hakbit | 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Resubmissions

16/04/2025, 11:04

250416-m58gsaz1ay 10

15/04/2025, 17:34

15/04/2025, 06:16

14/04/2025, 08:06

14/04/2025, 07:59

14/04/2025, 07:22

14/04/2025, 07:16

Analysis

max time kernel
102s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2025, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit credential_access defense_evasion discovery execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: laSyfwfRUHu6cbS8C0jl4ALXcbUVtKyco66ZZqT/U81rZuSAvCNrekvbbaBJO6PXJpjxUFfN16PxFHphmexw0fVf2VEfBUKengemPqZMrycLRoyLH4j5jLaXaep9vCzUiLnzuP/OG+O3yPwKzXmBHAoW7G7Fpo93h2e5U/mAk+tWAGaA94kSWdQDd8DDnxkLXFSdAZqLX4+J6Avexuh0+hCtymyzEuRHkASIqiI+HG/hz0eJw+vP46WoUfzsA1gNOa7YgbhAok84+QwRLVLnghLGJcRGDSUsn05UX1VvWBrV6Q87sjWqNmxNDPc9p6ChulYKgvDFblrw1+wdFqthbTdFXH6SHdDdUD04oc0EGblkf/KBaLpDkd28JDaDF/uFOMan/x38sxWjjdFwypBEr4jMijwqXQwqVLunEVUVgfhEyCiNTw5h4KVC2zCW1+xbnNBBGJ4pJAWcfPqWvP2P+vdKhpDyEiTjrvQ4G37tbppz+J2iUS3ReH+gm8MnXXd/UVhfEXL52nh1tQCc0rk8JPT43gJ4hXXkLBjYbPAurgjdvKgQhKiSkIaxoaLWJ+ayvjoLMAV74mUO2SF/trsS6dC3VT7aN34Ggkwkqw88LyDbxYSDO0dgM3zKH0QYNCrXJcIAor/z9MWJhU/4mJ7YFXY/RGsD/PZP8WoQvLPKYMA= Number of files that were processed is: 443

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Hakbit family
hakbit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1864	sc.exe
660	sc.exe
1248	sc.exe
540	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4244	cmd.exe
5208	PING.EXE

