Overview
overview
10Static
static
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows10-2004-x64
3Archive.zi...3e.exe
windows10-2004-x64
8DiskIntern...en.exe
windows10-2004-x64
3f28e02bd1e...8a.exe
windows10-2004-x64
10ForceOp 2....ce.exe
windows10-2004-x64
7HYDRA.exe
windows10-2004-x64
10#/power.exe
windows10-2004-x64
#/sant.exe
windows10-2004-x64
#/ufx.exe
windows10-2004-x64
#/va.exe
windows10-2004-x64
KLwC6vii.exe
windows10-2004-x64
1Keygen.exe
windows10-2004-x64
10Lonelyscre...ox.exe
windows10-2004-x64
3LtHv0O2KZDK4M637.exe
windows10-2004-x64
10Magic_File...ja.exe
windows10-2004-x64
3OnlineInstaller.exe
windows10-2004-x64
8REVENGE-RAT.js
windows10-2004-x64
10Remouse.Mi...cg.exe
windows10-2004-x64
3Analysis
-
max time kernel
102s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2025, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
#/power.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
#/sant.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
#/ufx.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
#/va.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
KLwC6vii.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
Keygen.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
OnlineInstaller.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
REVENGE-RAT.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v2004-20250502-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Disables service(s) 3 TTPs
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Hakbit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\Control Panel\International\Geo\Nation 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2116 sc.exe 3412 sc.exe 2088 sc.exe 4400 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3196 cmd.exe 5644 PING.EXE -
Kills process with taskkill 47 IoCs
pid Process 2596 taskkill.exe 624 taskkill.exe 4880 taskkill.exe 4840 taskkill.exe 3208 taskkill.exe 632 taskkill.exe 3828 taskkill.exe 3016 taskkill.exe 2856 taskkill.exe 2044 taskkill.exe 208 taskkill.exe 2060 taskkill.exe 4932 taskkill.exe 1428 taskkill.exe 2444 taskkill.exe 4988 taskkill.exe 832 taskkill.exe 2224 taskkill.exe 1040 taskkill.exe 4884 taskkill.exe 3256 taskkill.exe 4344 taskkill.exe 2692 taskkill.exe 2568 taskkill.exe 2748 taskkill.exe 3056 taskkill.exe 432 taskkill.exe 2052 taskkill.exe 1664 taskkill.exe 3276 taskkill.exe 3976 taskkill.exe 1668 taskkill.exe 368 taskkill.exe 4416 taskkill.exe 4908 taskkill.exe 3488 taskkill.exe 4724 taskkill.exe 4560 taskkill.exe 3736 taskkill.exe 2400 taskkill.exe 4556 taskkill.exe 2372 taskkill.exe 2440 taskkill.exe 4748 taskkill.exe 4264 taskkill.exe 2468 taskkill.exe 1700 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 6820 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5644 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 832 taskkill.exe Token: SeDebugPrivilege 1700 taskkill.exe Token: SeDebugPrivilege 4560 taskkill.exe Token: SeDebugPrivilege 2468 taskkill.exe Token: SeDebugPrivilege 3208 taskkill.exe Token: SeDebugPrivilege 2224 taskkill.exe Token: SeDebugPrivilege 1040 taskkill.exe Token: SeDebugPrivilege 3976 taskkill.exe Token: SeDebugPrivilege 632 taskkill.exe Token: SeDebugPrivilege 2748 taskkill.exe Token: SeDebugPrivilege 624 taskkill.exe Token: SeDebugPrivilege 1428 taskkill.exe Token: SeDebugPrivilege 2596 taskkill.exe Token: SeDebugPrivilege 3276 taskkill.exe Token: SeDebugPrivilege 4932 taskkill.exe Token: SeDebugPrivilege 3488 taskkill.exe Token: SeDebugPrivilege 208 taskkill.exe Token: SeDebugPrivilege 4416 taskkill.exe Token: SeDebugPrivilege 4556 taskkill.exe Token: SeDebugPrivilege 3828 taskkill.exe Token: SeDebugPrivilege 2244 powershell.exe Token: SeDebugPrivilege 4264 taskkill.exe Token: SeDebugPrivilege 1668 taskkill.exe Token: SeDebugPrivilege 2044 taskkill.exe Token: SeDebugPrivilege 2400 taskkill.exe Token: SeDebugPrivilege 368 taskkill.exe Token: SeDebugPrivilege 4724 taskkill.exe Token: SeDebugPrivilege 2440 taskkill.exe Token: SeDebugPrivilege 2856 taskkill.exe Token: SeDebugPrivilege 4988 taskkill.exe Token: SeDebugPrivilege 4880 taskkill.exe Token: SeDebugPrivilege 2060 taskkill.exe Token: SeDebugPrivilege 3256 taskkill.exe Token: SeDebugPrivilege 1664 taskkill.exe Token: SeDebugPrivilege 432 taskkill.exe Token: SeDebugPrivilege 4908 taskkill.exe Token: SeDebugPrivilege 2052 taskkill.exe Token: SeDebugPrivilege 4840 taskkill.exe Token: SeDebugPrivilege 4344 taskkill.exe Token: SeDebugPrivilege 2444 taskkill.exe Token: SeDebugPrivilege 3736 taskkill.exe Token: SeDebugPrivilege 2568 taskkill.exe Token: SeDebugPrivilege 2692 taskkill.exe Token: SeDebugPrivilege 3016 taskkill.exe Token: SeDebugPrivilege 