Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 13:52
Static task
static1
Behavioral task
behavioral1
Sample
Fast.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Fast.exe
Resource
win10v200430
General
-
Target
Fast.exe
-
Size
55KB
-
MD5
4a3762d49120264f48deb29ca8668082
-
SHA1
4ed52a74441ed443c09d51b625d07cded9e2ba08
-
SHA256
b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3
-
SHA512
dcbe5bb3f9cd2bbdacd0a2fad7728d7a78e07950e6cd8423bcd10f2c698e81b80fa9f8582af0925cae9a4c3c08c786ac38b07068a61a6b97d82a3f408a6b8f39
Malware Config
Extracted
\??\c:\users\admin\desktop\info.txt
https://icq.com/windows/
https://icq.im/VIRTUALHORSE
Extracted
C:\info.hta
https://icq.com/windows/
https://icq.im/VIRTUALHORSE
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 3768 created 3724 3768 svchost.exe Fast.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 3076 bcdedit.exe 756 bcdedit.exe 3468 bcdedit.exe 2208 bcdedit.exe -
Processes:
wbadmin.exewbadmin.exepid process 3020 wbadmin.exe 1908 wbadmin.exe -
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Fast.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\CompressRestart.tiff Fast.exe File opened for modification C:\Users\Admin\Pictures\BackupUnlock.tiff Fast.exe -
Drops startup file 3 IoCs
Processes:
Fast.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\Fast.exe Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Fast.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Fast.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe" Fast.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe" Fast.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
Fast.exedescription ioc process File opened for modification C:\Users\Admin\Documents\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Music\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Fast.exe File opened for modification C:\Program Files (x86)\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Fast.exe File opened for modification C:\Users\Public\desktop.ini Fast.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1231583446-2617009595-2137880041-1000\desktop.ini Fast.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini Fast.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Fast.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Links\desktop.ini Fast.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Fast.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini Fast.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Fast.exe File opened for modification C:\Users\Public\Music\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Fast.exe File opened for modification C:\Users\Public\Documents\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Fast.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Fast.exe File opened for modification C:\Users\Public\Videos\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Fast.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Fast.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-125.png Fast.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\ui-strings.js Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-200_contrast-white.png Fast.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe Fast.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\Snooze.scale-80.png Fast.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_RHP.aapp.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\music_empty_state_lifestyle.jpg Fast.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PersonPicture.UAP.dll Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\LargeTile.scale-200.png Fast.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon.png Fast.exe File created C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_MouseNose.png Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\2_32x32x32.png Fast.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\81.0.4044.129\Locales\bg.pak Fast.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.smile.scale-150.png Fast.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Fast.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\ui-strings.js.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\AppStore_icon.svg Fast.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\western_13s.png Fast.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\WINGDNG2.TTF.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-200.png Fast.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\PesterThrow.ps1 Fast.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms Fast.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\hyph_en_GB.dic.