Kills process with taskkill 47 IoCs

defense_evasion

pid	Process
4356	taskkill.exe
4872	taskkill.exe
1724	taskkill.exe
4292	taskkill.exe
1332	taskkill.exe
1484	taskkill.exe
2164	taskkill.exe
2312	taskkill.exe
2392	taskkill.exe
5064	taskkill.exe
4428	taskkill.exe
852	taskkill.exe
116	taskkill.exe
1088	taskkill.exe
3600	taskkill.exe
1004	taskkill.exe
1508	taskkill.exe
2228	taskkill.exe
4592	taskkill.exe
4548	taskkill.exe
2000	taskkill.exe
1616	taskkill.exe
5048	taskkill.exe
620	taskkill.exe
2848	taskkill.exe
2820	taskkill.exe
1472	taskkill.exe
3888	taskkill.exe
2140	taskkill.exe
4728	taskkill.exe
264	taskkill.exe
4828	taskkill.exe
4832	taskkill.exe
392	taskkill.exe
4724	taskkill.exe
4972	taskkill.exe
1812	taskkill.exe
1308	taskkill.exe
4556	taskkill.exe
4208	taskkill.exe
4220	taskkill.exe
4868	taskkill.exe
1520	taskkill.exe
636	taskkill.exe
2008	taskkill.exe
1384	taskkill.exe
1760	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1824	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5208	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Token: SeDebugPrivilege	1472	taskkill.exe
Token: SeDebugPrivilege	1308	taskkill.exe
Token: SeDebugPrivilege	4220	taskkill.exe
Token: SeDebugPrivilege	1004	taskkill.exe
Token: SeDebugPrivilege	4872	taskkill.exe
Token: SeDebugPrivilege	620	taskkill.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	1332	taskkill.exe
Token: SeDebugPrivilege	2000	taskkill.exe
Token: SeDebugPrivilege	2820	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	4292	taskkill.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	4728	taskkill.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeDebugPrivilege	116	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	4428	taskkill.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	852	taskkill.exe
Token: SeDebugPrivilege	1508	taskkill.exe
Token: SeDebugPrivilege	392	taskkill.exe
Token: SeDebugPrivilege	4868	taskkill.exe
Token: SeDebugPrivilege	3600	taskkill.exe
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	4832	taskkill.exe
Token: SeDebugPrivilege	2848	taskkill.exe
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	3888	taskkill.exe
Token: SeDebugPrivilege	2312	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	2140	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeDebugPrivilege	2228	taskkill.exe
Token: SeDebugPrivilege	2008	taskkill.exe
Token: SeDebugPrivilege	636	taskkill.exe
Token: SeDebugPrivilege	4356	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	1384	taskkill.exe
Token: SeDebugPrivilege	4208	taskkill.exe
Token: SeDebugPrivilege	5064	taskkill.exe
Token: SeDebugPrivilege	264	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	3360	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 1248	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	86
PID 5000 wrote to memory of 1248	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	86
PID 5000 wrote to memory of 540	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	87
PID 5000 wrote to memory of 540	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	87
PID 5000 wrote to memory of 1864	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	89
PID 5000 wrote to memory of 1864	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	89
PID 5000 wrote to memory of 1196	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	90
PID 5000 wrote to memory of 1196	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	90
PID 5000 wrote to memory of 660	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	92
PID 5000 wrote to memory of 660	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	92
PID 5000 wrote to memory of 1520	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	96
PID 5000 wrote to memory of 1520	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	96
PID 5000 wrote to memory of 1088	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	97
PID 5000 wrote to memory of 1088	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	97
PID 5000 wrote to memory of 1308	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	98
PID 5000 wrote to memory of 1308	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	98
PID 5000 wrote to memory of 1472	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	99
PID 5000 wrote to memory of 1472	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	99
PID 5000 wrote to memory of 116	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	100
PID 5000 wrote to memory of 116	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	100
PID 5000 wrote to memory of 1812	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	105
PID 5000 wrote to memory of 1812	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	105
PID 5000 wrote to memory of 2820	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	106
PID 5000 wrote to memory of 2820	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	106
PID 5000 wrote to memory of 4828	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	107
PID 5000 wrote to memory of 4828	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	107
PID 5000 wrote to memory of 852	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	108
PID 5000 wrote to memory of 852	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	108
PID 5000 wrote to memory of 2000	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	109
PID 5000 wrote to memory of 2000	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	109
PID 5000 wrote to memory of 2164	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	110
PID 5000 wrote to memory of 2164	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	110
PID 5000 wrote to memory of 4428	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	111
PID 5000 wrote to memory of 4428	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	111
PID 5000 wrote to memory of 264	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	112
PID 5000 wrote to memory of 264	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	112
PID 5000 wrote to memory of 2848	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	113
PID 5000 wrote to memory of 2848	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	113
PID 5000 wrote to memory of 4868	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	114
PID 5000 wrote to memory of 4868	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	114
PID 5000 wrote to memory of 4972	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	115
PID 5000 wrote to memory of 4972	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	115
PID 5000 wrote to memory of 4872	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	116
PID 5000 wrote to memory of 4872	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	116
PID 5000 wrote to memory of 1484	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	117
PID 5000 wrote to memory of 1484	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	117
PID 5000 wrote to memory of 620	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	118
PID 5000 wrote to memory of 620	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	118
PID 5000 wrote to memory of 4548	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	119
PID 5000 wrote to memory of 4548	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	119
PID 5000 wrote to memory of 4592	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	120
PID 5000 wrote to memory of 4592	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	120
PID 5000 wrote to memory of 4728	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	121
PID 5000 wrote to memory of 4728	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	121
PID 5000 wrote to memory of 1332	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	122
PID 5000 wrote to memory of 1332	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	122
PID 5000 wrote to memory of 4724	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	123
PID 5000 wrote to memory of 4724	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	123
PID 5000 wrote to memory of 3600	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	124
PID 5000 wrote to memory of 3600	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	124
PID 5000 wrote to memory of 4292	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	125
PID 5000 wrote to memory of 4292	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	125
PID 5000 wrote to memory of 2228	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	126
PID 5000 wrote to memory of 2228	5000	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	126

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:1248
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:540
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:1864
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:1196
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:660
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:116
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4828
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:852
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:264
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:620
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:4592
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1332
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:392
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4220
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5048
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:636
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3360
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1824
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4244
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5208
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:3128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  2⤵
  PID:4388
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

