Analysis
-
max time kernel
150s -
max time network
56s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 13:56
Static task
static1
Behavioral task
behavioral1
Sample
Fast.exe
Resource
win7
Behavioral task
behavioral2
Sample
Fast.exe
Resource
win10v200430
General
-
Target
Fast.exe
-
Size
55KB
-
MD5
4a3762d49120264f48deb29ca8668082
-
SHA1
4ed52a74441ed443c09d51b625d07cded9e2ba08
-
SHA256
b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3
-
SHA512
dcbe5bb3f9cd2bbdacd0a2fad7728d7a78e07950e6cd8423bcd10f2c698e81b80fa9f8582af0925cae9a4c3c08c786ac38b07068a61a6b97d82a3f408a6b8f39
Malware Config
Extracted
\??\c:\users\admin\desktop\info.txt
https://icq.com/windows/
https://icq.im/VIRTUALHORSE
Extracted
C:\Users\Admin\Desktop\info.hta
Signatures
-
Drops file in Program Files directory 19470 IoCs
Processes:
Fast.exedescription ioc process File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\MARQUEE.POC.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_block_plugin.dll Fast.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml Fast.exe File created C:\Program Files\Microsoft Office\Office14\1033\ENVELOPR.DLL.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MY.XML.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_K_COL.HXK.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk Fast.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107302.WMF.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGSIDEBR.XML.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll Fast.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY Fast.exe File created C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR20F.GIF.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR5B.GIF Fast.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\AWARDHM.POC.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\CHECKER.POC.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Common Files\System\ado\msado27.tlb Fast.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar Fast.exe File created C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar Fast.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif Fast.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0202045.JPG Fast.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18214_.WMF Fast.exe File created C:\Program Files\Microsoft Office\Office14\CSS7DATA000C.DLL.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Fast.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui Fast.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac Fast.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00837_.WMF Fast.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18189_.WMF Fast.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OLMAPI32.DLL.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.BR.XML Fast.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEBHED98.POC.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01772_.WMF Fast.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll Fast.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png Fast.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105414.WMF Fast.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387882.JPG Fast.exe File opened for modification C:\Program Files\Windows Journal\en-US\Journal.exe.mui Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll Fast.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll Fast.exe File created C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY01462_.WMF Fast.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_m.png Fast.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png Fast.exe File created C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Microsoft Office\Templates\1033\OriginMergeLetter.Dotx.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png Fast.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21365_.GIF.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSODCW.DLL Fast.exe -
Suspicious use of AdjustPrivilegeToken 87 IoCs
Processes:
Fast.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 240 Fast.exe Token: SeBackupPrivilege 1880 vssvc.exe Token: SeRestorePrivilege 1880 vssvc.exe Token: SeAuditPrivilege 1880 vssvc.exe Token: SeIncreaseQuotaPrivilege 1632 WMIC.exe Token: SeSecurityPrivilege 1632 WMIC.exe Token: SeTakeOwnershipPrivilege 1632 WMIC.exe Token: SeLoadDriverPrivilege 1632 WMIC.exe Token: SeSystemProfilePrivilege 1632 WMIC.exe Token: SeSystemtimePrivilege 1632 WMIC.exe Token: SeProfSingleProcessPrivilege 1632 WMIC.exe Token: SeIncBasePriorityPrivilege 1632 WMIC.exe Token: SeCreatePagefilePrivilege 1632 WMIC.exe Token: SeBackupPrivilege 1632 WMIC.exe Token: SeRestorePrivilege 1632 WMIC.exe Token: SeShutdownPrivilege 1632 WMIC.exe Token: SeDebugPrivilege 1632 WMIC.exe Token: SeSystemEnvironmentPrivilege 1632 WMIC.exe Token: SeRemoteShutdownPrivilege 1632 