054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9

Analysis

max time kernel
104s
max time network
110s
platform
windows10_x64
resource
win10
submitted
23/09/2020, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Size

1.3MB
MD5

f4c92c5896d92368dab37f277f74220a
SHA1

e5763d7e58f39b9f2130abcfadaa34e5e46b04a9
SHA256

054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9
SHA512

99d06cd0288d892c1e018439e75a5f62ad909a1a6d35de4101a1fa99d55ea3c34685857e39cc385f9aedd0d4f027dc3592d1605919b91bc0a44ea8126343b0e5

Score

10^/10

evasion persistence ransomware spyware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Visio\Recover files.hta

Ransom Note

Your personal ID ☣Your files are encrypted!☣ ⬇ To decrypt, follow the instructions below.⬇ To recover data you need decrypt tool. To get the decrypt tool you should: Send 3 crypted test image or text file or document to [email protected] Or alternate mail [email protected] In the letter include your personal ID (look at the beginning of this document). Send me this ID in your first email to me. We will give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files. After we send you instruction how to pay for decrypt tool and after payment you will receive a decrypt tool and instructions how to use it We can decrypt few files in quality the evidence that we have the decoder. MOST IMPORTANT!!! Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services. No one, except [email protected] ([email protected]), will decrypt your files. Only [email protected] ([email protected]) can decrypt your files Do not trust anyone besides [email protected] ([email protected]) Antivirus programs can delete this document and you can not contact us later. Attempts to self-decrypting files will result in the loss of your data Decoders other users are not compatible with your data, because each user's unique encryption key

Emails

[email protected]

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	3840	mshta.exe
9	784	mshta.exe

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ClearOptimize.tif => C:\Users\Admin\Pictures\ClearOptimize.tif.CRPTD	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File renamed	C:\Users\Admin\Pictures\JoinResume.tiff => C:\Users\Admin\Pictures\JoinResume.tiff.CRPTD	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File renamed	C:\Users\Admin\Pictures\SearchConvertFrom.tif => C:\Users\Admin\Pictures\SearchConvertFrom.tif.CRPTD	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Pictures\JoinResume.tiff	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File renamed	C:\Users\Admin\Pictures\LockSubmit.tiff => C:\Users\Admin\Pictures\LockSubmit.tiff.CRPTD	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File renamed	C:\Users\Admin\Pictures\BlockClose.png => C:\Users\Admin\Pictures\BlockClose.png.CRPTD	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertFromSkip.tiff	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromSkip.tiff => C:\Users\Admin\Pictures\ConvertFromSkip.tiff.CRPTD	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File renamed	C:\Users\Admin\Pictures\InvokeStep.tif => C:\Users\Admin\Pictures\InvokeStep.tif.CRPTD	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Pictures\LockSubmit.tiff	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Readme_c = "C:\\\\readme.bat"	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe"	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Readme = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Visio\\readme.bat"	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Readme_c = "C:\\\\readme.bat"	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe"	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Readme = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Visio\\readme.bat"	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe

