hakbit | 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Resubmissions

14-12-2024 07:51

241214-jqcj1sxnhr 10

11-12-2024 15:39

07-12-2024 20:12

04-12-2024 19:31

04-12-2024 11:47

04-12-2024 11:40

04-12-2024 11:35

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit credential_access discovery evasion execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: HIgLUG11SPpWeMFVGnszVRpvn3HVJ3d1txLyhDgW4d2HEPSiQ30s0CBbB5NmEG4VTVRfdgWcElzgF6U66oNp1YJBoIG7L2CAFpFSB9o5ehmKCb1gmEmTu+h7vbvRb0oiUc8IZAWqZSxKynrcPNRX/NVUXJEGbc6akm5bGJyPp9NY0EpIOE3q1066A5TR0hciD8V7TdVyTpmeHawIE7BIrGr72cafWXgfmS1pkHDug4HbmCFE3IYaHyiDwgkEiNCOqbW+eXZ2cJpJ6kAqwQM0KLgiwI66w99IKgQudAz7Em3+qcrKD/qJz1Vrh//SswSX7Q/7pd/a5eTbgXXghQ/eQ9+9SktrLD5jZAHgK7+sgFKc5nBJWblbp0za3XhAyL8wfMWo5pBbPAkcmDTzKuaD2dvth0VOSYZUhoqW5MyDvZ3Im8pswMpEzi504m5g0rOk+bh9wuzX2iutVf5HXe729H7AP7rzOQ4QVOapOQAiL8ZW+bQs582Y6mYDQhh3ujGynf2i6uNQI2UwtfE0F+ZTTPECVZSrMp1orVbteoDP/CWLam4/PG6AWiKhkFM4YsbTcGYSV7w7UsTCUo55zrKBaQtKZU1iVzWgkLs/8ltOj4G5dPOEQfBSfWuTpm1N6PnqZ0CHc2cEEG3OPuyOEGy5WDv5aD5OENUYxnkUozx54Ao= Number of files that were processed is: 502

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Hakbit family
hakbit
Renames multiple (53) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
1720	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2544	sc.exe
1720	sc.exe
2324	sc.exe
2944	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3368	cmd.exe
2056	PING.EXE

Kills process with taskkill 47 IoCs

evasion

pid	Process
2900	taskkill.exe
2876	taskkill.exe
1016	taskkill.exe
440	taskkill.exe
1052	taskkill.exe
2480	taskkill.exe
2956	taskkill.exe
832	taskkill.exe
2440	taskkill.exe
2784	taskkill.exe
1484	taskkill.exe
2468	taskkill.exe
2872	taskkill.exe
1940	taskkill.exe
1040	taskkill.exe
2092	taskkill.exe
2736	taskkill.exe
2500	taskkill.exe
2276	taskkill.exe
488	taskkill.exe
2768	taskkill.exe
640	taskkill.exe
1260	taskkill.exe
2792	taskkill.exe
2728	taskkill.exe
2252	taskkill.exe
1436	taskkill.exe
2372	taskkill.exe
2220	taskkill.exe
2272	taskkill.exe
2812	taskkill.exe
2752	taskkill.exe
2920	taskkill.exe
2576	taskkill.exe
2692	taskkill.exe
2640	taskkill.exe
2808	taskkill.exe
2712	taskkill.exe
2460	taskkill.exe
904	taskkill.exe
2880	taskkill.exe
2764	taskkill.exe
2184	taskkill.exe
2660	taskkill.exe
2344	taskkill.exe
2644	taskkill.exe
604	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2936	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2056	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Token: SeDebugPrivilege	2752	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	2576	taskkill.exe
Token: SeDebugPrivilege	1260	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2468	taskkill.exe
Token: SeDebugPrivilege	2812	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	2880	taskkill.exe
Token: SeDebugPrivilege	2644	taskkill.exe
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	488	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	832	taskkill.exe
Token: SeDebugPrivilege	2184	taskkill.exe
Token: SeDebugPrivilege	2276	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	2640	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	2480	taskkill.exe
Token: SeDebugPrivilege	904	taskkill.exe
Token: SeDebugPrivilege	1040	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	440	taskkill.exe
Token: SeDebugPrivilege	2272	taskkill.exe
Token: SeDebugPrivilege	1016	taskkill.exe
Token: SeDebugPrivilege	2372	taskkill.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	2440	taskkill.exe
Token: SeDebugPrivilege	2500	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	2876	taskkill.exe
Token: SeDebugPrivilege	604	taskkill.exe
Token: SeDebugPrivilege	2872	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2544	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	31
PID 2404 wrote to memory of 2544	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	31
PID 2404 wrote to memory of 2544	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	31
PID 2404 wrote to memory of 1864	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 2404 wrote to memory of 1864	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 2404 wrote to memory of 1864	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	33
PID 2404 wrote to memory of 1720	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 2404 wrote to memory of 1720	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 2404 wrote to memory of 1720	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 2404 wrote to memory of 2944	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 2404 wrote to memory of 2944	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 2404 wrote to memory of 2944	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 2404 wrote to memory of 2324	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 2404 wrote to memory of 2324	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 2404 wrote to memory of 2324	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 2404 wrote to memory of 2712	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	38
PID 2404 wrote to memory of 2712	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	38
PID 2404 wrote to memory of 2712	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	38
PID 2404 wrote to memory of 604	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	39
PID 2404 wrote to memory of 604	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	39
PID 2404 wrote to memory of 604	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	39
PID 2404 wrote to memory of 2220	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	40
PID 2404 wrote to memory of 2220	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	40
PID 2404 wrote to memory of 2220	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	40
PID 2404 wrote to memory of 2728	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 2404 wrote to memory of 2728	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 2404 wrote to memory of 2728	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 2404 wrote to memory of 2764	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 2404 wrote to memory of 2764	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 2404 wrote to memory of 2764	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 2404 wrote to memory of 2768	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 2404 wrote to memory of 2768	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 2404 wrote to memory of 2768	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	44
PID 2404 wrote to memory of 2876	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 2404 wrote to memory of 2876	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 2404 wrote to memory of 2876	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 2404 wrote to memory of 2880	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	46
PID 2404 wrote to memory of 2880	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	46
PID 2404 wrote to memory of 2880	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	46
PID 2404 wrote to memory of 2900	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 2404 wrote to memory of 2900	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 2404 wrote to memory of 2900	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 2404 wrote to memory of 2920	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 2404 wrote to memory of 2920	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 2404 wrote to memory of 2920	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 2404 wrote to memory of 2872	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	49
PID 2404 wrote to memory of 2872	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	49
PID 2404 wrote to memory of 2872	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	49
PID 2404 wrote to memory of 2752	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	52
PID 2404 wrote to memory of 2752	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	52
PID 2404 wrote to memory of 2752	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	52
PID 2404 wrote to memory of 2468	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 2404 wrote to memory of 2468	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 2404 wrote to memory of 2468	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 2404 wrote to memory of 2736	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	55
PID 2404 wrote to memory of 2736	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	55
PID 2404 wrote to memory of 2736	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	55
PID 2404 wrote to memory of 2812	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 2404 wrote to memory of 2812	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 2404 wrote to memory of 2812	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	57
PID 2404 wrote to memory of 2092	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 2404 wrote to memory of 2092	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 2404 wrote to memory of 2092	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 2404 wrote to memory of 2808	2404	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	60