WMIC.exe Token: SeUndockPrivilege 1632 WMIC.exe Token: SeManageVolumePrivilege 1632 WMIC.exe Token: 33 1632 WMIC.exe Token: 34 1632 WMIC.exe Token: 35 1632 WMIC.exe Token: SeIncreaseQuotaPrivilege 1632 WMIC.exe Token: SeSecurityPrivilege 1632 WMIC.exe Token: SeTakeOwnershipPrivilege 1632 WMIC.exe Token: SeLoadDriverPrivilege 1632 WMIC.exe Token: SeSystemProfilePrivilege 1632 WMIC.exe Token: SeSystemtimePrivilege 1632 WMIC.exe Token: SeProfSingleProcessPrivilege 1632 WMIC.exe Token: SeIncBasePriorityPrivilege 1632 WMIC.exe Token: SeCreatePagefilePrivilege 1632 WMIC.exe Token: SeBackupPrivilege 1632 WMIC.exe Token: SeRestorePrivilege 1632 WMIC.exe Token: SeShutdownPrivilege 1632 WMIC.exe Token: SeDebugPrivilege 1632 WMIC.exe Token: SeSystemEnvironmentPrivilege 1632 WMIC.exe Token: SeRemoteShutdownPrivilege 1632 WMIC.exe Token: SeUndockPrivilege 1632 WMIC.exe Token: SeManageVolumePrivilege 1632 WMIC.exe Token: 33 1632 WMIC.exe Token: 34 1632 WMIC.exe Token: 35 1632 WMIC.exe Token: SeBackupPrivilege 1436 wbengine.exe Token: SeRestorePrivilege 1436 wbengine.exe Token: SeSecurityPrivilege 1436 wbengine.exe Token: SeIncreaseQuotaPrivilege 1148 WMIC.exe Token: SeSecurityPrivilege 1148 WMIC.exe Token: SeTakeOwnershipPrivilege 1148 WMIC.exe Token: SeLoadDriverPrivilege 1148 WMIC.exe Token: SeSystemProfilePrivilege 1148 WMIC.exe Token: SeSystemtimePrivilege 1148 WMIC.exe Token: SeProfSingleProcessPrivilege 1148 WMIC.exe Token: SeIncBasePriorityPrivilege 1148 WMIC.exe Token: SeCreatePagefilePrivilege 1148 WMIC.exe Token: SeBackupPrivilege 1148 WMIC.exe Token: SeRestorePrivilege 1148 WMIC.exe Token: SeShutdownPrivilege 1148 WMIC.exe Token: SeDebugPrivilege 1148 WMIC.exe Token: SeSystemEnvironmentPrivilege 1148 WMIC.exe Token: SeRemoteShutdownPrivilege 1148 WMIC.exe Token: SeUndockPrivilege 1148 WMIC.exe Token: SeManageVolumePrivilege 1148 WMIC.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
Fast.execmd.execmd.execmd.exedescription pid process target process PID 240 wrote to memory of 772 240 Fast.exe cmd.exe PID 240 wrote to memory of 772 240 Fast.exe cmd.exe PID 240 wrote to memory of 772 240 Fast.exe cmd.exe PID 240 wrote to memory of 772 240 Fast.exe cmd.exe PID 240 wrote to memory of 844 240 Fast.exe cmd.exe PID 240 wrote to memory of 844 240 Fast.exe cmd.exe PID 240 wrote to memory of 844 240 Fast.exe cmd.exe PID 240 wrote to memory of 844 240 Fast.exe cmd.exe PID 772 wrote to memory of 1772 772 cmd.exe netsh.exe PID 772 wrote to memory of 1772 772 cmd.exe netsh.exe PID 772 wrote to memory of 1772 772 cmd.exe netsh.exe PID 844 wrote to memory of 1764 844 cmd.exe vssadmin.exe PID 844 wrote to memory of 1764 844 cmd.exe vssadmin.exe PID 844 wrote to memory of 1764 844 cmd.exe vssadmin.exe PID 772 wrote to memory of 1304 772 cmd.exe netsh.exe PID 772 wrote to memory of 1304 772 cmd.exe netsh.exe PID 772 wrote to memory of 1304 772 cmd.exe netsh.exe PID 844 wrote to memory of 1632 844 cmd.exe WMIC.exe PID 844 wrote to memory of 1632 844 cmd.exe WMIC.exe PID 844 wrote to memory of 1632 844 cmd.exe WMIC.exe PID 844 wrote to memory of 1220 844 cmd.exe bcdedit.exe PID 844 wrote to memory of 1220 844 cmd.exe bcdedit.exe PID 844 wrote to memory of 1220 844 cmd.exe bcdedit.exe PID 844 wrote to memory of 2040 844 cmd.exe bcdedit.exe PID 844 wrote to memory of 2040 844 cmd.exe bcdedit.exe PID 844 wrote to memory of 2040 844 cmd.exe bcdedit.exe PID 844 wrote to memory of 2044 844 cmd.exe wbadmin.exe PID 844 wrote to memory of 2044 844 cmd.exe wbadmin.exe PID 844 wrote to memory of 2044 844 cmd.exe wbadmin.exe PID 240 wrote to memory of 1296 240 Fast.exe mshta.exe PID 240 wrote to memory of 1296 240 Fast.exe mshta.exe PID 240 wrote to memory of 1296 240 Fast.exe mshta.exe PID 240 wrote to memory of 1296 240 Fast.exe mshta.exe PID 240 wrote to memory of 1932 240 Fast.exe mshta.exe PID 240 wrote to memory of 1932 240 Fast.exe mshta.exe PID 240 wrote to memory of 1932 240 Fast.exe mshta.exe PID 240 wrote to memory of 1932 240 Fast.exe mshta.exe PID 240 wrote to memory of 776 240 Fast.exe mshta.exe PID 240 wrote to memory of 776 240 Fast.exe mshta.exe PID 240 wrote to memory of 776 240 Fast.exe mshta.exe PID 240 wrote to memory of 776 240 Fast.exe mshta.exe PID 240 wrote to memory of 1748 240 Fast.exe cmd.exe PID 240 wrote to memory of 1748 240 Fast.exe cmd.exe PID 240 wrote to memory of 1748 240 Fast.exe cmd.exe PID 240 wrote to memory of 1748 240 Fast.exe cmd.exe PID 1748 wrote to memory of 1612 1748 cmd.exe vssadmin.exe PID 1748 wrote to memory of 1612 1748 cmd.exe vssadmin.exe PID 1748 wrote to memory of 1612 1748 cmd.exe vssadmin.exe PID 1748 wrote to memory of 1148 1748 cmd.exe WMIC.exe PID 1748 wrote to memory of 1148 1748 cmd.exe WMIC.exe PID 1748 wrote to memory of 1148 1748 cmd.exe WMIC.exe PID 1748 wrote to memory of 364 1748 cmd.exe bcdedit.exe PID 1748 wrote to memory of 364 1748 cmd.exe bcdedit.exe PID 1748 wrote to memory of 364 1748 cmd.exe bcdedit.exe PID 1748 wrote to memory of 844 1748 cmd.exe bcdedit.exe PID 1748 wrote to memory of 844 1748 cmd.exe bcdedit.exe PID 1748 wrote to memory of 844 1748 cmd.exe bcdedit.exe PID 1748 wrote to memory of 1792 1748 cmd.exe wbadmin.exe PID 1748 wrote to memory of 1792 1748 cmd.exe wbadmin.exe PID 1748 wrote to memory of 1792 1748 cmd.exe wbadmin.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
