hakbit | 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Resubmissions

13-11-2024 23:34

241113-3kmbta1eqc 10

13-11-2024 22:28

11-11-2024 05:34

11-11-2024 03:05

11-11-2024 03:00

08-11-2024 08:59

08-11-2024 08:55

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-11-2024 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit credential_access discovery evasion execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: LPDB1Q0X79SsmkD0Y4iX2GLAtoGv0g0wRGU8MKSxotXAJziq1n/TDKSzP1j3FYO2uYPcqVexJXxufsphlyysCwBE2/K5ON7Dhu//+GrsycTs3XsclGANKrspe+sIcl5al4fdE3O4gaWcNn+ts5Z2dMX26K+OBWe1wH7Y7WOPxcv+7O0HoSp0nz7GiU/p+K73iWdOMVxTMfc89Shfmgl+4q8f4jwl63JmoIqVcIk/dxdHubQ+e9KE8vfO20lRp4agqT3FeY67Zre+5h4WccY1/rQOquW3QesrWp1BYxCH/A8XGT5HAF5GZJuGU7+2X7JMBMY4LwV72L+o6Il1ghZbuoO0DYTwuN3IOwL8f2F8bNQF59oqfDEu2iYZZjiHDi6+JIK96/pChuiBR6I14y19IzeQqz8akETlqv3hbwHyjvHx1v4F/PhfwrCTmERpmjiM/1l+vwIDQ75By1lBtlpz43HwnqoFjje2NzGnIiPXKKZRrVGBCTE8uvplCSzMKsV5Aa0oaUIFlRiOVGt9mfVblbOu2DZ7rLPirLzCVtXOnExdRUVj7WstDBz9RD7P4W4bwbljKj/fuQToK6+Hs0YvphUU06boVKcRH8Dm+hF+aaSMXAOVonZaQ2BhAjhm6djdNnObNMufwBcsFf5nhmVkZl+tvzZWbFPdyySyh2j61k8= Number of files that were processed is: 492

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Hakbit family
hakbit
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
2916	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2480	sc.exe
2352	sc.exe
2264	sc.exe
484	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3104	cmd.exe
3880	PING.EXE

Kills process with taskkill 47 IoCs

evasion

pid	Process
2560	taskkill.exe
2564	taskkill.exe
2676	taskkill.exe
2828	taskkill.exe
2260	taskkill.exe
2788	taskkill.exe
2588	taskkill.exe
620	taskkill.exe
1416	taskkill.exe
1604	taskkill.exe
1384	taskkill.exe
2044	taskkill.exe
1236	taskkill.exe
2784	taskkill.exe
844	taskkill.exe
2756	taskkill.exe
1708	taskkill.exe
1872	taskkill.exe
3024	taskkill.exe
1128	taskkill.exe
2840	taskkill.exe
2580	taskkill.exe
1924	taskkill.exe
2268	taskkill.exe
2664	taskkill.exe
592	taskkill.exe
1308	taskkill.exe
2000	taskkill.exe
976	taskkill.exe
1936	taskkill.exe
1464	taskkill.exe
3040	taskkill.exe
2592	taskkill.exe
2172	taskkill.exe
1596	taskkill.exe
2836	taskkill.exe
2604	taskkill.exe
2768	taskkill.exe
2820	taskkill.exe
2652	taskkill.exe
2220	taskkill.exe
2816	taskkill.exe
2720	taskkill.exe
2600	taskkill.exe
2576	taskkill.exe
1512	taskkill.exe
2108	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
332	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3880	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	1384	taskkill.exe
Token: SeDebugPrivilege	844	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	1464	taskkill.exe
Token: SeDebugPrivilege	592	taskkill.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	2588	taskkill.exe
Token: SeDebugPrivilege	2664	taskkill.exe
Token: SeDebugPrivilege	2840	taskkill.exe
Token: SeDebugPrivilege	620	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	2576	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	2820	taskkill.exe
Token: SeDebugPrivilege	2836	taskkill.exe
Token: SeDebugPrivilege	2172	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	1872	taskkill.exe
Token: SeDebugPrivilege	2756	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeDebugPrivilege	2652	taskkill.exe
Token: SeDebugPrivilege	1128	taskkill.exe
Token: SeDebugPrivilege	1416	taskkill.exe
Token: SeDebugPrivilege	1924	taskkill.exe
Token: SeDebugPrivilege	2676	taskkill.exe
Token: SeDebugPrivilege	2604	taskkill.exe
Token: SeDebugPrivilege	2816	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeDebugPrivilege	3040	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	1596	taskkill.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	976	taskkill.exe
Token: SeDebugPrivilege	2000	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	1604	taskkill.exe
Token: SeDebugPrivilege	1308	taskkill.exe
Token: SeDebugPrivilege	1316	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2480	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	31
PID 2348 wrote to memory of 2480	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	31
PID 2348 wrote to memory of 2480	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	31
PID 2348 wrote to memory of 2072	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 2348 wrote to memory of 2072	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 2348 wrote to memory of 2072	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 2348 wrote to memory of 2352	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 2348 wrote to memory of 2352	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 2348 wrote to memory of 2352	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 2348 wrote to memory of 484	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 2348 wrote to memory of 484	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 2348 wrote to memory of 484	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 2348 wrote to memory of 2264	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	38
PID 2348 wrote to memory of 2264	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	38
PID 2348 wrote to memory of 2264	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	38
PID 2348 wrote to memory of 2652	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	40
PID 2348 wrote to memory of 2652	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	40
PID 2348 wrote to memory of 2652	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	40
PID 2348 wrote to memory of 2268	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 2348 wrote to memory of 2268	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 2348 wrote to memory of 2268	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 2348 wrote to memory of 2260	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 2348 wrote to memory of 2260	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 2348 wrote to memory of 2260	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 2348 wrote to memory of 2784	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 2348 wrote to memory of 2784	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 2348 wrote to memory of 2784	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 2348 wrote to memory of 2788	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 2348 wrote to memory of 2788	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 2348 wrote to memory of 2788	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 2348 wrote to memory of 2820	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 2348 wrote to memory of 2820	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 2348 wrote to memory of 2820	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 2348 wrote to memory of 2816	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 2348 wrote to memory of 2816	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 2348 wrote to memory of 2816	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 2348 wrote to memory of 2720	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	50
PID 2348 wrote to memory of 2720	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	50
PID 2348 wrote to memory of 2720	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	50
PID 2348 wrote to memory of 2664	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	51
PID 2348 wrote to memory of 2664	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	51
PID 2348 wrote to memory of 2664	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	51
PID 2348 wrote to memory of 2560	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 2348 wrote to memory of 2560	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 2348 wrote to memory of 2560	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 2348 wrote to memory of 2840	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	55
PID 2348 wrote to memory of 2840	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	55
PID 2348 wrote to memory of 2840	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	55
PID 2348 wrote to memory of 2588	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 2348 wrote to memory of 2588	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 2348 wrote to memory of 2588	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 2348 wrote to memory of 2580	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 2348 wrote to memory of 2580	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 2348 wrote to memory of 2580	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 2348 wrote to memory of 2576	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	61
PID 2348 wrote to memory of 2576	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	61
PID 2348 wrote to memory of 2576	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	61
PID 2348 wrote to memory of 2592	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	62
PID 2348 wrote to memory of 2592	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	62
PID 2348 wrote to memory of 2592	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	62
PID 2348 wrote to memory of 620	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	63
PID 2348 wrote to memory of 620	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	63
PID 2348 wrote to memory of 620	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	63
PID 2348 wrote to memory of 2828	2348	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	64

