Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2024, 19:28

General

  • Target

    513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe

  • Size

    477KB

  • MD5

    e931ab5882d62ea08e498d90e2e11ad0

  • SHA1

    5b68fe6556752d6bf077740d1b297f65a2673b54

  • SHA256

    513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425

  • SHA512

    f12285f65854fbce23b6c4fee6ef662cb61d65b874f17347494c1d0c9984c24acb4c1d703d7821b482864e271d08ccfce73e40a4cff9112d9907fea527ab6042

  • SSDEEP

    3072:/NV+7SXjtEjDg/s6L7h/gT72ZywWWq/ePVl/uw7cFh:/TwSXNUQmkWWjzcF

Malware Config

Signatures

  • HelloKitty Ransomware

    Ransomware family which has been active since late 2020, and in early 2021 a variant compromised the CDProjektRed game studio.

  • Renames multiple (191) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Kills process with taskkill 35 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe
    "C:\Users\Admin\AppData\Local\Temp\513266fb23782f2bff65b6e8f059c4f4bb99562610c44110c4a463338f91d425.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im mysql*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:796
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im dsa*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2340
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im Ntrtscan*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2328
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im ds_monitor*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2164
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im Notifier*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2228
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im TmListen*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2728
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im iVPAgent*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2848
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im CNTAoSMgr*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2740
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im IBM*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2432
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im bes10*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2620
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im black*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2724
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im robo*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2604
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im copy*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1352
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im store.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:320
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im sql*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1724
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im vee*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1644
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im wrsa*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1840
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im wrsa.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2804
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im postg*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2192
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im sage*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2092
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop MSSQLServerADHelper100
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2188
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop MSSQLServerADHelper100
        3⤵
          PID:2008
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\System32\net.exe" stop MSSQL$ISARS
        2⤵
          PID:2936
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop MSSQL$ISARS
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3004
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\System32\net.exe" stop MSSQL$MSFW
          2⤵
            PID:1920
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop MSSQL$MSFW
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2080
          • C:\Windows\SysWOW64\net.exe
            "C:\Windows\System32\net.exe" stop SQLAgent$ISARS
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1836
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop SQLAgent$ISARS
              3⤵
                PID:2396
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\System32\net.exe" stop SQLAgent$MSFW
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1540
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop SQLAgent$MSFW
                3⤵
                  PID:1888
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" stop SQLBrowser
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1736
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop SQLBrowser
                  3⤵
                    PID:2148
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\System32\net.exe" stop ReportServer$ISARS
                  2⤵
                    PID:640
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop ReportServer$ISARS
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2860
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" stop SQLWriter
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1636
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop SQLWriter
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2636
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" stop WinDefend
                    2⤵
                      PID:1700
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop WinDefend
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2364
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" stop mr2kserv
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2004
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop mr2kserv
                        3⤵
                          PID:2632
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" stop MSExchangeADTopology
                        2⤵
                          PID:980
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop MSExchangeADTopology
                            3⤵
                              PID:2832
                          • C:\Windows\SysWOW64\net.exe
                            "C:\Windows\System32\net.exe" stop MSExchangeFBA
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:1780
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop MSExchangeFBA
                              3⤵
                                PID:2716
                            • C:\Windows\SysWOW64\net.exe
                              "C:\Windows\System32\net.exe" stop MSExchangeIS
                              2⤵
                                PID:2880
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 stop MSExchangeIS
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2876
                              • C:\Windows\SysWOW64\net.exe
                                "C:\Windows\System32\net.exe" stop MSExchangeSA
                                2⤵
                                  PID:2776
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop MSExchangeSA
                                    3⤵
                                      PID:2904
                                  • C:\Windows\SysWOW64\net.exe
                                    "C:\Windows\System32\net.exe" stop ShadowProtectSvc
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2836
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 stop ShadowProtectSvc
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2044
                                  • C:\Windows\SysWOW64\net.exe
                                    "C:\Windows\System32\net.exe" stop SPAdminV4
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2884
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 stop SPAdminV4
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2956
                                  • C:\Windows\SysWOW64\net.exe
                                    "C:\Windows\System32\net.exe" stop SPTimerV4
                                    2⤵
                                    • System Time Discovery
                                    PID:2208
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 stop SPTimerV4
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Time Discovery
                                      PID:2028
                                  • C:\Windows\SysWOW64\net.exe
                                    "C:\Windows\System32\net.exe" stop SPTraceV4
                                    2⤵
                                      PID:2608
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 stop SPTraceV4
                                        3⤵
                                          PID:2760
                                      • C:\Windows\SysWOW64\net.exe
                                        "C:\Windows\System32\net.exe" stop SPUserCodeV4
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2560
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop SPUserCodeV4
                                          3⤵
                                            PID:2348
                                        • C:\Windows\SysWOW64\net.exe
                                          "C:\Windows\System32\net.exe" stop SPWriterV4
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1492
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 stop SPWriterV4
                                            3⤵
                                              PID:1404
                                          • C:\Windows\SysWOW64\net.exe
                                            "C:\Windows\System32\net.exe" stop SPSearch4
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:824
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 stop SPSearch4
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2424
                                          • C:\Windows\SysWOW64\net.exe
