hakbit | 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Resubmissions

13-11-2024 23:34

241113-3kmbta1eqc 10

13-11-2024 22:28

11-11-2024 05:34

11-11-2024 03:05

11-11-2024 03:00

08-11-2024 08:59

08-11-2024 08:55

Analysis

max time kernel
90s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit credential_access discovery evasion execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: Xu79xtR+w/NV6fx0Q8HxAGeKEQm5XNDt9qgVeeTD5OQKY97P/1MaZicr79bhDkQAxVgqfHC0km9pEU5DLyWpmEoJUZ2wsMx+9KJWB4QsEEhh03kh8EBYG8+PK4YEZBDvmE58t4xKKXV3W3i8WrrW7KnEGf78LhHEl1ErXQGBOYxnbHaoRTpfpeRsupicdKKKv/yU/OEAUIh4slE3bMi1qLxlAWiuKUb78xbMpMaHyWXdl38M0UyqT6UUifJvCfbNHN/Cqug8BvMhX2+GhluHtNGCuOyjivolPqrffjqsuQrRe8NAoQ0o44NlPckG+mSpjKhWLElVFYv+35OwGeOD391oxBEarx+5k3TK7e/goUtkpy3WYkcF9NzHbvZuW0IOQqU2qlRMSiPy2DlsG5VG8JM8+UH1fRW36bm9pwKzTK4QuJW/msjS/cb5CZc10CnSTXT0UhGTLbfbHA/oSC1XFdmJAiFJyIQkbhd1H+943N20k+DMf+9ybMpphtzhtgn3PeXDsvuurQFusW7Aqtae4Z1XojDdYNRTQtYpBYWmlKaJyfJvb7RcWqg1oKrFGGqzalvq1pihhI/uUQ31oQHvBecHiW3cBTL5uIzCSP0MGzZjW+or+X8NzUt9O+PVfNjXaV0wtkm6tIMSk3RmQ0XTrdvaNSA0Whkq1gZ8I5rlv3A= Number of files that were processed is: 433

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Hakbit family
hakbit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3504	sc.exe
4524	sc.exe
64	sc.exe
3920	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5896	PING.EXE
5588	cmd.exe