4884 taskkill.exe Token: SeDebugPrivilege 2372 taskkill.exe Token: SeDebugPrivilege 3056 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 952 wrote to memory of 2088 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 952 wrote to memory of 2088 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 87 PID 952 wrote to memory of 3412 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 952 wrote to memory of 3412 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 88 PID 952 wrote to memory of 2116 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 952 wrote to memory of 2116 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 89 PID 952 wrote to memory of 4400 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 952 wrote to memory of 4400 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 90 PID 952 wrote to memory of 1700 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 952 wrote to memory of 1700 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 91 PID 952 wrote to memory of 2468 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 952 wrote to memory of 2468 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 92 PID 952 wrote to memory of 832 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 952 wrote to memory of 832 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 93 PID 952 wrote to memory of 4932 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 952 wrote to memory of 4932 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 100 PID 952 wrote to memory of 3488 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 952 wrote to memory of 3488 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 101 PID 952 wrote to memory of 1428 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 952 wrote to memory of 1428 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 102 PID 952 wrote to memory of 1040 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 952 wrote to memory of 1040 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 103 PID 952 wrote to memory of 3976 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 952 wrote to memory of 3976 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 104 PID 952 wrote to memory of 2224 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 952 wrote to memory of 2224 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 105 PID 952 wrote to memory of 4560 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 952 wrote to memory of 4560 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 106 PID 952 wrote to memory of 2748 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 952 wrote to memory of 2748 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 107 PID 952 wrote to memory of 624 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 952 wrote to memory of 624 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 108 PID 952 wrote to memory of 632 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 952 wrote to memory of 632 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 109 PID 952 wrote to memory of 3208 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 952 wrote to memory of 3208 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 110 PID 952 wrote to memory of 3276 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 952 wrote to memory of 3276 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 111 PID 952 wrote to memory of 2596 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 952 wrote to memory of 2596 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 112 PID 952 wrote to memory of 4844 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127 PID 952 wrote to memory of 4844 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 127 PID 952 wrote to memory of 4884 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 128 PID 952 wrote to memory of 4884 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 128 PID 952 wrote to memory of 1668 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 952 wrote to memory of 1668 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 129 PID 952 wrote to memory of 1664 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 131 PID 952 wrote to memory of 1664 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 131 PID 952 wrote to memory of 4264 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 952 wrote to memory of 4264 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 132 PID 952 wrote to memory of 4748 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 133 PID 952 wrote to memory of 4748 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 133 PID 952 wrote to memory of 