                                            "C:\Windows\System32\net.exe" stop MSSQLServerADHelper100
                                            2⤵
                                              PID:2660
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 stop MSSQLServerADHelper100
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2068
                                            • C:\Windows\SysWOW64\net.exe
                                              "C:\Windows\System32\net.exe" stop IISADMIN
                                              2⤵
                                                PID:2824
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 stop IISADMIN
                                                  3⤵
                                                    PID:3048
                                                • C:\Windows\SysWOW64\net.exe
                                                  "C:\Windows\System32\net.exe" stop firebirdguardiandefaultinstance
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2624
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 stop firebirdguardiandefaultinstance
                                                    3⤵
                                                      PID:1348
                                                  • C:\Windows\SysWOW64\net.exe
                                                    "C:\Windows\System32\net.exe" stop ibmiasrw
                                                    2⤵
                                                      PID:2692
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 stop ibmiasrw
                                                        3⤵
                                                          PID:3004
                                                      • C:\Windows\SysWOW64\net.exe
                                                        "C:\Windows\System32\net.exe" stop QBCFMonitorService
                                                        2⤵
                                                          PID:588
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 stop QBCFMonitorService
                                                            3⤵
                                                              PID:1040
                                                          • C:\Windows\SysWOW64\net.exe
                                                            "C:\Windows\System32\net.exe" stop QBVSS
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2844
                                                            • C:\Windows\SysWOW64\net1.exe
                                                              C:\Windows\system32\net1 stop QBVSS
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2080
                                                          • C:\Windows\SysWOW64\net.exe
                                                            "C:\Windows\System32\net.exe" stop QBPOSDBServiceV12
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2948
                                                            • C:\Windows\SysWOW64\net1.exe
                                                              C:\Windows\system32\net1 stop QBPOSDBServiceV12
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1888
                                                          • C:\Windows\SysWOW64\net.exe
                                                            "C:\Windows\System32\net.exe" stop "IBM Domino Server(CProgramFilesIBMDominodata)"
                                                            2⤵
                                                              PID:1768
                                                              • C:\Windows\SysWOW64\net1.exe
                                                                C:\Windows\system32\net1 stop "IBM Domino Server(CProgramFilesIBMDominodata)"
                                                                3⤵
                                                                  PID:1640
                                                              • C:\Windows\SysWOW64\net.exe
                                                                "C:\Windows\System32\net.exe" stop "IBM Domino Diagnostics(CProgramFilesIBMDomino)"
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1512
                                                                • C:\Windows\SysWOW64\net1.exe
                                                                  C:\Windows\system32\net1 stop "IBM Domino Diagnostics(CProgramFilesIBMDomino)"
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:608
                                                              • C:\Windows\SysWOW64\net.exe
                                                                "C:\Windows\System32\net.exe" stop IISADMIN
                                                                2⤵
                                                                  PID:2528
                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                    C:\Windows\system32\net1 stop IISADMIN
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:320
                                                                • C:\Windows\SysWOW64\net.exe
                                                                  "C:\Windows\System32\net.exe" stop "Simply Accounting Database Connection Manager"
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2148
                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                    C:\Windows\system32\net1 stop "Simply Accounting Database Connection Manager"
                                                                    3⤵
                                                                      PID:1192
                                                                  • C:\Windows\SysWOW64\net.exe
                                                                    "C:\Windows\System32\net.exe" stop QuickBooksDB1
                                                                    2⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:884
                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                      C:\Windows\system32\net1 stop QuickBooksDB1
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1588
                                                                  • C:\Windows\SysWOW64\net.exe
                                                                    "C:\Windows\System32\net.exe" stop QuickBooksDB2
                                                                    2⤵
                                                                      PID:1204
                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                        C:\Windows\system32\net1 stop QuickBooksDB2
                                                                        3⤵
                                                                          PID:1596
                                                                      • C:\Windows\SysWOW64\net.exe
                                                                        "C:\Windows\System32\net.exe" stop QuickBooksDB3
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2932
                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                          C:\Windows\system32\net1 stop QuickBooksDB3
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2916
                                                                      • C:\Windows\SysWOW64\net.exe
                                                                        "C:\Windows\System32\net.exe" stop QuickBooksDB4
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1928
                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                          C:\Windows\system32\net1 stop QuickBooksDB4
                                                                          3⤵
                                                                            PID:2508
                                                                        • C:\Windows\SysWOW64\net.exe
                                                                          "C:\Windows\System32\net.exe" stop QuickBooksDB5
                                                                          2⤵
                                                                            PID:792
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 stop QuickBooksDB5
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:484
                                                                          • C:\Windows\SysWOW64\net.exe
                                                                            "C:\Windows\System32\net.exe" stop QuickBooksDB6
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1960
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 stop QuickBooksDB6
                                                                              3⤵
                                                                                PID:616
                                                                            • C:\Windows\SysWOW64\net.exe
                                                                              "C:\Windows\System32\net.exe" stop QuickBooksDB7
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1500
                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                C:\Windows\system32\net1 stop QuickBooksDB7
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1628
                                                                            • C:\Windows\SysWOW64\net.exe
                                                                              "C:\Windows\System32\net.exe" stop QuickBooksDB8
                                                                              2⤵
                                                                                PID:1724
                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                  C:\Windows\system32\net1 stop QuickBooksDB8
                                                                                  3⤵
