Analysis
- max time kernel
125s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2024, 09:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
advanced_ip_scanner.exe
Resource
win7-20240903-en
windows7-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
advanced_ip_scanner.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
28 signatures
150 seconds
General
- Target advanced_ip_scanner.exe
- Size 2.6MB
- Sample241010-lpmdyayemp
- SHA256 ad640f32617bf57f7b4547fc686cc3e0a9875811ef6be1cb257a0607c391fdb8
- MD5 85921539592aeaff3fbe0e104f344db0
- SHA1 2ca28c946d6632f70c70e555afa8d9a072039d79
- SHA512 76f07e5d36dabeb56ffc9301cc82c32a975f4e83ad5d165cc8631e1809675011eba85e3d542e8fd2b6b3ae3a9228f4ca5e7ff953fb1446559879c081aa94fbfb
- SSDEEP 49152:wgwR1ifu1DBgutBPNUF+zTR3HLHaY2UtKvu5vgmAbjNFAF5hcb:wgwR1vguPPocHHfcJbJFAe
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023c6b-37.dat family_mimic - Mimic
Ransomware family was first exploited in the wild in 2022.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 116 bcdedit.exe 2476 bcdedit.exe - Renames multiple (5803) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 3084 wbadmin.exe -
pid Process 1448 wbadmin.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe BACHOKTECHET.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation advanced_ip_scanner.exe - Executes dropped EXE 10 IoCs
pid Process 3496 7za.exe 2112 7za.exe 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe 1208 BACHOKTECHET.exe 4872 BACHOKTECHET.exe 4608 BACHOKTECHET.exe 4604 BACHOKTECHET.exe 4028 Everything.exe 4864 DC.exe 3900 Everything.exe - Loads dropped DLL 5 IoCs
pid Process 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe 1208 BACHOKTECHET.exe 4872 BACHOKTECHET.exe 4608 BACHOKTECHET.exe 4604 BACHOKTECHET.exe - Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell\open\command ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell\open ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell\open\command BACHOKTECHET.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" BACHOKTECHET.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BACHOKTECHET = "\"C:\\Users\\Admin\\AppData\\Local\\BFBF5FF3-02FF-66A7-72D2-688544C61A80\\BACHOKTECHET.exe\" " ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\X: Everything.exe - Power Settings 1 TTPs 15 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1776 powercfg.exe 3396 powercfg.exe 3380 powercfg.exe 2160 powercfg.exe 1656 powercfg.exe 4212 powercfg.exe 772 powercfg.exe 1728 powercfg.exe 4828 powercfg.exe 4664 powercfg.exe 3008 powercfg.exe 4256 powercfg.exe 3892 powercfg.exe 3956 powercfg.exe 1536 powercfg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\da-dk\ui-strings.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\close_x.png.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_opencarat_18.svg.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons.png.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARABD.TTF.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\ui-strings.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\selector.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\AddDebug.wav.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Certificates_R.aapp.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ui-strings.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WordCombinedFloatieModel.bin.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\ui-strings.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msolui.rll.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ui-strings.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\ui-strings.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\ui-strings.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\7-Zip\descript.ion.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner.gif.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\plugins.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\ui-strings.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_field_grabber.png.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main.css.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud.png.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\ui-strings.js.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql120.xsl.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\openssl64.dlla.manifest.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\sendforsignature.svg.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_anonymoususer_18.svg.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe -
pid Process 2880 powershell.exe 4544 powershell.exe 4576 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BACHOKTECHET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language advanced_ip_scanner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BACHOKTECHET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BACHOKTECHET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BACHOKTECHET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe - Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell\open\command ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" BACHOKTECHET.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell\open\command BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open BACHOKTECHET.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell\open ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\README_SOLVETHIS.txt\"" BACHOKTECHET.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command BACHOKTECHET.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks\ = "mimicfile" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\exefile ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command BACHOKTECHET.exe Key created \REGISTRY\MACHINE\Software\Classes\.ELONMUSKISGREEDY-Ha0vPWYu4HMcrUt8VtQ-3BIEYzm_LY9OSIsJOMUbMks BACHOKTECHET.exe - Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 4544 powershell.exe 4544 powershell.exe 2880 powershell.exe 2880 powershell.exe 4576 powershell.exe 4576 powershell.exe 2880 powershell.exe 4544 powershell.exe 4576 powershell.exe 4608 BACHOKTECHET.exe 4608 BACHOKTECHET.exe 4604 BACHOKTECHET.exe 4604 BACHOKTECHET.exe 1208 BACHOKTECHET.exe 1208 BACHOKTECHET.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3496 7za.exe Token: 35 3496 7za.exe Token: SeRestorePrivilege 2112 7za.exe Token: 35 2112 7za.exe Token: SeSecurityPrivilege 2112 7za.exe Token: SeSecurityPrivilege 2112 7za.exe Token: SeIncreaseQuotaPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeSecurityPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeTakeOwnershipPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeLoadDriverPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeSystemProfilePrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeSystemtimePrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeProfSingleProcessPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeIncBasePriorityPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeCreatePagefilePrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeBackupPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeRestorePrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeShutdownPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeDebugPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeSystemEnvironmentPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeChangeNotifyPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeRemoteShutdownPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeUndockPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeManageVolumePrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeImpersonatePrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeCreateGlobalPrivilege 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: 33 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: 34 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: 35 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: 36 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeIncreaseQuotaPrivilege 1208 BACHOKTECHET.exe Token: SeSecurityPrivilege 1208 BACHOKTECHET.exe Token: SeTakeOwnershipPrivilege 1208 BACHOKTECHET.exe Token: SeLoadDriverPrivilege 1208 BACHOKTECHET.exe Token: SeSystemProfilePrivilege 1208 BACHOKTECHET.exe Token: SeSystemtimePrivilege 1208 BACHOKTECHET.exe Token: SeProfSingleProcessPrivilege 1208 BACHOKTECHET.exe Token: SeIncBasePriorityPrivilege 1208 BACHOKTECHET.exe Token: SeCreatePagefilePrivilege 1208 BACHOKTECHET.exe Token: SeBackupPrivilege 1208 BACHOKTECHET.exe Token: SeRestorePrivilege 1208 BACHOKTECHET.exe Token: SeShutdownPrivilege 1208 BACHOKTECHET.exe Token: SeDebugPrivilege 1208 BACHOKTECHET.exe Token: SeSystemEnvironmentPrivilege 1208 BACHOKTECHET.exe Token: SeChangeNotifyPrivilege 1208 BACHOKTECHET.exe Token: SeRemoteShutdownPrivilege 1208 BACHOKTECHET.exe Token: SeUndockPrivilege 1208 BACHOKTECHET.exe Token: SeManageVolumePrivilege 1208 BACHOKTECHET.exe Token: SeImpersonatePrivilege 1208 BACHOKTECHET.exe Token: SeCreateGlobalPrivilege 1208 BACHOKTECHET.exe Token: 33 1208 BACHOKTECHET.exe Token: 34 1208 BACHOKTECHET.exe Token: 35 1208 BACHOKTECHET.exe Token: 36 1208 BACHOKTECHET.exe Token: SeIncreaseQuotaPrivilege 4604 BACHOKTECHET.exe Token: SeSecurityPrivilege 4604 BACHOKTECHET.exe Token: SeTakeOwnershipPrivilege 4604 BACHOKTECHET.exe Token: SeLoadDriverPrivilege 4604 BACHOKTECHET.exe Token: SeSystemProfilePrivilege 4604 BACHOKTECHET.exe Token: SeIncreaseQuotaPrivilege 4608 BACHOKTECHET.exe Token: SeSystemtimePrivilege 4604 BACHOKTECHET.exe Token: SeSecurityPrivilege 4608 BACHOKTECHET.exe Token: SeProfSingleProcessPrivilege 4604 BACHOKTECHET.exe Token: SeTakeOwnershipPrivilege 4608 BACHOKTECHET.