phobos | b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3

General

Target

Fast.exe
Size

55KB
MD5

4a3762d49120264f48deb29ca8668082
SHA1

4ed52a74441ed443c09d51b625d07cded9e2ba08
SHA256

b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3
SHA512

dcbe5bb3f9cd2bbdacd0a2fad7728d7a78e07950e6cd8423bcd10f2c698e81b80fa9f8582af0925cae9a4c3c08c786ac38b07068a61a6b97d82a3f408a6b8f39

Score

10^/10

ransomware evasion persistence phobos spyware

Malware Config

Extracted

Path

\??\c:\users\admin\desktop\info.txt

Ransom Note

All your files have been ENCRYPTED!!! Install ICQ software on your PC or mobile phone here https://icq.com/windows/ Write to our ICQ @VIRTUALHORSE https://icq.im/VIRTUALHORSE Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss.

URLs

https://icq.com/windows/

https://icq.im/VIRTUALHORSE

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, install ICQ software on your PC or mobile phone here Write to our ICQ @VIRTUALHORSE Write this ID in the title of your message You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee How to obtain Bitcoins Also you can find other places to buy Bitcoins and beginners guide here: Attention!

Signatures

Drops file in Program Files directory 19470 IoCs

Processes:

Fast.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\Office14\PUBWIZ\MARQUEE.POC.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_block_plugin.dll	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\ENVELOPR.DLL.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MY.XML.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties	Fast.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_K_COL.HXK.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk	Fast.exe
File created	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107302.WMF.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGSIDEBR.XML.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll	Fast.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR20F.GIF.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR5B.GIF	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\PUBWIZ\AWARDHM.POC.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\PUBWIZ\CHECKER.POC.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado27.tlb	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar	Fast.exe
File created	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif	Fast.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG	Fast.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0202045.JPG	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18214_.WMF	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\CSS7DATA000C.DLL.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Fast.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui	Fast.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00837_.WMF	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18189_.WMF	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\OLMAPI32.DLL.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.BR.XML	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEBHED98.POC.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01772_.WMF	Fast.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll	Fast.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105414.WMF	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387882.JPG	Fast.exe
File opened for modification	C:\Program Files\Windows Journal\en-US\Journal.exe.mui	Fast.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll	Fast.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll	Fast.exe
File created	C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY01462_.WMF	Fast.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_m.png	Fast.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Microsoft Office\Templates\1033\OriginMergeLetter.Dotx.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png	Fast.exe
File created	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21365_.GIF.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSODCW.DLL	Fast.exe

Suspicious use of AdjustPrivilegeToken 87 IoCs

Processes:

Fast.exevssvc.exeWMIC.exewbengine.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	240	Fast.exe
Token: SeBackupPrivilege	1880	vssvc.exe
Token: SeRestorePrivilege	1880	vssvc.exe
Token: SeAuditPrivilege	1880	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1632	WMIC.exe
Token: SeSecurityPrivilege	1632	WMIC.exe
Token: SeTakeOwnershipPrivilege	1632	WMIC.exe
Token: SeLoadDriverPrivilege	1632	WMIC.exe
Token: SeSystemProfilePrivilege	1632	WMIC.exe
Token: SeSystemtimePrivilege	1632	WMIC.exe
Token: SeProfSingleProcessPrivilege	1632	WMIC.exe
Token: SeIncBasePriorityPrivilege	1632	WMIC.exe
Token: SeCreatePagefilePrivilege	1632	WMIC.exe
Token: SeBackupPrivilege	1632	WMIC.exe
Token: SeRestorePrivilege	1632	WMIC.exe
Token: SeShutdownPrivilege	1632	WMIC.exe
Token: SeDebugPrivilege	1632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1632	WMIC.exe
Token: SeRemoteShutdownPrivilege	1632	WMIC.exe
Token: SeUndockPrivilege	1632	WMIC.exe
Token: SeManageVolumePrivilege	1632	WMIC.exe
Token: 33	1632	WMIC.exe
Token: 34	1632	WMIC.exe
Token: 35	1632	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1632	WMIC.exe
Token: SeSecurityPrivilege	1632	WMIC.exe
Token: SeTakeOwnershipPrivilege	1632	WMIC.exe
Token: SeLoadDriverPrivilege	1632	WMIC.exe
Token: SeSystemProfilePrivilege	1632	WMIC.exe
Token: SeSystemtimePrivilege	1632	WMIC.exe
Token: SeProfSingleProcessPrivilege	1632	WMIC.exe
Token: SeIncBasePriorityPrivilege	1632	WMIC.exe
Token: SeCreatePagefilePrivilege	1632	WMIC.exe
Token: SeBackupPrivilege	1632	WMIC.exe
Token: SeRestorePrivilege	1632	WMIC.exe
Token: SeShutdownPrivilege	1632	WMIC.exe
Token: SeDebugPrivilege	1632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1632	WMIC.exe
Token: SeRemoteShutdownPrivilege	1632	WMIC.exe
Token: SeUndockPrivilege	1632	WMIC.exe
Token: SeManageVolumePrivilege	1632	WMIC.exe
Token: 33	1632	WMIC.exe
Token: 34	1632	WMIC.exe
Token: 35	1632	WMIC.exe
Token: SeBackupPrivilege	1436	wbengine.exe
Token: SeRestorePrivilege	1436	wbengine.exe
Token: SeSecurityPrivilege	1436	wbengine.exe
Token: SeIncreaseQuotaPrivilege	1148	WMIC.exe
Token: SeSecurityPrivilege	1148	WMIC.exe
Token: SeTakeOwnershipPrivilege	1148	WMIC.exe
Token: SeLoadDriverPrivilege	1148	WMIC.exe
Token: SeSystemProfilePrivilege	1148	WMIC.exe
Token: SeSystemtimePrivilege	1148	WMIC.exe
Token: SeProfSingleProcessPrivilege	1148	WMIC.exe
Token: SeIncBasePriorityPrivilege	1148	WMIC.exe
Token: SeCreatePagefilePrivilege	1148	WMIC.exe
Token: SeBackupPrivilege	1148	WMIC.exe
Token: SeRestorePrivilege	1148	WMIC.exe
Token: SeShutdownPrivilege	1148	WMIC.exe
Token: SeDebugPrivilege	1148	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1148	WMIC.exe
Token: SeRemoteShutdownPrivilege	1148	WMIC.exe
Token: SeUndockPrivilege	1148	WMIC.exe
Token: SeManageVolumePrivilege	1148	WMIC.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

