 Client-2.exe 36 PID 2240 wrote to memory of 2908 2240 Client-2.exe 38 PID 2240 wrote to memory of 2908 2240 Client-2.exe 38 PID 2240 wrote to memory of 2908 2240 Client-2.exe 38 PID 2240 wrote to memory of 2996 2240 Client-2.exe 40 PID 2240 wrote to memory of 2996 2240 Client-2.exe 40 PID 2240 wrote to memory of 2996 2240 Client-2.exe 40 PID 2240 wrote to memory of 2408 2240 Client-2.exe 41 PID 2240 wrote to memory of 2408 2240 Client-2.exe 41 PID 2240 wrote to memory of 2408 2240 Client-2.exe 41 PID 2240 wrote to memory of 772 2240 Client-2.exe 42 PID 2240 wrote to memory of 772 2240 Client-2.exe 42 PID 2240 wrote to memory of 772 2240 Client-2.exe 42 PID 2240 wrote to memory of 3048 2240 Client-2.exe 43 PID 2240 wrote to memory of 3048 2240 Client-2.exe 43 PID 2240 wrote to memory of 3048 2240 Client-2.exe 43 PID 2240 wrote to memory of 3064 2240 Client-2.exe 44 PID 2240 wrote to memory of 3064 2240 Client-2.exe 44 PID 2240 wrote to memory of 3064 2240 Client-2.exe 44 PID 2240 wrote to memory of 2084 2240 Client-2.exe 45 PID 2240 wrote to memory of 2084 2240 Client-2.exe 45 PID 2240 wrote to memory of 2084 2240 Client-2.exe 45 PID 2240 wrote to memory of 1532 2240 Client-2.exe 47 PID 2240 wrote to memory of 1532 2240 Client-2.exe 47 PID 2240 wrote to memory of 1532 2240 Client-2.exe 47 PID 2240 wrote to memory of 1896 2240 Client-2.exe 48 PID 2240 wrote to memory of 1896 2240 Client-2.exe 48 PID 2240 wrote to memory of 1896 2240 Client-2.exe 48 PID 2240 wrote to memory of 2568 2240 Client-2.exe 56 PID 2240 wrote to memory of 2568 2240 Client-2.exe 56 PID 2240 wrote to memory of 2568 2240 Client-2.exe 56 PID 2240 wrote to memory of 2728 2240 Client-2.exe 57 PID 2240 wrote to memory of 2728 2240 Client-2.exe 57 PID 2240 wrote to memory of 2728 2240 Client-2.exe 57 PID 2240 wrote to memory of 2644 2240 Client-2.exe 58 PID 2240 wrote to memory of 2644 2240 Client-2.exe 58 PID 2240 wrote to memory of 2644 2240 Client-2.exe 58 PID 2240 wrote to memory of 2596 2240 Client-2.exe 59 PID 2240 wrote to memory of 2596 2240 Client-2.exe 59 PID 2240 wrote to memory of 2596 2240 Client-2.exe 59 PID 2240 wrote to memory of 2296 2240 Client-2.exe 60 PID 2240 wrote to memory of 2296 2240 Client-2.exe 60 PID 2240 wrote to memory of 2296 2240 Client-2.exe 60 PID 2240 wrote to memory of 2564 2240 Client-2.exe 61 PID 2240 wrote to memory of 2564 2240 Client-2.exe 61 PID 2240 wrote to memory of 2564 2240 Client-2.exe 61 PID 2240 wrote to memory of 2448 2240 Client-2.exe 62 PID 2240 wrote to memory of 2448 2240 Client-2.exe 62 PID 2240 wrote to memory of 2448 2240 Client-2.exe 62 PID 2240 wrote to memory of 2060 2240 Client-2.exe 63
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:1724
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:2840
-
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:1604
-
-
C:\Windows\system32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:1020
-
-
C:\Windows\system32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:2416
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:772
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:2476
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2492
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:596
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:676
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:108
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4052
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1460 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2176
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe2⤵
- Deletes itself
PID:2972 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:636
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]
Filesize4KB
MD54596d95eac1550d3e154a30c65b343b1
SHA162ff0f25bc0f63808f1bca59babb6076131c8907
SHA256bf91a138e506c5c7c17279362e33a8ae7d17ac5883b587df0e9a91c3421ecee5
SHA5122e41f6bd9934f33e33573e77122b93918b711660de80d77dad4e4401ab66c5abeb7f7a6a89b627686f1e4c13fc671a33d09a7c46ef6a9b5e9369fad0d1022a25
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD51a4f2f9113d0623f454a6aed12ba8299
SHA12309dc7c2f56af13df25702c4b99c46333180815
SHA25692d50fc3bda152b02ac4ef867e2bb964c93eab3d1449ca1d616e410b5f162e74
SHA512544b0f6db2152f0a5fbf57535793054066ed7cb3673a2d15fc5758f1d34a36b31e998a766b79b03683b19863c1c88ad283aa18eb97b71a6c33f09cc1dbc01b52
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5e733b30abc2eadf185a0682d9d769f0c
SHA12aca5d0257a739a34af10dc316c1a0f62ce6b2eb
SHA2569f36973eb38b126783d35fc1e249473a9a2046283752bfa56e04d61abd03c770
SHA5121e06725ba40c09e9d96690a1eb7a9664cb85f07b21f7cdc89ce0d5b04b5077f63a83a15a1cdc06c36369ee65073d75618e951638681f9781bab4abaa400404ab
-
Filesize
828B
MD5a24f0bff399b2706cac3e45ff62cbe51
SHA129fe4ecb932588f57197c94e0c822b8b993a3d20
SHA256fa81e42d76e20c007414b1c71d1fdf3c569085ddb8d1d97b14c6e73ba18952a2
SHA5127fcef5aac13a7c4d9c088051770b7735fd7e42d37bdb1aad92a8982f2b480b1ec67c8fb64a6d13a1a16b6cf4af1f3a4569ad50a582c1128ff39e04af60433803
-
C:\Users\Admin\Desktop\UseJoin.xlsx.energy[[email protected]]
Filesize16KB
MD5268fe801c00a866f62ec4ed0b2f747a5
SHA19964e0a771a74ff765e72f6a423608aa0d496da3
SHA256cd7c39ad76489864d74de9fbf0227d44fb6c0ae82b250c0080e34211979eae0f
SHA512fe0cc51803990dd4d12e4b3f448c32dc737a10ff7242781a81458b524af6cbba462119501a850a400d3f2e4feb060be9b362b42721cd728c1e5484f627c57d6a