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4028 Everything.exe 3900 Everything.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 3496 2008 advanced_ip_scanner.exe 86 PID 2008 wrote to memory of 3496 2008 advanced_ip_scanner.exe 86 PID 2008 wrote to memory of 3496 2008 advanced_ip_scanner.exe 86 PID 2008 wrote to memory of 2112 2008 advanced_ip_scanner.exe 88 PID 2008 wrote to memory of 2112 2008 advanced_ip_scanner.exe 88 PID 2008 wrote to memory of 2112 2008 advanced_ip_scanner.exe 88 PID 2008 wrote to memory of 1052 2008 advanced_ip_scanner.exe 90 PID 2008 wrote to memory of 1052 2008 advanced_ip_scanner.exe 90 PID 2008 wrote to memory of 1052 2008 advanced_ip_scanner.exe 90 PID 1052 wrote to memory of 1208 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe 91 PID 1052 wrote to memory of 1208 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe 91 PID 1052 wrote to memory of 1208 1052 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe 91 PID 1208 wrote to memory of 3436 1208 BACHOKTECHET.exe 92 PID 1208 wrote to memory of 3436 1208 BACHOKTECHET.exe 92 PID 1208 wrote to memory of 3436 1208 BACHOKTECHET.exe 92 PID 1208 wrote to memory of 4872 1208 BACHOKTECHET.exe 93 PID 1208 wrote to memory of 4872 1208 BACHOKTECHET.exe 93 PID 1208 wrote to memory of 4872 1208 BACHOKTECHET.exe 93 PID 1208 wrote to memory of 4608 1208 BACHOKTECHET.exe 94 PID 1208 wrote to memory of 4608 1208 BACHOKTECHET.exe 94 PID 1208 wrote to memory of 4608 1208 BACHOKTECHET.exe 94 PID 1208 wrote to memory of 4604 1208 BACHOKTECHET.exe 96 PID 1208 wrote to memory of 4604 1208 BACHOKTECHET.exe 96 PID 1208 wrote to memory of 4604 1208 BACHOKTECHET.exe 96 PID 1208 wrote to memory of 4028 1208 BACHOKTECHET.exe 95 PID 1208 wrote to memory of 4028 1208 BACHOKTECHET.exe 95 PID 1208 wrote to memory of 4028 1208 BACHOKTECHET.exe 95 PID 3436 wrote to memory of 4864 3436 cmd.exe 98 PID 3436 wrote to memory of 4864 3436 cmd.exe 98 PID 3436 wrote to memory of 4864 3436 cmd.exe 98 PID 1208 wrote to memory of 3396 1208 BACHOKTECHET.exe 100 PID 1208 wrote to memory of 3396 1208 BACHOKTECHET.exe 100 PID 1208 wrote to memory of 3892 1208 BACHOKTECHET.exe 101 PID 1208 wrote to memory of 3892 1208 BACHOKTECHET.exe 101 PID 1208 wrote to memory of 4212 1208 BACHOKTECHET.exe 102 PID 1208 wrote to memory of 4212 1208 BACHOKTECHET.exe 102 PID 1208 wrote to memory of 772 1208 BACHOKTECHET.exe 103 PID 1208 wrote to memory of 772 1208 BACHOKTECHET.exe 103 PID 1208 wrote to memory of 1728 1208 BACHOKTECHET.exe 104 PID 1208 wrote to memory of 1728 1208 BACHOKTECHET.exe 104 PID 1208 wrote to memory of 4828 1208 BACHOKTECHET.exe 105 PID 1208 wrote to memory of 4828 1208 BACHOKTECHET.exe 105 PID 1208 wrote to memory of 3380 1208 BACHOKTECHET.exe 106 PID 1208 wrote to memory of 3380 1208 BACHOKTECHET.exe 106 PID 1208 wrote to memory of 2160 1208 BACHOKTECHET.exe 107 PID 1208 wrote to memory of 2160 1208 BACHOKTECHET.exe 107 PID 1208 wrote to memory of 3956 1208 BACHOKTECHET.exe 108 PID 1208 wrote to memory of 3956 1208 BACHOKTECHET.exe 108 PID 1208 wrote to memory of 1656 1208 BACHOKTECHET.exe 109 PID 1208 wrote to memory of 1656 1208 BACHOKTECHET.exe 109 PID 1208 wrote to memory of 4664 1208 BACHOKTECHET.exe 110 PID 1208 wrote to memory of 4664 1208 BACHOKTECHET.exe 110 PID 1208 wrote to memory of 1776 1208 BACHOKTECHET.exe 111 PID 1208 wrote to memory of 1776 1208 BACHOKTECHET.exe 111 PID 1208 wrote to memory of 3008 1208 BACHOKTECHET.exe 112 PID 1208 wrote to memory of 3008 1208 BACHOKTECHET.exe 112 PID 1208 wrote to memory of 4256 1208 BACHOKTECHET.exe 113 PID 1208 wrote to memory of 4256 1208 BACHOKTECHET.exe 113 PID 1208 wrote to memory of 1536 1208 BACHOKTECHET.exe 114 PID 1208 wrote to memory of 1536 1208 BACHOKTECHET.exe 114 PID 1208 wrote to memory of 2880 1208 BACHOKTECHET.exe 115 PID 1208 wrote to memory of 2880 1208 BACHOKTECHET.exe 115 PID 1208 wrote to memory of 4544 1208 BACHOKTECHET.exe 116 PID 1208 wrote to memory of 4544 1208 BACHOKTECHET.exe 116 - System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System BACHOKTECHET.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection BACHOKTECHET.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer BACHOKTECHET.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\advanced_ip_scanner.exe"C:\Users\Admin\AppData\Local\Temp\advanced_ip_scanner.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p1197321047146881885 Everything64.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1208 -