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:2480
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:2072
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2352
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:484
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2264
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:620
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2564
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:592
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1236
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:844
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:976
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1872
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1316
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:332
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3104
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3880
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:2224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  2⤵
  - Deletes itself
  PID:2916
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]

Filesize
4KB

MD5
d3c03fb4d72eb05dd7c044a3d09cf17b

SHA1
7bd1b535c1bd433173227377fd2ebf8619fadc41

SHA256
1f97130a3bdb2bf29be5f09f6eacc0b3dc868252ac421b3acf47cb369d5ada6c

SHA512
eac32f8d7362ea7ff01cfdb87d77aa1fb65728544de01098fddd5d17dd5d2f2673b9ddc87840b271ec0ae98b1ed10de9b5c10d0507b9a85635d34c6f5ab6e4a0

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
7ad71d43727c06c8f0465b8d2d088b7b

SHA1
6fcc3fdaa853eb52f2230ec2d0c1fb608889f903

SHA256
6ea70debc16df747458437d443f962c63cbde611acecdf8c883b087148994bd0

SHA512
68d2b663ab2e45e0919e317b3f4abcbf71efdb2e8b2764b38d81ca709e3f4dd1800a5f170c7fe1180b0bc2bbbf9274a562bf3c8ff5083c3234ba4d79d597da9e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ee677fa591c76fcbadb40bbae5c24f59

SHA1
a2b40986b59b28dc14a641f4d9173b0bf1a967d2

SHA256
b74fa6628a3f2babbbbdd2a1b7e503cc9986421a25594b66e49b5631fa21f8a7

SHA512
49defe32a975d84ab6ac5f21009cafbbf7f4c8e0d1003912e207637ac628adfcf778f8539a2c1adb8547e208e70c61791302ca808deae90830b3a015ce4c143c

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
3d95aa64521728a0ea5a2de914190650

SHA1
25bafad098676762557bfcad977fa8700416f042

SHA256
6cf094ac0056bf4efc588eb07cf8aba348d42995902a0df0fa8a8966125d939a

SHA512
a784abab4720636bc254e1ab471b0523b90c852055d5c8136cfa72a65f312e997e70181892c656d7e38333bd6b781215322609e2ae48245430dc5b4990408b51

Download Submit
C:\Users\Admin\Documents\UnlockMount.xlsx.energy[[email protected]]

Filesize
11KB

MD5
745e8566eb796de52c4cac073e734952

SHA1
5208084bddfd39ca207196ba8d3d3044643e3b3c

SHA256
d6c8bd5ee34e3b2249dc03fbe3119e36d4713f23c29c409208e801f89f9a1b84

SHA512
6b45dbba821f8f8941496519648b6d28758038002777e4720ab91f7a40548ce8a8608fbfb7c53b06ad2525e78ecdf074b01e32f2ccf59ad3a5b2085d8062455e

Download Submit
memory/1316-8-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/1316-9-0x0000000001CF0000-0x0000000001CF8000-memory.dmp

Filesize
32KB

Download
memory/2348-128-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

Filesize
4KB

Download
memory/2348-140-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download
memory/2348-0-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

Filesize
4KB

Download
memory/2348-2-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download
memory/2348-1-0x00000000012C0000-0x00000000012DA000-memory.dmp

Filesize
104KB

Download
memory/2348-615-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download