hakbit | 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Resubmissions

01/04/2025, 21:24

250401-z8184awycs 10

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25/02/2025, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit credential_access defense_evasion discovery execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: VTyr9NrsdovT+FksGyZrNbe0BuK2GmbjJF4PXgIOQrHnr7MMVy8RKrvtcCxBOppvG06uz3cBPMvh7TBNzvYa4PeiLMYmqDQ77UQaqA1dge68qABA6Vv8AbVeVOOcqwpT68U262OKXA01oGWaqXp6cwQMMOMcmNzIXTzzcKJUo9ZWj99kDJ5J+Ta+xaESZ/qEygLiImygXoowl2Q70OQQoRdmlrO3KDTEcq992L4FQ/fIVjWJLXmRXzBLmsJENttL4YW6UvdUa5SJsw77SWHpp/Sx+BMzTB5+hMuwG3u9apo0A4JG/TGvGp/AY2DKD+2kdOdzoobbi8lFYzymmSdUbnOW5QeYh+q1jxpLEpLdhocf5ThHgr5hV0akvUtnwlQ7NFpnQ58OMhEaC6gfPXVmAc+Usv6z/1VpF9PAVOIFNDYqKQ4nQWnllvNL/ccFhXiiPcCwhV6uuuZrnfqpeRSHUmlxhCMDQEOSf4JKjcE8UtQ+3A37XaRtO2tkLC+eTKywTMySzStQJ+OTpRgW3Wem8cmdr0qQqi3n43GwnX1VKr4K2nL8B3EadivWSspelMmfjhix6iYBOLIgfofM4qrNzYW+U7HCbnJdAJw35ASlvV0z5ctLC2NXIIEe5VYx0s868bYUZKN6qTBT0OutSG4lh89V1bPPdp7DhSMZlnyzT7s= Number of files that were processed is: 472

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Hakbit family
hakbit
Renames multiple (56) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
2716	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2468	sc.exe
2340	sc.exe
2352	sc.exe
1908	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2684	cmd.exe
1576	PING.EXE

Kills process with taskkill 47 IoCs

defense_evasion

pid	Process
1224	taskkill.exe
2776	taskkill.exe
2320	taskkill.exe
1968	taskkill.exe
1220	taskkill.exe
2220	taskkill.exe
2852	taskkill.exe
2828	taskkill.exe
2720	taskkill.exe
2940	taskkill.exe
1956	taskkill.exe
2824	taskkill.exe
2884	taskkill.exe
2880	taskkill.exe
2832	taskkill.exe
1700	taskkill.exe
2264	taskkill.exe
2896	taskkill.exe
2472	taskkill.exe
2752	taskkill.exe
3012	taskkill.exe
2768	taskkill.exe
1128	taskkill.exe
2044	taskkill.exe
1540	taskkill.exe
1340	taskkill.exe
2904	taskkill.exe
2788	taskkill.exe
2892	taskkill.exe
2172	taskkill.exe
2816	taskkill.exe
592	taskkill.exe
2296	taskkill.exe
2808	taskkill.exe
1244	taskkill.exe
1600	taskkill.exe
1616	taskkill.exe
764	taskkill.exe
2692	taskkill.exe
624	taskkill.exe
2716	taskkill.exe
2784	taskkill.exe
2736	taskkill.exe
2696	taskkill.exe
1312	taskkill.exe
396	taskkill.exe
2532	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1864	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1576	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	2816	taskkill.exe
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	1128	taskkill.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	1700	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	2320	taskkill.exe
Token: SeDebugPrivilege	2716	taskkill.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	2904	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	2172	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	1220	taskkill.exe
Token: SeDebugPrivilege	2852	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	2884	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	624	taskkill.exe
Token: SeDebugPrivilege	2532	taskkill.exe
Token: SeDebugPrivilege	592	taskkill.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	2752	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	764	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	1340	taskkill.exe
Token: SeDebugPrivilege	2896	taskkill.exe
Token: SeDebugPrivilege	396	taskkill.exe
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	1312	taskkill.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	1600	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2468	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 3044 wrote to memory of 2468	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 3044 wrote to memory of 2468	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	30
PID 3044 wrote to memory of 2332	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 3044 wrote to memory of 2332	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 3044 wrote to memory of 2332	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	32
PID 3044 wrote to memory of 2340	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	34
PID 3044 wrote to memory of 2340	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	34
PID 3044 wrote to memory of 2340	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	34
PID 3044 wrote to memory of 2352	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 3044 wrote to memory of 2352	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 3044 wrote to memory of 2352	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	35
PID 3044 wrote to memory of 1908	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 3044 wrote to memory of 1908	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 3044 wrote to memory of 1908	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	36
PID 3044 wrote to memory of 2264	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 3044 wrote to memory of 2264	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 3044 wrote to memory of 2264	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	37
PID 3044 wrote to memory of 2044	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	39
PID 3044 wrote to memory of 2044	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	39
PID 3044 wrote to memory of 2044	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	39
PID 3044 wrote to memory of 2320	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 3044 wrote to memory of 2320	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 3044 wrote to memory of 2320	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	41
PID 3044 wrote to memory of 1244	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 3044 wrote to memory of 1244	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 3044 wrote to memory of 1244	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	42
PID 3044 wrote to memory of 1700	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 3044 wrote to memory of 1700	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 3044 wrote to memory of 1700	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	43
PID 3044 wrote to memory of 1128	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 3044 wrote to memory of 1128	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 3044 wrote to memory of 1128	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	45
PID 3044 wrote to memory of 2816	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 3044 wrote to memory of 2816	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 3044 wrote to memory of 2816	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	47
PID 3044 wrote to memory of 2720	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 3044 wrote to memory of 2720	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 3044 wrote to memory of 2720	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	48
PID 3044 wrote to memory of 2172	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	50
PID 3044 wrote to memory of 2172	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	50
PID 3044 wrote to memory of 2172	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	50
PID 3044 wrote to memory of 2736	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	51
PID 3044 wrote to memory of 2736	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	51
PID 3044 wrote to memory of 2736	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	51
PID 3044 wrote to memory of 2768	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	52
PID 3044 wrote to memory of 2768	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	52
PID 3044 wrote to memory of 2768	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	52
PID 3044 wrote to memory of 2776	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 3044 wrote to memory of 2776	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 3044 wrote to memory of 2776	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	53
PID 3044 wrote to memory of 2828	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 3044 wrote to memory of 2828	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 3044 wrote to memory of 2828	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	54
PID 3044 wrote to memory of 2852	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	56
PID 3044 wrote to memory of 2852	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	56
PID 3044 wrote to memory of 2852	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	56
PID 3044 wrote to memory of 3012	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	58
PID 3044 wrote to memory of 3012	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	58
PID 3044 wrote to memory of 3012	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	58
PID 3044 wrote to memory of 2832	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 3044 wrote to memory of 2832	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 3044 wrote to memory of 2832	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	59
PID 3044 wrote to memory of 2784	3044	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	60