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\DC.exeDC.exe /D5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4864
-
-
-
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe" -e watch -pid 1208 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4872
-
-
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608
-
-
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\Everything.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4028
-
-
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4604
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off4⤵
- Power Settings
PID:3396
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:3892
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:4212
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:772
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:1728
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:4828
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:3380
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:2160
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:3956
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:1656
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:4664
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:1776
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:3008
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵
- Power Settings
PID:4256
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵
- Power Settings
PID:1536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4544
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4576
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:116
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2476
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3084
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:1448
-
-
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\Everything.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3900
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- System Location Discovery: System Language Discovery
PID:228
-
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3596
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2212
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3956
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2860
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:116
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4196
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3176
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4020
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2380
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:232
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2012
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:3480
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:452
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:992
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2272
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\Everything.db
- Size 13.2MB
- SHA256 61246cb50fb8eba0b2bfc4947b587c8c86eaff0d7db1af24ef764e7d48cf2f79
- MD5 fc964cb26b903c6bf713904cbe686609
- SHA1 e03e5f270fc98eee2bca2cc9219b2b45514c6bc6
- SHA512 cb0ceffc8c46bd7686dfbb38d5bd77b95a31d4bd3e9a9e4a1be140d9bb8ce4fa14537533b6751515e6076ff48b0bac0ff3d3b65584a7d628d3b22cf267a250a1
- SSDEEP 98304:5Ju0nVOIDXr/pEBlvtL8ixY87o/XqqZ67ptMKU2dsOrP/jZ7DW0+xK3xQHt15Jtl:ju0arP17KJg3xiXT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\Everything.ini
- Size 20KB
- SHA256 15a830fa3ea541a5211d1c5da4803f854348289e838c104abde236d8cdb5c5b5
- MD5 182047ec6abeca1022177b3b714362bc
- SHA1 d5a6263f202fd76983cb2d7bf08b5095e3b546e0
- SHA512 1c83834dec5bcc05c87865ae71b71cc92a1abaad753198a162d6c961c17ea5664ccb377ced499ee6a83f3bbaf07164b651c214da745c19411e9bae0b0f678d39
- SSDEEP 192:RjCxnELo+ny9QOL4jwnTef2JFTAiwTMisXZiPgCSjvtM8nbVwoQTLAu+Ztul4Axa:Rug6TeEFTA+isX/M8nvZ4z8lJCK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\session.tmp
- Size 32B
- SHA256 8cc5cd1d91a50231a2d8e4f7d85c53245f6ee3843a175a2610e0c8c9f003b1cb
- MD5 a1d75a4da81d49d28c18e0b2bd7ce2cf
- SHA1 9749c353f06a12652444866c843d7449e4331e7a
- SHA512 f444581d45c6bdf3709aa322c30044de7e6d9ace9567e80251f83835cb47161652745d017fd7d39a3d3a4c2376077a42b0b7797744d1686deebcc099dbc80174