                                                                                    PID:1700
                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                  "C:\Windows\System32\net.exe" stop QuickBooksDB9
                                                                                  2⤵
                                                                                    PID:1744
                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                      C:\Windows\system32\net1 stop QuickBooksDB9
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2768
                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                    "C:\Windows\System32\net.exe" stop QuickBooksDB10
                                                                                    2⤵
                                                                                      PID:3052
                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                        C:\Windows\system32\net1 stop QuickBooksDB10
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2964
                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                      "C:\Windows\System32\net.exe" stop QuickBooksDB11
                                                                                      2⤵
                                                                                        PID:1740
                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                          C:\Windows\system32\net1 stop QuickBooksDB11
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1648
                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                        "C:\Windows\System32\net.exe" stop QuickBooksDB12
                                                                                        2⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1712
                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                          C:\Windows\system32\net1 stop QuickBooksDB12
                                                                                          3⤵
                                                                                            PID:1872
                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                          "C:\Windows\System32\net.exe" stop QuickBooksDB13
                                                                                          2⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1880
                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                            C:\Windows\system32\net1 stop QuickBooksDB13
                                                                                            3⤵
                                                                                              PID:2736
                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                            "C:\Windows\System32\net.exe" stop QuickBooksDB14
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3036
                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                              C:\Windows\system32\net1 stop QuickBooksDB14
                                                                                              3⤵
                                                                                                PID:2172
                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                              "C:\Windows\System32\net.exe" stop QuickBooksDB15
                                                                                              2⤵
                                                                                                PID:2960
                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                  C:\Windows\system32\net1 stop QuickBooksDB15
                                                                                                  3⤵
                                                                                                    PID:1780
                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                  "C:\Windows\System32\net.exe" stop QuickBooksDB16
                                                                                                  2⤵
                                                                                                    PID:2584
                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                      C:\Windows\system32\net1 stop QuickBooksDB16
                                                                                                      3⤵
                                                                                                        PID:2716
                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                      "C:\Windows\System32\net.exe" stop QuickBooksDB17
                                                                                                      2⤵
                                                                                                        PID:2248
                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                          C:\Windows\system32\net1 stop QuickBooksDB17
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:2520
                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                        "C:\Windows\System32\net.exe" stop QuickBooksDB18
                                                                                                        2⤵
                                                                                                          PID:640
                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                            C:\Windows\system32\net1 stop QuickBooksDB18
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1108
                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                          "C:\Windows\System32\net.exe" stop QuickBooksDB19
                                                                                                          2⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:2876
                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                            C:\Windows\system32\net1 stop QuickBooksDB19
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2836
                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                          "C:\Windows\System32\net.exe" stop QuickBooksDB20
                                                                                                          2⤵
                                                                                                            PID:2712
                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                              C:\Windows\system32\net1 stop QuickBooksDB20
                                                                                                              3⤵
                                                                                                                PID:2044
                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                              "C:\Windows\System32\net.exe" stop QuickBooksDB21
                                                                                                              2⤵
                                                                                                                PID:2432
                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                  C:\Windows\system32\net1 stop QuickBooksDB21
                                                                                                                  3⤵
                                                                                                                    PID:2368
                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                  "C:\Windows\System32\net.exe" stop QuickBooksDB22
                                                                                                                  2⤵
                                                                                                                    PID:2196
                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                      C:\Windows\system32\net1 stop QuickBooksDB22
                                                                                                                      3⤵
                                                                                                                        PID:2588
                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                      "C:\Windows\System32\net.exe" stop QuickBooksDB23
                                                                                                                      2⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:1132
                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                        C:\Windows\system32\net1 stop QuickBooksDB23
                                                                                                                        3⤵
                                                                                                                          PID:1728
                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                        "C:\Windows\System32\net.exe" stop QuickBooksDB24
                                                                                                                        2⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:448
                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                          C:\Windows\system32\net1 stop QuickBooksDB24
                                                                                                                          3⤵