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:2468
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:2332
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:2340
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:2352
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1908
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2880
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:592
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1340
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1864
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2684
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1576
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:3332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  2⤵
  - Deletes itself
  PID:2716
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.energy[[email protected]]

Filesize
4KB

MD5
be2ebf15c342a12657e16a5ddd19b8b8

SHA1
36fafeeb94e027d4bdf3230755a37c4474eee135

SHA256
21fee3b3bb578c2f0bb474976167f65663fae1b798852dc8578d6ed0e8c85b17

SHA512
9dd074fe26c7c798d93669198090a0cc84a2b897379e9c90a23c09ff72fb000b45dd34cd81447e134fd1d72483fcfbcecd7e08ffebe42f16a9349a2a17b6b3a6

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
4be5cc03b6a379f407f4058d8bb87ff8

SHA1
b343e0c544ed057754a930ef223420fe5a69a0b9

SHA256
e083eae6eb3f0bd3e29cafa11d3e23dd1231b0b1350ea63071657cc078a46e89

SHA512
e31e0dfbf2121a20668e2fb92ab419a81b989c68af60cb0d89cd642e6adffd1e541373ec3188e7154c84973e0ba29f683278fbe6425cf67b986fcae1fcfdcd2a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e1c9364879bce0cde76926cf6de67ffe

SHA1
2c2e7670c644809b324425ae5e5ea6667ffd531d

SHA256
f7a5426d57fdb5f3859a5ea4abc2551364805e93cc887ec125a7e967f3a3bfbf

SHA512
b59eadcb27bd68466d18a64b69c063c5e3b418a1271ffcefc86b4c96b264584fb7cd8b2fecd134f695b96cdeb2369be71d333594ae9b5e8763e62b9666b4cdc9

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
fb19d98d3fd5748185823978ffbb8377

SHA1
57955ea2c526873fd6028ba722aaafe773913dc1

SHA256
a3a56119ecea2d3e5b07f246ae16ce02daa1e6a2891cc1a588d0ce2585bf869a

SHA512
8c36639571825bf9164b8a70b644ba5c780a17aca842c002a5f966606c9fe7690caa90ca2e9647075bfa053935677feddbdc7c9e17d5a3a30b913ee6abaec88b

Download Submit
C:\Users\Admin\Desktop\UnpublishRevoke.xlsx.energy[[email protected]]

Filesize
16KB

MD5
75eebe7f5e1a11648e95bbcdfce08955

SHA1
34b50f03bb9139df87552332f3b525332425fd1e

SHA256
5beea1a7f3177949f086be2007fc74c9579febab6930e2f45de5c3130d196ec4

SHA512
717bc62de407e15c4042710466447bd0b3607b5cdade73f05123752c7079a810a5baa95cd3607b2841cb1d446e1258ff339ef2f446de606d15fded6f469050be

Download Submit
memory/1964-9-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/1964-8-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/3044-10-0x000007FEF5F10000-0x000007FEF68FC000-memory.dmp

Filesize
9.9MB

Download
memory/3044-0-0x000007FEF5F13000-0x000007FEF5F14000-memory.dmp

Filesize
4KB

Download
memory/3044-206-0x000007FEF5F13000-0x000007FEF5F14000-memory.dmp

Filesize
4KB

Download
memory/3044-220-0x000007FEF5F10000-0x000007FEF68FC000-memory.dmp

Filesize
9.9MB

Download
memory/3044-1-0x0000000000D40000-0x0000000000D5A000-memory.dmp

Filesize
104KB

Download
memory/3044-572-0x000007FEF5F10000-0x000007FEF68FC000-memory.dmp

Filesize
9.9MB

Download