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:2544
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:1864
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:1720
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:2944
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2324
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:604
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2792
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:832
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:488
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1040
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:440
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2936
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3368
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2056
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  2⤵
  - Deletes itself
  PID:1720
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]

Filesize
4KB

MD5
ddf38035b84eb87a4452d94d29ce1d35

SHA1
7f095e9a0bdb57b485fbf7bf957910d7735bd6e4

SHA256
fdf4ca7ceb0f450dac40d895369fdb54d02efff9f726f6845fbcfcdde49bbf77

SHA512
6462aad2dc1d3ba8cdafa768a09a801d795aaaf465c95ca6445a588dfc5e2a6293c56dbc9d942a9391b439c5bee1fd04c3a4f19e4cc8fa94eb43f1e30c8117c7

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
52e811a2e7884a9778da7d6d9a09a39c

SHA1
c4e1e2fbe1797cae53fffd41e6934a48dbe78e1d

SHA256
4fd7930355e7235c564e46bc2e97867a38ab063e91972d1530758ef6a1a63bf2

SHA512
3fd7a3082406ca30623a06237ceee06a4c0f6f20fb534d9053c9da1d31922465fedb101977c8573fc0bfc4feaa60252e8637937d2f61cbb974c48261a79fb30d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2aaf4f239095b6797c2eff51563afb31

SHA1
f604d2168b582a367f0d9bf34ac1003e08daf87c

SHA256
ce37630511a139c550824f825e379d5a7fd81566be5ab28b62312e25ae162e24

SHA512
db688b257eca74677e5cdf8468883a96197cb359359cfc2c0a6aabc1bd64ecd76f25b6211df823d87ae6c01b203465bc570aa1f107f68a5467650a59de36c69c

Download Submit
C:\Users\Admin\Desktop\GrantLock.xlsx.energy[[email protected]]

Filesize
12KB

MD5
8f8ce1f5c80afafafdcdf178a7f481a5

SHA1
c7cdc08890b5a3492510350997a7ad1ed6bf31f7

SHA256
ac62e67f4f16fb1a5077006b408abc4f157fa485b0710341005a998add2d22cb

SHA512
c6a12826b3e4fe001928a6b3fb96c0032ec2b6736e8502f21e0f356c47593b611dd45337121a608ecc89e9a325e611318ce8724fa612c27c9b6784025ace2b42

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
d7c36fc1c42dabdd9ad34b54be14de41

SHA1
1d2498ff62226e2e5c77d0148d2f6e837063ad9c

SHA256
51d6264b1b8a40b925d3f9017b798734c155cc2382add5242301b71d24b5b157

SHA512
fec51bb9c6ccbdf8c4184a5a78ebc5a591129e20ddcc56198972d9696569a0a8f5661a28b2483fb3a08f3f2e4a635753b9cf449a9f90f0a182987089d6ef9cf5

Download Submit
memory/2240-10-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2240-11-0x0000000001E20000-0x0000000001E28000-memory.dmp

Filesize
32KB

Download
memory/2404-0-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download
memory/2404-275-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download
memory/2404-303-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2404-3-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2404-1-0x0000000000E60000-0x0000000000E7A000-memory.dmp

Filesize
104KB

Download
memory/2404-639-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download