Kills process with taskkill 47 IoCs

evasion

pid	Process
2536	taskkill.exe
2032	taskkill.exe
776	taskkill.exe
4624	taskkill.exe
1736	taskkill.exe
3956	taskkill.exe
4772	taskkill.exe
2804	taskkill.exe
3396	taskkill.exe
396	taskkill.exe
2624	taskkill.exe
1988	taskkill.exe
3964	taskkill.exe
1096	taskkill.exe
4960	taskkill.exe
3760	taskkill.exe
4304	taskkill.exe
1200	taskkill.exe
436	taskkill.exe
3948	taskkill.exe
3768	taskkill.exe
4572	taskkill.exe
5032	taskkill.exe
1184	taskkill.exe
1864	taskkill.exe
2540	taskkill.exe
1784	taskkill.exe
1140	taskkill.exe
2712	taskkill.exe
4204	taskkill.exe
1052	taskkill.exe
1576	taskkill.exe
2368	taskkill.exe
1660	taskkill.exe
2572	taskkill.exe
3080	taskkill.exe
4940	taskkill.exe
1972	taskkill.exe
2744	taskkill.exe
624	taskkill.exe
3644	taskkill.exe
224	taskkill.exe
1352	taskkill.exe
872	taskkill.exe
3564	taskkill.exe
2056	taskkill.exe
1516	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6744	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5896	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	1352	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeDebugPrivilege	776	taskkill.exe
Token: SeDebugPrivilege	4624	taskkill.exe
Token: SeDebugPrivilege	436	taskkill.exe
Token: SeDebugPrivilege	3644	taskkill.exe
Token: SeDebugPrivilege	224	taskkill.exe
Token: SeDebugPrivilege	872	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	1736	taskkill.exe
Token: SeDebugPrivilege	3956	taskkill.exe
Token: SeDebugPrivilege	3964	taskkill.exe
Token: SeDebugPrivilege	3948	taskkill.exe
Token: SeDebugPrivilege	1184	taskkill.exe
Token: SeDebugPrivilege	2368	taskkill.exe
Token: SeDebugPrivilege	3768	taskkill.exe
Token: SeDebugPrivilege	3760	taskkill.exe
Token: SeDebugPrivilege	1516	taskkill.exe
Token: SeDebugPrivilege	3396	taskkill.exe
Token: SeDebugPrivilege	2744	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	4940	taskkill.exe
Token: SeDebugPrivilege	396	taskkill.exe
Token: SeDebugPrivilege	624	taskkill.exe
Token: SeDebugPrivilege	1988	taskkill.exe
Token: SeDebugPrivilege	3564	taskkill.exe
Token: SeDebugPrivilege	4960	taskkill.exe
Token: SeDebugPrivilege	4304	taskkill.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeDebugPrivilege	2032	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	1784	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	1096	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	1660	taskkill.exe
Token: SeDebugPrivilege	2056	taskkill.exe
Token: SeDebugPrivilege	4572	taskkill.exe
Token: SeDebugPrivilege	4772	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	4328	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 64	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	84
PID 3548 wrote to memory of 64	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	84
PID 3548 wrote to memory of 3504	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	85
PID 3548 wrote to memory of 3504	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	85
PID 3548 wrote to memory of 3920	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	86
PID 3548 wrote to memory of 3920	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	86
PID 3548 wrote to memory of 664	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	88
PID 3548 wrote to memory of 664	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	88
PID 3548 wrote to memory of 4524	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	92
PID 3548 wrote to memory of 4524	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	92
PID 3548 wrote to memory of 1576	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	93
PID 3548 wrote to memory of 1576	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	93
PID 3548 wrote to memory of 1736	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	94
PID 3548 wrote to memory of 1736	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	94
PID 3548 wrote to memory of 872	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	95
PID 3548 wrote to memory of 872	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	95
PID 3548 wrote to memory of 4624	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	96
PID 3548 wrote to memory of 4624	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	96
PID 3548 wrote to memory of 1052	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	97
PID 3548 wrote to memory of 1052	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	97
PID 3548 wrote to memory of 776	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	98
PID 3548 wrote to memory of 776	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	98
PID 3548 wrote to memory of 1352	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	99
PID 3548 wrote to memory of 1352	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	99
PID 3548 wrote to memory of 4204	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	100
PID 3548 wrote to memory of 4204	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	100
PID 3548 wrote to memory of 224	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	101
PID 3548 wrote to memory of 224	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	101
PID 3548 wrote to memory of 436	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	102
PID 3548 wrote to memory of 436	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	102
PID 3548 wrote to memory of 2572	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	103
PID 3548 wrote to memory of 2572	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	103
PID 3548 wrote to memory of 1200	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	104
PID 3548 wrote to memory of 1200	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	104
PID 3548 wrote to memory of 2712	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	105
PID 3548 wrote to memory of 2712	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	105
PID 3548 wrote to memory of 1140	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	106
PID 3548 wrote to memory of 1140	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	106
PID 3548 wrote to memory of 3644	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	107
PID 3548 wrote to memory of 3644	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	107
PID 3548 wrote to memory of 3964	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	121
PID 3548 wrote to memory of 3964	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	121
PID 3548 wrote to memory of 1184	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	126
PID 3548 wrote to memory of 1184	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	126
PID 3548 wrote to memory of 3948	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	127
PID 3548 wrote to memory of 3948	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	127
PID 3548 wrote to memory of 2368	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	128
PID 3548 wrote to memory of 2368	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	128
PID 3548 wrote to memory of 3768	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	129
PID 3548 wrote to memory of 3768	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	129
PID 3548 wrote to memory of 3080	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	130
PID 3548 wrote to memory of 3080	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	130
PID 3548 wrote to memory of 3956	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	131
PID 3548 wrote to memory of 3956	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	131
PID 3548 wrote to memory of 1864	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	138
PID 3548 wrote to memory of 1864	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	138
PID 3548 wrote to memory of 1660	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	139
PID 3548 wrote to memory of 1660	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	139
PID 3548 wrote to memory of 3396	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	140
PID 3548 wrote to memory of 3396	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	140
PID 3548 wrote to memory of 2032	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	141
PID 3548 wrote to memory of 2032	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	141
PID 3548 wrote to memory of 4304	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	142
PID 3548 wrote to memory of 4304	3548	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	142

