Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows7-x64
100di3x.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
33DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
395560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows7-x64
8Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows7-x64
3DiskIntern...en.exe
windows10-2004-x64
3ForceOp 2....ce.exe
windows7-x64
7ForceOp 2....ce.exe
windows10-2004-x64
7Resubmissions
14-12-2024 07:51
241214-jqcj1sxnhr 1011-12-2024 15:39
241211-s3498stkar 1007-12-2024 20:12
241207-yy4qsswqej 1004-12-2024 19:31
241204-x8wmhaxmcv 1004-12-2024 11:47
241204-nybd5szkdq 1004-12-2024 11:40
241204-nsybqazjek 1004-12-2024 11:35
241204-np1bxatqgz 10Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14-12-2024 07:51
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
0di3x.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
0di3x.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
31.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
31.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20241007-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Renames multiple (56) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Deletes itself 1 IoCs
pid Process 2484 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2332 sc.exe 2312 sc.exe 1428 sc.exe 2492 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2376 PING.EXE 2352 cmd.exe -
Kills process with taskkill 47 IoCs
pid Process 2932 taskkill.exe 396 taskkill.exe 624 taskkill.exe 2716 taskkill.exe 2816 taskkill.exe 2324 taskkill.exe 2044 taskkill.exe 2172 taskkill.exe 1560 taskkill.exe 632 taskkill.exe 764 taskkill.exe 2728 taskkill.exe 2740 taskkill.exe 3024 taskkill.exe 2896 taskkill.exe 1152 taskkill.exe 2892 taskkill.exe 1628 taskkill.exe 2264 taskkill.exe 2732 taskkill.exe 2304 taskkill.exe 760 taskkill.exe 2616 taskkill.exe 2868 taskkill.exe 2928 taskkill.exe 592 taskkill.exe 2356 taskkill.exe 1804 taskkill.exe 1956 taskkill.exe 2656 taskkill.exe 468 taskkill.exe 2004 taskkill.exe 2588 taskkill.exe 2944 taskkill.exe 2376 taskkill.exe 2900 taskkill.exe 1308 taskkill.exe 1384 taskkill.exe 2484 taskkill.exe 1676 taskkill.exe 2020 taskkill.exe 1796 taskkill.exe 1968 taskkill.exe 484 taskkill.exe 1660 taskkill.exe 1340 taskkill.exe 2296 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2284 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2376 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 2356 taskkill.exe Token: SeDebugPrivilege 2044 taskkill.exe Token: SeDebugPrivilege 2588 taskkill.exe Token: SeDebugPrivilege 2816 taskkill.exe Token: SeDebugPrivilege 1676 taskkill.exe Token: SeDebugPrivilege 2264 taskkill.exe Token: SeDebugPrivilege 2172 taskkill.exe Token: SeDebugPrivilege 3024 taskkill.exe Token: SeDebugPrivilege 468 taskkill.exe Token: SeDebugPrivilege 2020 taskkill.exe Token: SeDebugPrivilege 2656 taskkill.exe Token: SeDebugPrivilege 2324 taskkill.exe Token: SeDebugPrivilege 2868 taskkill.exe Token: SeDebugPrivilege 2732 taskkill.exe Token: SeDebugPrivilege 2004 taskkill.exe Token: SeDebugPrivilege 624 taskkill.exe Token: SeDebugPrivilege 2740 taskkill.exe Token: SeDebugPrivilege 2716 taskkill.exe Token: SeDebugPrivilege 1628 taskkill.exe Token: SeDebugPrivilege 2892 taskkill.exe Token: SeDebugPrivilege 760 taskkill.exe Token: SeDebugPrivilege 2296 taskkill.exe Token: SeDebugPrivilege 2896 taskkill.exe Token: SeDebugPrivilege 2944 taskkill.exe Token: SeDebugPrivilege 1560 taskkill.exe Token: SeDebugPrivilege 2932 taskkill.exe Token: SeDebugPrivilege 1660 taskkill.exe Token: SeDebugPrivilege 1152 taskkill.exe Token: SeDebugPrivilege 1956 taskkill.exe Token: SeDebugPrivilege 1804 taskkill.exe Token: SeDebugPrivilege 632 taskkill.exe Token: SeDebugPrivilege 592 taskkill.exe Token: SeDebugPrivilege 764 taskkill.exe Token: SeDebugPrivilege 2616 taskkill.exe Token: SeDebugPrivilege 1264 powershell.exe Token: SeDebugPrivilege 2900 taskkill.exe Token: SeDebugPrivilege 2484 taskkill.exe Token: SeDebugPrivilege 1340 taskkill.exe Token: SeDebugPrivilege 2728 taskkill.exe Token: SeDebugPrivilege 1308 taskkill.exe Token: SeDebugPrivilege 2376 taskkill.exe Token: SeDebugPrivilege 1968 taskkill.exe Token: SeDebugPrivilege 2928 taskkill.exe Token: SeDebugPrivilege 396 taskkill.exe Token: SeDebugPrivilege 2304 taskkill.exe Token: SeDebugPrivilege 484 taskkill.exe Token: SeDebugPrivilege 1384 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2464 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 30 PID 3044 wrote to memory of 2464 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 30 PID 3044 wrote to memory of 2464 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 30 PID 3044 wrote to memory of 2492 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 31 PID 3044 wrote to memory of 2492 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 31 PID 3044 wrote to memory of 2492 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 31 PID 3044 wrote to memory of 2332 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 33 PID 3044 wrote to memory of 2332 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 33 PID 3044 wrote to memory of 2332 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 33 PID 3044 wrote to memory of 1428 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 34 PID 3044 wrote to memory of 1428 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 34 PID 3044 wrote to memory of 1428 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 34 PID 3044 wrote to memory of 2312 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 35 PID 3044 wrote to memory of 2312 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 35 PID 3044 wrote to memory of 2312 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 35 PID 3044 wrote to memory of 2356 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 37 PID 3044 wrote to memory of 2356 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 37 PID 3044 wrote to memory of 2356 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 37 PID 3044 wrote to memory of 2264 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 39 PID 3044 wrote to memory of 2264 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 39 PID 3044 wrote to memory of 2264 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 39 PID 3044 wrote to memory of 2044 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 40 PID 3044 wrote to memory of 2044 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 