Fast.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe" Fast.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe" Fast.exe -
Deletes system backup catalog 2 TTPs
Ransomware often tries to delete backup files to inhibit system recovery.
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 820 NOTEPAD.EXE -
Modifies Windows Firewall 1 TTPs
-
Modifies service 2 TTPs 15 IoCs
Processes:
vssvc.exenetsh.exenetsh.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 280 IoCs
Processes:
Fast.exepid process 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe 240 Fast.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
mshta.exemshta.exemshta.exepid process 1296 mshta.exe 776 mshta.exe 1932 mshta.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1612 vssadmin.exe 1764 vssadmin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 1220 bcdedit.exe 2040 bcdedit.exe 364 bcdedit.exe 844 bcdedit.exe -
Processes:
wbadmin.exewbadmin.exepid process 2044 wbadmin.exe 1792 wbadmin.exe -
Drops startup file 3 IoCs
Processes:
Fast.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\Fast.exe Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Fast.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight Fast.exe -
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Drops desktop.ini file(s) 77 IoCs
Processes:
Fast.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Fast.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini Fast.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini Fast.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Fast.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Fast.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini Fast.exe File opened for modification C:\Users\Public\Libraries\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GVV7BJHB\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Fast.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini Fast.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1MJ70CPH\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini Fast.exe File opened for modification C:\Users\Public\Documents\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\Music\desktop.ini Fast.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini Fast.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V8SX06NR\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini Fast.exe File opened for modification C:\Users\Public\Pictures\desktop.ini Fast.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Fast.exe File opened for modification C:\Users\Public\desktop.ini Fast.exe File opened for modification C:\Users\Public\Music\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Links\desktop.ini Fast.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Fast.exe File opened for modification C:\Program Files\desktop.ini Fast.exe File opened for modification C:\Program Files (x86)\desktop.ini Fast.exe -
Processes:
mshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fast.exe"C:\Users\Admin\AppData\Local\Temp\Fast.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
- Drops desktop.ini file(s)
-
C:\Users\Admin\AppData\Local\Temp\Fast.exe"C:\Users\Admin\AppData\Local\Temp\Fast.exe"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies service
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies service
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\info.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\info.hta
-
C:\Users\Public\Desktop\info.txt
-
C:\info.hta
-
C:\users\public\desktop\info.hta
-
memory/364-18-0x0000000000000000-mapping.dmp
-
memory/772-0-0x0000000000000000-mapping.dmp
-
memory/776-12-0x0000000000000000-mapping.dmp
-
memory/844-19-0x0000000000000000-mapping.dmp
-
memory/844-1-0x0000000000000000-mapping.dmp
-
memory/1148-17-0x0000000000000000-mapping.dmp
-
memory/1220-6-0x0000000000000000-mapping.dmp
-
memory/1296-9-0x0000000000000000-mapping.dmp
-
memory/1304-4-0x0000000000000000-mapping.dmp
-
memory/1612-16-0x0000000000000000-mapping.dmp
-
memory/1632-5-0x0000000000000000-mapping.dmp
-
memory/1748-14-0x0000000000000000-mapping.dmp
-
memory/1764-3-0x0000000000000000-mapping.dmp
-
memory/1772-2-0x0000000000000000-mapping.dmp
-
memory/1792-20-0x0000000000000000-mapping.dmp
-
memory/1932-10-0x0000000000000000-mapping.dmp
-
memory/2040-7-0x0000000000000000-mapping.dmp
-
memory/2044-8-0x0000000000000000-mapping.dmp