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt Fast.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html Fast.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tiles\pyramid.jpg Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\Images\moji_mask.contrast-black.png Fast.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaBrightRegular.ttf Fast.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe Fast.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms Fast.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui Fast.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\affDescription.txt Fast.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\tg_60x42.png Fast.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-125.png Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-256_altform-unplated.png Fast.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons_retina.png.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\classic_cardback.png Fast.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll Fast.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml Fast.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll Fast.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll.id[E79A80BD-2797].[ICQ@VIRTUALHORSE].eight Fast.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-30.png Fast.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\PSReadline.psd1 Fast.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\by_60x42.png Fast.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1851_40x40x32.png Fast.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vds.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 vds.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1568 vssadmin.exe 1020 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
Fast.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings Fast.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Fast.exepid process 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe 3724 Fast.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exeFast.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeTcbPrivilege 3768 svchost.exe Token: SeTcbPrivilege 3768 svchost.exe Token: SeDebugPrivilege 3724 Fast.exe Token: SeBackupPrivilege 1884 vssvc.exe Token: SeRestorePrivilege 1884 vssvc.exe Token: SeAuditPrivilege 1884 vssvc.exe Token: SeIncreaseQuotaPrivilege 3932 WMIC.exe Token: SeSecurityPrivilege 3932 WMIC.exe Token: SeTakeOwnershipPrivilege 3932 WMIC.exe Token: SeLoadDriverPrivilege 3932 WMIC.exe Token: SeSystemProfilePrivilege 3932 WMIC.exe Token: SeSystemtimePrivilege 3932 WMIC.exe Token: SeProfSingleProcessPrivilege 3932 WMIC.exe Token: SeIncBasePriorityPrivilege 3932 WMIC.exe Token: SeCreatePagefilePrivilege 3932 WMIC.exe Token: SeBackupPrivilege 3932 WMIC.exe Token: SeRestorePrivilege 3932 WMIC.exe Token: SeShutdownPrivilege 3932 WMIC.exe Token: SeDebugPrivilege 3932 WMIC.exe Token: SeSystemEnvironmentPrivilege 3932 WMIC.exe Token: SeRemoteShutdownPrivilege 3932 WMIC.exe Token: SeUndockPrivilege 3932 WMIC.exe Token: SeManageVolumePrivilege 3932 WMIC.exe Token: 33 3932 WMIC.exe Token: 34 3932 WMIC.exe Token: 35 3932 WMIC.exe Token: 36 3932 WMIC.exe Token: SeIncreaseQuotaPrivilege 3932 WMIC.exe Token: SeSecurityPrivilege 3932 WMIC.exe Token: SeTakeOwnershipPrivilege 3932 WMIC.exe Token: SeLoadDriverPrivilege 3932 WMIC.exe Token: SeSystemProfilePrivilege 3932 WMIC.exe Token: SeSystemtimePrivilege 3932 WMIC.exe Token: SeProfSingleProcessPrivilege 3932 WMIC.exe Token: SeIncBasePriorityPrivilege 3932 WMIC.exe Token: SeCreatePagefilePrivilege 3932 WMIC.exe Token: SeBackupPrivilege 3932 WMIC.exe Token: SeRestorePrivilege 3932 WMIC.exe Token: SeShutdownPrivilege 3932 WMIC.exe Token: SeDebugPrivilege 3932 WMIC.exe Token: SeSystemEnvironmentPrivilege 3932 WMIC.exe Token: SeRemoteShutdownPrivilege 3932 WMIC.exe Token: SeUndockPrivilege 3932 WMIC.exe Token: SeManageVolumePrivilege 3932 WMIC.exe Token: 33 3932 WMIC.exe Token: 34 3932 WMIC.exe Token: 35 3932 WMIC.exe Token: 36 3932 WMIC.exe Token: SeBackupPrivilege 2332 wbengine.exe Token: SeRestorePrivilege 2332 wbengine.exe Token: SeSecurityPrivilege 2332 wbengine.exe Token: SeIncreaseQuotaPrivilege 3684 WMIC.exe Token: SeSecurityPrivilege 3684 WMIC.exe Token: SeTakeOwnershipPrivilege 3684 WMIC.exe Token: SeLoadDriverPrivilege 3684 WMIC.exe Token: SeSystemProfilePrivilege 3684 WMIC.exe Token: SeSystemtimePrivilege 3684 WMIC.exe Token: SeProfSingleProcessPrivilege 3684 WMIC.exe Token: SeIncBasePriorityPrivilege 3684 WMIC.exe Token: SeCreatePagefilePrivilege 3684 WMIC.exe Token: SeBackupPrivilege 3684 WMIC.exe Token: SeRestorePrivilege 3684 WMIC.exe Token: SeShutdownPrivilege 3684 WMIC.exe Token: SeDebugPrivilege 3684 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