40 PID 3044 wrote to memory of 2044 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 40 PID 3044 wrote to memory of 468 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 42 PID 3044 wrote to memory of 468 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 42 PID 3044 wrote to memory of 468 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 42 PID 3044 wrote to memory of 1676 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 44 PID 3044 wrote to memory of 1676 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 44 PID 3044 wrote to memory of 1676 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 44 PID 3044 wrote to memory of 2020 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 45 PID 3044 wrote to memory of 2020 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 45 PID 3044 wrote to memory of 2020 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 45 PID 3044 wrote to memory of 2324 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 47 PID 3044 wrote to memory of 2324 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 47 PID 3044 wrote to memory of 2324 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 47 PID 3044 wrote to memory of 2816 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 49 PID 3044 wrote to memory of 2816 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 49 PID 3044 wrote to memory of 2816 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 49 PID 3044 wrote to memory of 2172 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 52 PID 3044 wrote to memory of 2172 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 52 PID 3044 wrote to memory of 2172 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 52 PID 3044 wrote to memory of 2732 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 53 PID 3044 wrote to memory of 2732 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 53 PID 3044 wrote to memory of 2732 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 53 PID 3044 wrote to memory of 2588 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 54 PID 3044 wrote to memory of 2588 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 54 PID 3044 wrote to memory of 2588 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 54 PID 3044 wrote to memory of 2868 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 57 PID 3044 wrote to memory of 2868 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 57 PID 3044 wrote to memory of 2868 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 57 PID 3044 wrote to memory of 3024 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 58 PID 3044 wrote to memory of 3024 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 58 PID 3044 wrote to memory of 3024 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 58 PID 3044 wrote to memory of 2716 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 66 PID 3044 wrote to memory of 2716 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 66 PID 3044 wrote to memory of 2716 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 66 PID 3044 wrote to memory of 2656 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 67 PID 3044 wrote to memory of 2656 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 67 PID 3044 wrote to memory of 2656 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 67 PID 3044 wrote to memory of 624 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 68 PID 3044 wrote to memory of 624 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 68 PID 3044 wrote to memory of 624 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 68 PID 3044 wrote to memory of 2740 3044 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:2464
-
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:2492
-
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:2332
-
-
C:\Windows\system32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:1428
-
-
C:\Windows\system32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:2312
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:468
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:624
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:1796
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:592
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1340
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:484
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:632
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:2284
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2352 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2376
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:1000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵
- Deletes itself
PID:2484 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1028
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]
Filesize4KB
MD55f55ca74f5cacf82a18077317b84a3c3
SHA1ef89724461f73a76ffee559040173c5db4e58c2b
SHA2569b8c4abf9233bcaab47b7fdd72e7da9d3253e822fa692195657e6efbac69688e
SHA51266e48f770321ce59e5e8184a40372de90154f1fb5d1e318b6f6900f82e6220da385da8c94b7cd03cc93e7c9070001d4e20a5f33be7111e63f1ad3a04bc2036f9
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD58b1316a5f8a4ab24f01b89bf5ea91ed0
SHA193f5a410e79c9c594e0ecd89a31bfa6a21cf6783
SHA2562241553a897ecd3efa2c0337bb93154fe81b9e4a0e7db1b3e68ba434b030d708
SHA512b6f84986ce4fcdcc19ee23a54d7d82e8cc4ee63bb1aa1fa590eff0d3b92d4b935318f7f84447b40f3a8400be2238e24e2dce3da9013c3e716485b2ad7a4dbce3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5394d845516e83596be445ea2f627c8ad
SHA18c4e67cc2c3992e5cab0caec9e652227e2384314
SHA2566474d9b9ce18fcb8e0d19ada0f89e7f1e8493271b4aa21c97eff87afb6dba64c
SHA51257bb362919ee4d50b64250ff754e5527ddf84aab86a37ab551a290f9ce8e5a6e37455379b6218b10448ad1f091c0d1ff758db831fae44fd917a6910db2d230f7
-
Filesize
828B
MD5818ec6fa9439cedc21b7d63d42a75162
SHA15ea94232f0ce016771f94af5a00de7b1124afbe7
SHA2564ceb2006cccdde7063fde95c4b81ec1e0db4ef423aa44ac26703fcbf645d6dd9
SHA512cfc379f5b0bbe8caa5603b45db6d2f4b4a1db0340decd108fccdd0c59b7de23d14faa11e9c55fee47e61df51857095abd7f5958a6b88eb966995bd680f5593fe
-
C:\Users\Admin\Desktop\UnpublishRevoke.xlsx.energy[[email protected]]
Filesize16KB
MD5a227bc679dfea78e3c24e564dc1376eb
SHA1d2f3b311ca2ca64153dfc4880715b921d80bba59
SHA256aeb38d6e329e29fb29c8291bcad105b4570c16ac65ca5b87100512c21b59df76
SHA51270efeefc42ceee386e97384c1beb0302f83517f67a6682806b638cfb0981ffcb6fd95982e6d86fc55d1da9f8184e165b4cfe7f7376b46eda44dda5db7e6dc4ed