2052 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 134 PID 952 wrote to memory of 2052 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 134 PID 952 wrote to memory of 2440 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 135 PID 952 wrote to memory of 2440 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 135 PID 952 wrote to memory of 432 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 136 PID 952 wrote to memory of 432 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 136 PID 952 wrote to memory of 2060 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 137 PID 952 wrote to memory of 2060 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 137 PID 952 wrote to memory of 2372 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 138 PID 952 wrote to memory of 2372 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 138 PID 952 wrote to memory of 4556 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 139 PID 952 wrote to memory of 4556 952 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 139
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:2088
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:3412
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:2116
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:4400
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:832
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:624
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:632
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3208
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3276
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:4844
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4264
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:4748
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:368
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3256
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:6820
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3196 -
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5644
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:4304
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:4808
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:5304
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD59eaaf6bbfa4e91c49b353f7dc8e8545f
SHA16c932b4022ff39daa75d05380d7959da68ac6875
SHA256e26c6cb7f95251bf5a75aebd9da0cd2302d2f7faad0afd3822436893801b6581
SHA51246cd1b5ffaf41ee6701732f1b849828bea1d49de0d8f7ba3da8547c438882be055998f792f42d499ef73a834f2a21aac88d6373304251565efb5a7a37b9a11bc
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize28.8MB
MD5fc0bbfcff60c1985ea5af2ce5d29fe67
SHA1b4879e52680d9accd2396dfb30ebef53b0c498bd
SHA25692fb30aee1716c83b10e7aef71cadf08893cf02b29891e6d8e34e798a15f4f68
SHA512a01bc0752d167962698a2cac1eaa3e8a7a2c5aefec4516e64c12cd07b0cb875db18309e31845e61a91c0e8009dc8c20e71b797b626180123b347ba49873699ed
-
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Filesize804KB
MD5433d6a5fbffc03bda0c89b751ab6e428
SHA146012c27d4e7a92376043ad6ade3b3c2d36c036f
SHA2569a2d86ec3868caade257d4f84b8a977e47d6ea6b8036defef912cfdd7f598909
SHA51220564076bc16e95628e0ae5e6029a22f928b1d64c154b196842a03ebf2da73a7a4f79445c7e30c92c491f08a1c3d0f63940052076a7b12e4de1c804267b795fe
-
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Filesize25.7MB
MD59c08087e4d683fda4f98e41f23801153
SHA17b17f0f7f6a6b96e24920a1c98e93e7429d49064
SHA256df86418fcb7a2a82eadf4b63e8ddb6734dde0f92fe53325412419a84f2c7dce8
SHA5122a61fe4bc7cca90b7c94d088887676892013e92ae5c99497f1548a60171b1010d18cb15ad9e32784e040e18b978383184724604702e48e7c563e38123b53dbcd
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Filesize180KB
MD57b88186126851f0ac39a877dc5e76478
SHA1d3b16a9b9e1ece74f068c74260af2aadd97e445a
SHA256ed68f63e108312492d7d9d2da77d3ccfb1cec2df7f1ab545cd0cc71ae0fa7bbc
SHA51228fd24424fe9cb720b20510b920e3586a9186753c0bad8ccc2ed0274835432bd8883e490bd199a486bd8a89eb246f148d9b72e7812acb590c02c641a55d00130
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5ada23d35e4a3f1bc35ac8d393cd02675
SHA188dd6ddecec82aeafba2b6368078c7c70b88fcac
SHA25698d17949831dda7243aa8b24a66443eee75d0805996826290fbe1a75bfc79e72
SHA5120acae33f83787122b779b8b1b41580f4595eb44c74ef0035949e3d90103fd22e15ed4af4238985bd58f8a0378dc8bce4d77549ca4bb661c2c515018be99a79e6
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
828B
MD5f39a9eaafee38750f4042ccdf1621b93
SHA1275604cf610936d160447e1e1ee9c8daefcd21fd
SHA256fe29ef7eaf41f133dafde2444502f8a8180679e6d63d00cfd10917836e5f6edb
SHA5125f6c8cd7db47eedcc511c3f89afb1dae497cd9b4421a2200d67a0469fc8a710a33c5afac5882532cc2d79015660ec235335113dd09941c0bb0bf33ce79733d20