svchost.exeFast.execmd.execmd.execmd.exedescription pid process target process PID 3768 wrote to memory of 504 3768 svchost.exe Fast.exe PID 3768 wrote to memory of 504 3768 svchost.exe Fast.exe PID 3768 wrote to memory of 504 3768 svchost.exe Fast.exe PID 3724 wrote to memory of 732 3724 Fast.exe cmd.exe PID 3724 wrote to memory of 732 3724 Fast.exe cmd.exe PID 3724 wrote to memory of 692 3724 Fast.exe cmd.exe PID 3724 wrote to memory of 692 3724 Fast.exe cmd.exe PID 732 wrote to memory of 1468 732 cmd.exe netsh.exe PID 732 wrote to memory of 1468 732 cmd.exe netsh.exe PID 692 wrote to memory of 1568 692 cmd.exe vssadmin.exe PID 692 wrote to memory of 1568 692 cmd.exe vssadmin.exe PID 732 wrote to memory of 2116 732 cmd.exe netsh.exe PID 732 wrote to memory of 2116 732 cmd.exe netsh.exe PID 692 wrote to memory of 3932 692 cmd.exe WMIC.exe PID 692 wrote to memory of 3932 692 cmd.exe WMIC.exe PID 692 wrote to memory of 3076 692 cmd.exe bcdedit.exe PID 692 wrote to memory of 3076 692 cmd.exe bcdedit.exe PID 692 wrote to memory of 756 692 cmd.exe bcdedit.exe PID 692 wrote to memory of 756 692 cmd.exe bcdedit.exe PID 692 wrote to memory of 3020 692 cmd.exe wbadmin.exe PID 692 wrote to memory of 3020 692 cmd.exe wbadmin.exe PID 3724 wrote to memory of 2416 3724 Fast.exe mshta.exe PID 3724 wrote to memory of 2416 3724 Fast.exe mshta.exe PID 3724 wrote to memory of 2416 3724 Fast.exe mshta.exe PID 3724 wrote to memory of 3744 3724 Fast.exe mshta.exe PID 3724 wrote to memory of 3744 3724 Fast.exe mshta.exe PID 3724 wrote to memory of 3744 3724 Fast.exe mshta.exe PID 3724 wrote to memory of 3448 3724 Fast.exe mshta.exe PID 3724 wrote to memory of 3448 3724 Fast.exe mshta.exe PID 3724 wrote to memory of 3448 3724 Fast.exe mshta.exe PID 3724 wrote to memory of 2884 3724 Fast.exe cmd.exe PID 3724 wrote to memory of 2884 3724 Fast.exe cmd.exe PID 2884 wrote to memory of 1020 2884 cmd.exe vssadmin.exe PID 2884 wrote to memory of 1020 2884 cmd.exe vssadmin.exe PID 2884 wrote to memory of 3684 2884 cmd.exe WMIC.exe PID 2884 wrote to memory of 3684 2884 cmd.exe WMIC.exe PID 2884 wrote to memory of 3468 2884 cmd.exe bcdedit.exe PID 2884 wrote to memory of 3468 2884 cmd.exe bcdedit.exe PID 2884 wrote to memory of 2208 2884 cmd.exe bcdedit.exe PID 2884 wrote to memory of 2208 2884 cmd.exe bcdedit.exe PID 2884 wrote to memory of 1908 2884 cmd.exe wbadmin.exe PID 2884 wrote to memory of 1908 2884 cmd.exe wbadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fast.exe"C:\Users\Admin\AppData\Local\Temp\Fast.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fast.exe"C:\Users\Admin\AppData\Local\Temp\Fast.exe"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\info.htaMD5
ad113b538ed6f73b3ec2cec4b0497951
SHA1fb2ed053e9406adbfa10566ade5e154d80df31a8
SHA256f1affee5a4b419f01b8cdbb28fbfcbefad68e87f869328dacbe805b7c977bd6c
SHA512b343e82fce15a27fd3e6fd272cec1dd02c91d5048220bd24d7dc707fff22790c5c03b32eb693903fe9b940818fae1675e4a295a7b86a6e2a2f3af1d819dec10d
-
C:\info.htaMD5
ad113b538ed6f73b3ec2cec4b0497951
SHA1fb2ed053e9406adbfa10566ade5e154d80df31a8
SHA256f1affee5a4b419f01b8cdbb28fbfcbefad68e87f869328dacbe805b7c977bd6c
SHA512b343e82fce15a27fd3e6fd272cec1dd02c91d5048220bd24d7dc707fff22790c5c03b32eb693903fe9b940818fae1675e4a295a7b86a6e2a2f3af1d819dec10d
-
C:\users\public\desktop\info.htaMD5
ad113b538ed6f73b3ec2cec4b0497951
SHA1fb2ed053e9406adbfa10566ade5e154d80df31a8
SHA256f1affee5a4b419f01b8cdbb28fbfcbefad68e87f869328dacbe805b7c977bd6c
SHA512b343e82fce15a27fd3e6fd272cec1dd02c91d5048220bd24d7dc707fff22790c5c03b32eb693903fe9b940818fae1675e4a295a7b86a6e2a2f3af1d819dec10d
-
memory/504-0-0x0000000000000000-mapping.dmp
-
memory/692-2-0x0000000000000000-mapping.dmp
-
memory/732-1-0x0000000000000000-mapping.dmp
-
memory/756-13-0x0000000000000000-mapping.dmp
-
memory/1020-28-0x0000000000000000-mapping.dmp
-
memory/1468-5-0x0000000000000000-mapping.dmp
-
memory/1568-6-0x0000000000000000-mapping.dmp
-
memory/1908-35-0x0000000000000000-mapping.dmp
-
memory/2116-9-0x0000000000000000-mapping.dmp
-
memory/2208-34-0x0000000000000000-mapping.dmp
-
memory/2416-24-0x0000000000000000-mapping.dmp
-
memory/2884-27-0x0000000000000000-mapping.dmp
-
memory/3020-14-0x0000000000000000-mapping.dmp
-
memory/3076-12-0x0000000000000000-mapping.dmp
-
memory/3448-26-0x0000000000000000-mapping.dmp
-
memory/3468-33-0x0000000000000000-mapping.dmp
-
memory/3684-29-0x0000000000000000-mapping.dmp
-
memory/3744-25-0x0000000000000000-mapping.dmp
-
memory/3932-11-0x0000000000000000-mapping.dmp