Filesize
1.3MB

MD5
3e855080bf147beab8b51fef860da8e3

SHA1
a3ce1ee054bfa3ece244de9444896dc89da2df27

SHA256
4514ab5e3a4aceb2ff7ce2df1498a2404b96ac5fedaa0573cfbf2d76f07d2878

SHA512
6b0d5b33e61c27e4b01b39877dfd1dad81182d3f464218608b18873c28ad6dab6ae023f491832e48eb93a656eb1f6ffffa319ef353406805b28ad0528b124256

Download Submit
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi

Filesize
28.8MB

MD5
1a940086a812a7d7cfe8189c1040544c

SHA1
6ee6b717e916a72b82951782f1c1b14d76604013

SHA256
f85bd975c10fa79593e57f8e7d4dcd9a402686a1bc48a1e4ee21319e98c0f6d9

SHA512
cb6a619349d67bbfc6d531dc6b8e872022b78d07b06e0768d6eedda41992abb5c820672cd3c978580f690ba8f06fd22eabf359679f81510e967acd7b91626e16

Download Submit
C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.energy[[email protected]]

Filesize
728KB

MD5
235d1946b98c1d933ac224eb9e0c1b47

SHA1
cc5f6ae9edba7ecaae76c9def6e75a6199efcb5b

SHA256
e99eb3bc1625019fcc64e87d777eac976eb40afd29150219439ff34b10f81cf2

SHA512
28ebe8218ac1411c40f153a5e764c23f833979cbf545595ec2f9a2a40bcd295d42d238e3f27ac8f603663e621cf11c76b5b1baa1a90a302fb1f105b195347007

Download Submit
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi

Filesize
25.7MB

MD5
9b371eeec6f66774a0cf13e38ed51694

SHA1
2d88c0e9a1db9284556bbd2645c000e3635e90f6

SHA256
d69e3e726ae184f2fd742d80a3fb5c9f115b5f05715fcf4eb44812db6c5f1ae0

SHA512
7586af0c8ed213d036cf21b24fb8b5458bdbcb0db8b01d9c7def001c8d55a8117a721b4eb029cc26fc8fceaee9446e332f9a8e14247c98bed33bfce0c386f8d9

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
fed08c579384a1e9b250ebdfa2b5f53e

SHA1
3b871a1127f2cdb74884be6ede8321ba621a8d0a

SHA256
432b38997033db4bfe6b72f014f9bdd24eb6f926513f2f5809b428ed0de743bf

SHA512
10a6c19fc29939c15f4424463fdaab7400b452859065cab0c521d4d4f47637e524cbc49da5235ab4b20283d15e84b0518c79b5dff9cd0146e4697021526942ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
414d3c7be38a289ed476cbb4ac51ae02

SHA1
da5113d85edeefb5a20093e40bb548356316f3d4

SHA256
d8ce1dc945725e1a003fcad77de1db795d498003228c088506d286c613cd2e31

SHA512
a6db753e6e9515ad845b8073e725b2d0182697c6dd77475291aefd19e7331d78039c00b9d41ee8cccfabe9a2e0e2ab25753ebf9a865c4a3c18d77ee27cbbae93

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kllmqy5o.cfy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
e380e8b78d6c0ebda2c0cb231d5b22fa

SHA1
3970f4b7d2c371ec3e0298d554efecbc6697b234

SHA256
92295dbc211825a6653677ce758c9b53c745ad1d12e4b4e1f1aba016dc88e8d2

SHA512
5ea12bd9904db8241ad960c0bcbd54d5ec087e34d091d99b922a8bb6568a621626c96e72119915d7129a971cf720c1e40334f4517351b9744031b7cc0592c05f

Download Submit
memory/3360-29-0x0000021C706B0000-0x0000021C706D2000-memory.dmp

Filesize
136KB

Download
memory/5000-180-0x00007FFF41733000-0x00007FFF41735000-memory.dmp

Filesize
8KB

Download
memory/5000-210-0x00007FFF41730000-0x00007FFF421F1000-memory.dmp

Filesize
10.8MB

Download
memory/5000-2-0x00007FFF41730000-0x00007FFF421F1000-memory.dmp

Filesize
10.8MB

Download
memory/5000-0-0x00007FFF41733000-0x00007FFF41735000-memory.dmp

Filesize
8KB

Download
memory/5000-1-0x0000000000630000-0x000000000064A000-memory.dmp

Filesize
104KB

Download
memory/5000-579-0x00007FFF41730000-0x00007FFF421F1000-memory.dmp

Filesize
10.8MB

Download