Drops desktop.ini file(s) 30 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Public\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2066881839-3229799743-3576549721-1000\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ExcelServices.dll	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tr.gif	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\invalid32x32.gif	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\mobile_scan_logo.svg	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_field_grabber.png	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\t2k.dll	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\ui-strings.js	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-tool-view.js	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\oregres.dll	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages.properties	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\security\US_export_policy.jar	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\management-agent.jar	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\S_ThumbDownOutline_22_N1.svg	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\PREVIEW.GIF	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_2x.png	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\ui-strings.js	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\ui-strings.js	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\s_agreement_filetype.svg	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSJHBD.TTC	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\Recover files.hta	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\sat_logo_2x.png	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\packager.jar	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Interacts with shadow copies 2 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
3052	vssadmin.exe
2084	vssadmin.exe
292	vssadmin.exe
1316	vssadmin.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
2356	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
2356	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	3240	vssvc.exe
Token: SeRestorePrivilege	3240	vssvc.exe
Token: SeAuditPrivilege	3240	vssvc.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
Token: SeSecurityPrivilege	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1164	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	75
PID 3920 wrote to memory of 1164	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	75
PID 3920 wrote to memory of 1164	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	75
PID 3920 wrote to memory of 1536	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	77
PID 3920 wrote to memory of 1536	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	77
PID 3920 wrote to memory of 1536	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	77
PID 1536 wrote to memory of 1904	1536	net.exe	79
PID 1536 wrote to memory of 1904	1536	net.exe	79
PID 1536 wrote to memory of 1904	1536	net.exe	79
PID 3920 wrote to memory of 2088	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	80
PID 3920 wrote to memory of 2088	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	80
PID 3920 wrote to memory of 2088	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	80
PID 2088 wrote to memory of 2364	2088	net.exe	82
PID 2088 wrote to memory of 2364	2088	net.exe	82
PID 2088 wrote to memory of 2364	2088	net.exe	82
PID 3920 wrote to memory of 2672	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	83
PID 3920 wrote to memory of 2672	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	83
PID 3920 wrote to memory of 2672	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	83
PID 3920 wrote to memory of 2772	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	84
PID 3920 wrote to memory of 2772	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	84
PID 3920 wrote to memory of 2772	3920	054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe	84
PID 2772 wrote to memory of 292	2772	cmd.exe	86
PID 2772 wrote to memory of 292	2772	cmd.exe	86
PID 2772 wrote to memory of 292	2772	cmd.exe	86
PID 2772 wrote to memory of 3516	2772	cmd.exe	88
PID 2772 wrote to memory of 3516	2772	cmd.exe	88
PID 2772 wrote to memory of 3516	2772	cmd.exe	88
PID 2772 wrote to memory of 1208	2772	cmd.exe	89
PID 2772 wrote to memory of 1208	2772	cmd.exe	89
PID 2772 wrote to memory of 1208	2772	cmd.exe	89
PID 2772 wrote to memory of 2268	2772	cmd.exe	90
PID 2772 wrote to memory of 2268	2772	cmd.exe	90
PID 2772 wrote to memory of 2268	2772	cmd.exe	90
PID 2772 wrote to memory of 3928	2772	cmd.exe	91
PID 2772 wrote to memory of 3928	2772	cmd.exe	91
PID 2772 wrote to memory of 3928	2772	cmd.exe	91
PID 2772 wrote to memory of 3792	2772	cmd.exe	92
PID 2772 wrote to memory of 3792	2772	cmd.exe	92
PID 2772 wrote to memory of 3792	2772	cmd.exe	92
PID 2772 wrote to memory of 3856	2772	cmd.exe	93
PID 2772 wrote to memory of 3856	2772	cmd.exe	93
PID 2772 wrote to memory of 3856	2772	cmd.exe	93
PID 2772 wrote to memory of 1304	2772	cmd.exe	94
PID 2772 wrote to memory of 1304	2772	cmd.exe	94
PID 2772 wrote to memory of 1304	2772	cmd.exe	94
PID 2772 wrote to memory of 1532	2772	cmd.exe	95
PID 2772 wrote to memory of 1532	2772	cmd.exe	95
PID 2772 wrote to memory of 1532	2772	cmd.exe	95
PID 2772 wrote to memory of 1308	2772	cmd.exe	96
PID 2772 wrote to memory of 1308	2772	cmd.exe	96
PID 2772 wrote to memory of 1308	2772	cmd.exe	96
PID 2772 wrote to memory of 948	2772	cmd.exe	97
PID 2772 wrote to memory of 948	2772	cmd.exe	97
PID 2772 wrote to memory of 948	2772	cmd.exe	97
PID 2772 wrote to memory of 1684	2772	cmd.exe	98
PID 2772 wrote to memory of 1684	2772	cmd.exe	98
PID 2772 wrote to memory of 1684	2772	cmd.exe	98
PID 2772 wrote to memory of 2100	2772	cmd.exe	99
PID 2772 wrote to memory of 2100	2772	cmd.exe	99
PID 2772 wrote to memory of 2100	2772	cmd.exe	99
PID 2772 wrote to memory of 1732	2772	cmd.exe	100
PID 2772 wrote to memory of 1732	2772	cmd.exe	100
PID 2772 wrote to memory of 1732	2772	cmd.exe	100
PID 2772 wrote to memory of 2608	2772	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
"C:\Users\Admin\AppData\Local\Temp\054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\net.exe
  "net" use
  2⤵
  PID:1164
- C:\Windows\SysWOW64\net.exe
  "net" user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:1904
- C:\Windows\SysWOW64\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2364
- C:\Users\Admin\AppData\Local\Temp\054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe" 1
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\net.exe
    "net" use
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\net.exe
    "net" user
    3⤵
    PID:3112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:3444
- - C:\Windows\SysWOW64\net.exe
    "net" session
    3⤵
    PID:3860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4076
- - C:\Users\Admin\AppData\Local\Temp\054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe
    C:\Users\Admin\AppData\Local\Temp\054ce01f56fced98721576017754aa60fb81309babaab7bf53aaec39d2c1fbc9.bin.exe 1
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2356
  - - C:\Windows\SysWOW64\net.exe
      "net" use
      4⤵
      PID:4004
  - - C:\Windows\SysWOW64\net.exe
      "net" user
      4⤵
      PID:2332
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:3248
  - - C:\Windows\SysWOW64\net.exe
      "net" session
      4⤵
      PID:2248
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:376
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /C C:\Users\Admin\AppData\Roaming\Microsoft\Visio\start.bat
      4⤵
      PID:804
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:1316
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config browser
        5⤵
        
        PID:2340
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config browser start=enabled
        5⤵
        
        PID:2256
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop vss
        5⤵
        
        PID:1092
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config vss start=disabled
        5⤵
        
        PID:2140
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop MongoDB
        5⤵
        
        PID:2196
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config MongoDB start=disabled
        5⤵
        
        PID:3044
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop SQLWriter
        5⤵
        