Fast.execmd.execmd.execmd.exe

description	pid	process	target process
PID 240 wrote to memory of 772	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 772	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 772	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 772	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 844	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 844	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 844	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 844	240	Fast.exe	cmd.exe
PID 772 wrote to memory of 1772	772	cmd.exe	netsh.exe
PID 772 wrote to memory of 1772	772	cmd.exe	netsh.exe
PID 772 wrote to memory of 1772	772	cmd.exe	netsh.exe
PID 844 wrote to memory of 1764	844	cmd.exe	vssadmin.exe
PID 844 wrote to memory of 1764	844	cmd.exe	vssadmin.exe
PID 844 wrote to memory of 1764	844	cmd.exe	vssadmin.exe
PID 772 wrote to memory of 1304	772	cmd.exe	netsh.exe
PID 772 wrote to memory of 1304	772	cmd.exe	netsh.exe
PID 772 wrote to memory of 1304	772	cmd.exe	netsh.exe
PID 844 wrote to memory of 1632	844	cmd.exe	WMIC.exe
PID 844 wrote to memory of 1632	844	cmd.exe	WMIC.exe
PID 844 wrote to memory of 1632	844	cmd.exe	WMIC.exe
PID 844 wrote to memory of 1220	844	cmd.exe	bcdedit.exe
PID 844 wrote to memory of 1220	844	cmd.exe	bcdedit.exe
PID 844 wrote to memory of 1220	844	cmd.exe	bcdedit.exe
PID 844 wrote to memory of 2040	844	cmd.exe	bcdedit.exe
PID 844 wrote to memory of 2040	844	cmd.exe	bcdedit.exe
PID 844 wrote to memory of 2040	844	cmd.exe	bcdedit.exe
PID 844 wrote to memory of 2044	844	cmd.exe	wbadmin.exe
PID 844 wrote to memory of 2044	844	cmd.exe	wbadmin.exe
PID 844 wrote to memory of 2044	844	cmd.exe	wbadmin.exe
PID 240 wrote to memory of 1296	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1296	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1296	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1296	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1932	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1932	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1932	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1932	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 776	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 776	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 776	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 776	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1748	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1748	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1748	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1748	240	Fast.exe	cmd.exe
PID 1748 wrote to memory of 1612	1748	cmd.exe	vssadmin.exe
PID 1748 wrote to memory of 1612	1748	cmd.exe	vssadmin.exe
PID 1748 wrote to memory of 1612	1748	cmd.exe	vssadmin.exe
PID 1748 wrote to memory of 1148	1748	cmd.exe	WMIC.exe
PID 1748 wrote to memory of 1148	1748	cmd.exe	WMIC.exe
PID 1748 wrote to memory of 1148	1748	cmd.exe	WMIC.exe
PID 1748 wrote to memory of 364	1748	cmd.exe	bcdedit.exe
PID 1748 wrote to memory of 364	1748	cmd.exe	bcdedit.exe
PID 1748 wrote to memory of 364	1748	cmd.exe	bcdedit.exe
PID 1748 wrote to memory of 844	1748	cmd.exe	bcdedit.exe
PID 1748 wrote to memory of 844	1748	cmd.exe	bcdedit.exe
PID 1748 wrote to memory of 844	1748	cmd.exe	bcdedit.exe
PID 1748 wrote to memory of 1792	1748	cmd.exe	wbadmin.exe
PID 1748 wrote to memory of 1792	1748	cmd.exe	wbadmin.exe
PID 1748 wrote to memory of 1792	1748	cmd.exe	wbadmin.exe

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Fast.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe"	Fast.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe"	Fast.exe

Deletes system backup catalog 2 TTPs
Ransomware often tries to delete backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

820 NOTEPAD.EXE
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
820	NOTEPAD.EXE

Modifies service 2 TTPs 15 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exenetsh.exenetsh.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI	netsh.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Suspicious behavior: EnumeratesProcesses 280 IoCs

Processes:

Fast.exe

pid	process
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

mshta.exemshta.exemshta.exe

pid process

1296 mshta.exe
776 mshta.exe
1932 mshta.exe
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1612 vssadmin.exe
1764 vssadmin.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

1220 bcdedit.exe
2040 bcdedit.exe
364 bcdedit.exe
844 bcdedit.exe
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

2044 wbadmin.exe
1792 wbadmin.exe

pid	process
1296	mshta.exe
776	mshta.exe
1932	mshta.exe

pid	process
1612	vssadmin.exe
1764	vssadmin.exe

pid	process
1220	bcdedit.exe
2040	bcdedit.exe
364	bcdedit.exe
844	bcdedit.exe

pid	process
2044	wbadmin.exe
1792	wbadmin.exe

Drops startup file 3 IoCs

Processes:

Fast.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\Fast.exe	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Fast.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[29726EB9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos

Drops desktop.ini file(s) 77 IoCs

Processes:

Fast.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	Fast.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GVV7BJHB\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1MJ70CPH\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	Fast.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V8SX06NR\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	Fast.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	Fast.exe
File opened for modification	C:\Program Files\desktop.ini	Fast.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	Fast.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

C:\Users\Admin\AppData\Local\Temp\Fast.exe
"C:\Users\Admin\AppData\Local\Temp\Fast.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
- Drops desktop.ini file(s)
PID:240

C:\Users\Admin\AppData\Local\Temp\Fast.exe
"C:\Users\Admin\AppData\Local\Temp\Fast.exe"
2⤵
PID:1620

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
3⤵
- Modifies service
PID:1772

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
3⤵
- Modifies service
PID:1304

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1764

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:1220

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:2040

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:2044

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"
2⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
PID:1296

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"
2⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
PID:1932

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"
2⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
PID:776

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1612

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:364

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:844

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:1792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1880

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1180

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\info.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:820