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:64
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:3504
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:3920
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:664
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4524
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4624
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1352
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3644
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3768
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:3080
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3396
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1784
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3760
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3564
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4328
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6744
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5588
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5896
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:3224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  2⤵
  PID:6760
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:5604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

Filesize
1.3MB

MD5
b0e4ca49f3a5f0507055d144ae9752b9

SHA1
92e0a37e49e53f5ec0a269fb377b5d323702cdb4

SHA256
540f148d904221286f5517c0c3c224064336a10a688227671d359c8344385679

SHA512
5c64a0939d83fc94a4fb401a967df919ee1d8eac385d065f7f0a5f7ffef9e834b458e1c9414ed78dbba59bad2619d78e98565697d7a83440a112ce38750cbd6f

Download Submit
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi

Filesize
28.8MB

MD5
1bc082a9c13ce7b01223044f1cb7a247

SHA1
5b3269250ffcf892307b594bd2e6831196731783

SHA256
8507e662aedde36cf009ccef98cf47ecd82c56f2249e4a313bcf489aec555d94

SHA512
2e8cdd4f578c3c6bfe812768d32b351e85f927662e1acb811b33fb14ed365686b08884ae145a1e3c2db5f20dc3ae027a858dfb83f51b6e37450e68ea2d305f66

Download Submit
C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.energy[[email protected]]

Filesize
728KB

MD5
3796dc6523106f8f7f16792d05a1cb9f

SHA1
d0e77b1dde00aa146e63886c62bcd0e2d926860a

SHA256
3190e08379a5164ed219f63e9005f4a6b267c384682bed8a2867487d02069a6c

SHA512
726f48870c2e9816f3e536c905e02bc7f42969a453dc3eb6aadd9051bee3f807d20bf89d25b6defbdee33a8867ceee354e5a7d1a818e4d8aebee4e8e3e2f02fb

Download Submit
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi

Filesize
25.7MB

MD5
9b9c1f18952c31df58c8ea14d6f22f77

SHA1
1318307aea1cf7d25ac16e1c13020623d54d0209

SHA256
600724c7897b0f30450c29a2a4b8a3f69296b2a8aa23269cf6f2d84a4122145f

SHA512
c2202f65bee1c6b9513a4f93ac3139be9d3b9bae55ec755c1d86d2d814c0d511ee889db90fe599c1aafd6dcfd5f93b8b5aa056bc2760bee778aa3eb42a8437e1

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
e2775828f7ddc6dc02d07ef15161fa96

SHA1
7c2617686d4c4ad03a15dd72fc9953cdeb59afdc

SHA256
8eba82c766f782be21ad71d1a64a249d7d4373defe1bc9758d69a38f10e90100

SHA512
0735fdd6984937f2a766b77e53f5b159738df385da5c9988482981b5d8829087233aa5de76e096fbea4cf077e0c1089cf839c5ae9e19d0499748941d12d8cc59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sjeeolsh.obg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
40da25ed394516a5165c9167454b47cb

SHA1
cad8224c2d7eea86634093fc40688ab60ed3aac1

SHA256
6530052820b8d26bec5b0d4d9c93545a8eb1055c1aa639eadb860bde1f05b501

SHA512
44d6729670cb3f394b992d8dee2da2db5b06445524addd726cd2a45e1f5a24f8a8c71e52fe3af405c29234c8012fb38bb0ee08e6655e9d1286456aa14c277520

Download Submit
memory/3548-193-0x00007FFEE6A80000-0x00007FFEE7541000-memory.dmp

Filesize
10.8MB

Download
memory/3548-173-0x00007FFEE6A83000-0x00007FFEE6A85000-memory.dmp

Filesize
8KB

Download
memory/3548-0-0x00007FFEE6A83000-0x00007FFEE6A85000-memory.dmp

Filesize
8KB

Download
memory/3548-3-0x00007FFEE6A80000-0x00007FFEE7541000-memory.dmp

Filesize
10.8MB

Download
memory/3548-1-0x0000000000CE0000-0x0000000000CFA000-memory.dmp

Filesize
104KB

Download
memory/3548-550-0x00007FFEE6A80000-0x00007FFEE7541000-memory.dmp

Filesize
10.8MB

Download
memory/4328-25-0x000001DCA1310000-0x000001DCA1332000-memory.dmp

Filesize
136KB

Download