        PID:3244
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config SQLWriter start=disabled
        5⤵
        
        PID:888
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop MSSQLServerOLAPService
        5⤵
        
        PID:2180
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config MSSQLServerOLAPService start=disabled
        5⤵
        
        PID:2756
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop MSSQLSERVER
        5⤵
        
        PID:1504
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config MSSQLSERVER start=disabled
        5⤵
        
        PID:3780
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop MSSQL$SQLEXPRESS
        5⤵
        
        PID:4008
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config MSSQL$SQLEXPRESS start=disabled
        5⤵
        
        PID:3924
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop ReportServer
        5⤵
        
        PID:4012
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config ReportServer start=disabled
        5⤵
        
        PID:2212
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop OracleServiceORCL
        5⤵
        
        PID:1232
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config OracleServiceORCL start=disabled
        5⤵
        
        PID:360
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop OracleDBConsoleorcl
        5⤵
        
        PID:892
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config OracleDBConsoleorcl start=disabled
        5⤵
        
        PID:408
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop OracleMTSRecoveryService
        5⤵
        
        PID:3776
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config OracleMTSRecoveryService start=disabled
        5⤵
        
        PID:1108
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop OracleVssWriterORCL
        5⤵
        
        PID:3896
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config OracleVssWriterORCL start=disabled
        5⤵
        
        PID:3940
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop MySQL
        5⤵
        
        PID:2192
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config MySQL start=disabled
        5⤵
        
        PID:848
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /C C:\Users\Admin\AppData\Roaming\Microsoft\Visio\start_after.bat
      4⤵
      PID:2612
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:3052
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
        5⤵
        
        PID:2244
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
        5⤵
        
        PID:3892
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
        5⤵
        
        PID:1564
  - - C:\Windows\SysWOW64\mshta.exe
      "mshta" "C:\Users\Admin\AppData\Roaming\Microsoft\Visio/Recover files.hta"
      4⤵
      Blocklisted process makes network request
      PID:3840
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Roaming\Microsoft\Visio\start.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:292
- - C:\Windows\SysWOW64\sc.exe
    sc config browser
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\sc.exe
    sc config browser start=enabled
    3⤵
    PID:1208
- - C:\Windows\SysWOW64\sc.exe
    sc stop vss
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\sc.exe
    sc config vss start=disabled
    3⤵
    PID:3928
- - C:\Windows\SysWOW64\sc.exe
    sc stop MongoDB
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\sc.exe
    sc config MongoDB start=disabled
    3⤵
    PID:3856
- - C:\Windows\SysWOW64\sc.exe
    sc stop SQLWriter
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\sc.exe
    sc config SQLWriter start=disabled
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\sc.exe
    sc stop MSSQLServerOLAPService
    3⤵
    PID:1308
- - C:\Windows\SysWOW64\sc.exe
    sc config MSSQLServerOLAPService start=disabled
    3⤵
    PID:948
- - C:\Windows\SysWOW64\sc.exe
    sc stop MSSQLSERVER
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\sc.exe
    sc config MSSQLSERVER start=disabled
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\sc.exe
    sc stop MSSQL$SQLEXPRESS
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc config MSSQL$SQLEXPRESS start=disabled
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\sc.exe
    sc stop ReportServer
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\sc.exe
    sc config ReportServer start=disabled
    3⤵
    PID:2152
- - C:\Windows\SysWOW64\sc.exe
    sc stop OracleServiceORCL
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\sc.exe
    sc config OracleServiceORCL start=disabled
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\sc.exe
    sc stop OracleDBConsoleorcl
    3⤵
    PID:3512
- - C:\Windows\SysWOW64\sc.exe
    sc config OracleDBConsoleorcl start=disabled
    3⤵
    PID:1216
- - C:\Windows\SysWOW64\sc.exe
    sc stop OracleMTSRecoveryService
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\sc.exe
    sc config OracleMTSRecoveryService start=disabled
    3⤵
    PID:4044
- - C:\Windows\SysWOW64\sc.exe
    sc stop OracleVssWriterORCL
    3⤵
    PID:3904
- - C:\Windows\SysWOW64\sc.exe
    sc config OracleVssWriterORCL start=disabled
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\sc.exe
    sc stop MySQL
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\sc.exe
    sc config MySQL start=disabled
    3⤵
    PID:1336
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Roaming\Microsoft\Visio\start_after.bat
  2⤵
  PID:3796
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2084
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
    3⤵
    PID:1656
- C:\Windows\SysWOW64\mshta.exe
  "mshta" "C:\Users\Admin\AppData\Roaming\Microsoft\Visio/Recover files.hta"
  2⤵
  - Blocklisted process makes network request
  PID:784

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2356-44-0x00000000013C0000-0x000000000150E000-memory.dmp

Filesize
1.3MB

Download
memory/2672-8-0x00000000013C0000-0x000000000150E000-memory.dmp

Filesize
1.3MB

Download
memory/3920-0-0x00000000013C0000-0x000000000150E000-memory.dmp

Filesize
1.3MB

Download