                                                                                                                            PID:2620
                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                          "C:\Windows\System32\net.exe" stop QuickBooksDB25
                                                                                                                          2⤵
                                                                                                                            PID:2760
                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                              C:\Windows\system32\net1 stop QuickBooksDB25
                                                                                                                              3⤵
                                                                                                                                PID:2868
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2712"
                                                                                                                              2⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1480
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2712"
                                                                                                                              2⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2068
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2712"
                                                                                                                              2⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2824
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2432"
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:824
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2432"
                                                                                                                              2⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2696
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2432"
                                                                                                                              2⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2944
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2196"
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:3004
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2196"
                                                                                                                              2⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:588
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2196"
                                                                                                                              2⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1696
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "1132"
                                                                                                                              2⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1876
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "1132"
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:3068
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "1132"
                                                                                                                              2⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:788
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2760"
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:972
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2760"
                                                                                                                              2⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1960
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "C:\Windows\System32\taskkill.exe" /f /PID "2760"
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1688
                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe "-920361397-455352954145608291295062029436467011-2083657928-1630133219859086464"
                                                                                                                            1⤵
                                                                                                                              PID:1540
                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe "986654627-1626514809-888695962-11799503044450980231166288374-1223185277-1066786889"
                                                                                                                              1⤵
                                                                                                                                PID:1736
                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe "-1189573867-892120566942384988-38111527618959676111091956562189480072106698280"
                                                                                                                                1⤵
                                                                                                                                  PID:1644
                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe "1205979640-1732864898-301322901944405601-13774720391190635593-7799910221120107683"
                                                                                                                                  1⤵
                                                                                                                                    PID:2804
                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-161957301-5480256554841813261178088080-1277238527-865664954-68090980-891309342"
                                                                                                                                    1⤵
                                                                                                                                      PID:2004
                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                      \??\C:\Windows\system32\conhost.exe "368450378-525036244-350061796-201167179-99720042763005170518104128481732540735"
                                                                                                                                      1⤵
                                                                                                                                        PID:2776
                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe "8851457492083940483523702463-1920929385-493451444697085792-355570833-1760681848"
                                                                                                                                        1⤵
                                                                                                                                          PID:2424
                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe "3955504191830642786-595195050-6302489641762350269-78358277010697247181174836406"
                                                                                                                                          1⤵
                                                                                                                                            PID:2956
                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe "1820029086-692687778-359123049649262640296350747-11730651561128499137-1889383716"
                                                                                                                                            1⤵
                                                                                                                                              PID:2740
                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe "59804450320334554-1798728081-916215206-715834437-416751795982545285-957767028"
                                                                                                                                              1⤵
                                                                                                                                                PID:616
                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe "1075430327-1402677405143363371-41797668-992576816101319521648350176576583233"
                                                                                                                                                1⤵
                                                                                                                                                  PID:1840

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\read_me_lkd.txt

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  456f9ee19279b7267f4a39a1d09d23ff

                                                                                                                                                  SHA1

                                                                                                                                                  ff811ade989d29d81537b1549489b55965e78041

                                                                                                                                                  SHA256

                                                                                                                                                  76800f4dd8d468918290faced7b06fa0a287930d4c76e7719d49b41ba43a45c7

                                                                                                                                                  SHA512

                                                                                                                                                  5117b46ced621edb9d2552539613e76982d4d7f45ba2a709d92b6b0eab3f955af596fd5079fdc9326f784804a7c5f81e5d1e7a3bd3373b6fe50235afa87f8f07