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
- MD5 d85ba6ff808d9e5444a4b369f5bc2730
- SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
- SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
- MD5 77d622bb1a5b250869a3238b9bc1402b
- SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
- SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 120B
- SHA256 a26a40cba7ff2edfacf55be3eb8814f85741a187ff78750e9d1594b97335af93
- MD5 ed88599937142d00c86f103e4f0b00fe
- SHA1 adad7ca5bd544553e6f001b2f5400359f2d3b69a
- SHA512 c1d83e45ebc73975b81fff27bbde9a7c2be47a6b38498997fdd9e96d53340da704c8569b114d142d3fc3d272bb65306cb1969f6d7f83b4da43d51419b0546b14
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\README_SOLVETHIS.txt
- Size 1KB
- SHA256 1f61a0b562f8b7b3b7b6486c885fb0d5e92945c7aff1be9f95eb10a43ab0ef69
- MD5 1bec750e064bd67f7fb63d707ca58fda
- SHA1 daa0ba4a483a98e3b97a359712da42f42a2f33dd
- SHA512 7f102dd7d9dc2f8feb0b6eddf0efdd3f24891213bccfe8d9e0515c4bd80df0527f01167b6de34ed7074b257e4997aa74d2e8502b745c4e7b276bffee810b12e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
- Size 210B
- SHA256 c2966f06cb6a4a314d5ace764ac3949c83500c383ad260b0e9e3fd60da20092c
- MD5 f48067c39b81ebcaef918ee1b2226e1a
- SHA1 092240ee6d1a37bb14dc330375862d7bfdfc28ff
- SHA512 330e77cabb8221258490ee2ae969de5492564eb2f1e4907a555a1b4b40d3b7fef686c09e7c137f3179f793d0a316ab48b891e982b90e915ed6888217faf82f03
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
- Size 772KB
- SHA256 ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
- MD5 b93eb0a48c91a53bda6a1a074a4b431e
- SHA1 ac693a14c697b1a8ee80318e260e817b8ee2aa86
- SHA512 732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
- SSDEEP 24576:DFhjj7f4K+ao308d0ORMz27R0iIdclDJiD:JlwpP90OFWxD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe
- Size 802KB
- SHA256 c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
- MD5 ac34ba84a5054cd701efad5dd14645c9
- SHA1 dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
- SHA512 df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
- SSDEEP 12288:NaWzgMg7v3qnCiPErQohh0F4uCJ8lnyIQJ9QudhzYOekDXiGt8PSmQ:MaHMv6CrrjSnyIQ8+ekGA8PSmQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe
- Size 2.3MB
- SHA256 b3658008f5c35db1cc1c72fbf9587b8de23e5a3efd53186805deef84b09318d2
- MD5 36adf0930dee86c24335c023b9de1956
- SHA1 f7400c68d2a13c9ddad0adb1ace6b70ed9a47bd6
- SHA512 09eb1c90760c4b065880874318f3107a096820203854fff48dc8e26d330e3b483be1a84c3e5cd57a87345190f1d2c92349587b5628dbed1d2a8adde34fae040b
- SSDEEP 49152:glhR5no/qrf5EQlRUhNAw6IN0ny2C7OoZGtPENNCr26FnehJx+x9k484:glhRuiVhG/o80ny2CnZGaHCjFnehJx+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe
- Size 1.7MB
- SHA256 4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
- MD5 c44487ce1827ce26ac4699432d15b42a
- SHA1 8434080fad778057a50607364fee8b481f0feef8
- SHA512 a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
- SSDEEP 49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini
- Size 548B
- SHA256 2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
- MD5 742c2400f2de964d0cce4a8dabadd708
- SHA1 c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
- SHA512 63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini
- Size 550B
- SHA256 89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
- MD5 51014c0c06acdd80f9ae4469e7d30a9e
- SHA1 204e6a57c44242fad874377851b13099dfe60176
- SHA512 79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
- Size 84KB
- SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
- MD5 3b03324537327811bbbaff4aafa4d75b
- SHA1 1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
- SHA512 ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
- SSDEEP 768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll
- Size 1.6MB
- SHA256 915a72236ead8270af5fdf315b1128bdd98eecae53dd82653748e456d8dc3c2b
- MD5 b5ccae67ddfb858b2f764cd6d4065e99
- SHA1 208bbca7a59bb1926e93c4986700a47c06fdd7b2
- SHA512 8b4666a823f918396c2b36df22279ec20e949c3fc184058b5dd9425b49a9d3dcb1e1e901e995a13334df820931b981d00c102dbad276f3fb870312fb0aac5427
- SSDEEP 24576:K0Z/e25BalRxhx82Lot/YMx6815fe0UdgsWGW0zukGgCgPSrjNPslAFynGhMw:XFeWuR/RLuAYjsWGdukGg5PijNYAFjhN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\xdel.exe
- Size 350KB
- SHA256 e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
- MD5 803df907d936e08fbbd06020c411be93
- SHA1 4aa4b498ae037a2b0479659374a5c3af5f6b8d97
- SHA512 5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
- SSDEEP 6144:OBgL/kqXQangs2iKn5yvfj7wZxPzzLHrNJT7V:QgL5ga0iKn5GfPwZRT5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3gek2orz.d4v.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512