avaddon | 0ba5efbb88dd3a6cf12923ed9f6abe16431e839cf0d0beebc3e2e0cdf1a6af5a

Analysis

max time kernel
150s
max time network
143s
platform
windows10_x64
resource
win10
submitted
28-10-2020 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b76e77b52d682f0938d120f3fe011660.exe
Size

68KB
MD5

b76e77b52d682f0938d120f3fe011660
SHA1

c1fdc71284b5a34b170470a6071626f40f4a4f65
SHA256

0ba5efbb88dd3a6cf12923ed9f6abe16431e839cf0d0beebc3e2e0cdf1a6af5a
SHA512

5547b31fd4635d81e8ea4d426c0133f291b0a1caa3237efb21f849fe71d2d504bf59a1d25e3a20265e6a6f8ce108e6adda47f66eed2c64ecfa96c593efb80177

Score

10^/10

avaddon phorphiex evasion loader persistence ransomware trojan worm

Malware Config

Extracted

Path

C:\odt\8xHXy_readme_.txt

Ransom Note

-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .baDcdcdEdc You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NzMwLUhqK0o5SEg0RGM5TFNkdWN1ZjlCWDgyeU9RbERTY0R6TVRJaWRJbUgyZUt1clcyMUhhVWdBWU0vMnpXdW4xa01kc2xWYmdDNkRYYkplYjg4SUlmbVBWQUtUM29OYlhiZHpabXhVOWtUOEMzeXBNRkxlVlA1SllkN3RpZVBxUSt2MUdkU0J4K3NUS2QxdHFrdEZkSkU0KzR2NldueXVZY01MaWRya2xQbDN2UWpKR244dktjcVRDMENnYlBrWmtWa2xqR1pWTkFoMG5vSEsyRlRNek1EZHp1KzREaUZTeUl6QllLSlozQnliNGIvQUdzUXRmYVhLQ3V1T1NiRytvbWtLZU1HSUpPNXU4RWt0cytOcFlYV1VVZlZkYkNOSHdMd1NjS1BodVJialhTZHgvSDNJWlZUSkNFQ1lKTXNaRnF0TmJJS3p0NitsdUYvcEZGZEJQYkR1elNRUC9pUWU4eXVOQmFrMEJiTG1EblFOZGRhRTVlaEFlQUc0UkdzSkxXMlBTeDM4Q0xKei9BSFZsSmY3b1ZBdWN3ajRmTGJQWk9hS0hNVVFCazRlRmZUc0poL0tCVjZGeW51Smx4WmNCeE95N2xVR21ZbHZaRGVKbjU4Z0NkVEFpTWNudWJVSVVtczh2ZjV3ZEFSWUJyS1V6Q2FPbE9hV2hnL1BkcHRaVEVBNlNsbGg0elRXUEZ4Vm9iK09HZHVqTkx0MnJpZ210ekRTUkFOa0V6R21iUzFYQ25hNUQ3YWlVSGNpSEprMjF6dEYwaC93MGtBUFBGNytzdUFEU3dnaC9CZmdzUU1ndjJtbXk5Z2ttbTRUc0ZaWWFNc2NzNTFLMTREM3JDYjFVZWk4T2ROcDF4UXJDb3VxSVBHeTdWTEY5eExxVllEZ292MVl2QzBZOUE3MVdDYy9LR3hXeU1Fa0owSFpsSVhCRWYrekY4aEV4b21XY1NGRkdhUFVHb3pEYktZUmRGdzRlQzhkZy9IbGREU2luZ0w0N1BNMDFPNm1XYWZYWC83U3BzOVNoVU15N2U4ek5CUjRzUmE0d0dKaW4xbWh5ZzhLSmVoTmg1a1g5dkRjMVM3VlZRdGNLcW9FRFZqNUlvb0Vob1U4VE0xQWYvbkFaR0NxQ1Z4VVBXenpxdjVDeHJRamxEZE9hQkdLeFJBNmJwb2V2TGI4MkRVQzJvdndnZnRGSG1HL2t0UTRIVEJLSXVMbXZReE1DeWw2bFBzWFJZckUxNkNBWkRQK1pRSG5VajVMVHNxb25nT00vZFVVQnNhcEpack5EODBGU3ViRnpQVlhHQzZQbFBKNjltRnBaWE1NZnkzU0xqVC9vSUF1Y2xyUzdob2VhSzlCVFUxYzEvWER1dEJHQmR6RVlyRG9qUkdhRmlHdXQrYkZEOE9Dak1UWGJxWERXeVlQUS9ybko1VXJLN1AyYS95TUYxQUJBb3E2K3BocVNqQS9tRUVOVE9YV1NhQVdFNDcvNCtiZFpWbWgzcFowbnZpQ29yOTVOQjZjOFFLbkJldXFsNkVObGtNbFNjZm8rcUlrczBzbUtMbFVHN2Q4bHFUYjhmOXZDbG92VlVnaHQ2NGtpRzd2ZDEzY2VGSFNJTXUrWDdGdzV1MndMa3FrZ1FJby8xbTlvWEQ5SXUrQit4OGF2Q2ZxYmlsRVF2NnBPSkdRSnZrbTdnZEpobk0xcWJSaERJbC9DM1NyczA2b2UxTjR3OHJselpoWFQzQ1VDbmZmbTQrdXFDdElXZGJTYXV6em8zOTFaNzY1Uk54OHh5L2dEMlB2NzQxV1BycVNrWEZ2YytaWjV0eGhBRnNwRkE1MlBxMGorSUk0R1p6Nk1rV0pCaU52Ylk4QjVqYndrWjZNY3lsb1RKVDBzWGQ4Zk5FUDVONUV2OTkzMHV2bzZVM0lMeDh3WXhQbXdicEZhbER1d2hUYUFVcEZwYnFNS2ZyL1MyTlN0dU9iRG9GZ2w3cEF2b3hiSjFBT3djVGo1RVFRazFuK0YrOEt6bTZjTFpaVE1zVHJvR1M0TXZRdmZkanZ0U3NlVUtCM20rMEZNd0dhdnZORUVDUFFWMDFCMmhiZ1YrdVBBbnJ0TlRiUm02aitMdUpIWjQ9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * LhTk70N0xaqZ0aou9JtOs0u

URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Downloads\8xHXy_readme_.txt

Ransom Note

URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Searches\8xHXy_readme_.txt

Ransom Note

URLs

http://avaddonbotrxmuyl.onion

Signatures

Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
ransomware avaddon

Avaddon Ransomware 4 IoCs

ransomware

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2560128089.exe	avaddon_ransomware
C:\Users\Admin\AppData\Local\Temp\2560128089.exe	avaddon_ransomware
C:\Users\Admin\AppData\Local\Temp\2271737858.exe	avaddon_ransomware
C:\Users\Admin\AppData\Local\Temp\2271737858.exe	avaddon_ransomware

Phorphiex Payload 2 IoCs

Processes:

resource	yara_rule
C:\132732751115422\winsvcs.exe	family_phorphiex
C:\132732751115422\winsvcs.exe	family_phorphiex

Phorphiex Worm
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 3 IoCs

Processes:

winsvcs.exe2560128089.exe2271737858.exe

pid process

3632 winsvcs.exe
200 2560128089.exe
4700 2271737858.exe

pid	process
3632	winsvcs.exe
200	2560128089.exe
4700	2271737858.exe

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

2560128089.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\StepRemove.tiff => C:\Users\Admin\Pictures\StepRemove.tiff.baDcdcdEdc	2560128089.exe
File renamed	C:\Users\Admin\Pictures\SkipEnable.raw => C:\Users\Admin\Pictures\SkipEnable.raw.baDcdcdEdc	2560128089.exe
File opened for modification	C:\Users\Admin\Pictures\UnprotectRename.tiff	2560128089.exe
File renamed	C:\Users\Admin\Pictures\PingCheckpoint.raw => C:\Users\Admin\Pictures\PingCheckpoint.raw.baDcdcdEdc	2560128089.exe
File opened for modification	C:\Users\Admin\Pictures\ResizeUnregister.tiff	2560128089.exe
File renamed	C:\Users\Admin\Pictures\MountPublish.png => C:\Users\Admin\Pictures\MountPublish.png.baDcdcdEdc	2560128089.exe
File opened for modification	C:\Users\Admin\Pictures\StepRemove.tiff	2560128089.exe
File renamed	C:\Users\Admin\Pictures\ResizeUnregister.tiff => C:\Users\Admin\Pictures\ResizeUnregister.tiff.baDcdcdEdc	2560128089.exe
File renamed	C:\Users\Admin\Pictures\CompressRequest.crw => C:\Users\Admin\Pictures\CompressRequest.crw.baDcdcdEdc	2560128089.exe
File renamed	C:\Users\Admin\Pictures\SelectStep.tif => C:\Users\Admin\Pictures\SelectStep.tif.baDcdcdEdc	2560128089.exe
File renamed	C:\Users\Admin\Pictures\UnprotectRename.tiff => C:\Users\Admin\Pictures\UnprotectRename.tiff.baDcdcdEdc	2560128089.exe
File renamed	C:\Users\Admin\Pictures\UseResize.tif => C:\Users\Admin\Pictures\UseResize.tif.baDcdcdEdc	2560128089.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winsvcs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winsvcs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b76e77b52d682f0938d120f3fe011660.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\132732751115422\\winsvcs.exe"	b76e77b52d682f0938d120f3fe011660.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\132732751115422\\winsvcs.exe"	b76e77b52d682f0938d120f3fe011660.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

2560128089.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2560128089.exe
Drops desktop.ini file(s) 1 IoCs

Processes:

2560128089.exe

description ioc process

File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2627584638-3284755310-3019450177-1000\desktop.ini 2560128089.exe

description	ioc	process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-2627584638-3284755310-3019450177-1000\desktop.ini	2560128089.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2560128089.exe

description	ioc	process
File opened (read-only)	\??\I:	2560128089.exe
File opened (read-only)	\??\L:	2560128089.exe
File opened (read-only)	\??\O:	2560128089.exe
File opened (read-only)	\??\Q:	2560128089.exe
File opened (read-only)	\??\S:	2560128089.exe
File opened (read-only)	\??\U:	2560128089.exe
File opened (read-only)	\??\Z:	2560128089.exe
File opened (read-only)	\??\E:	2560128089.exe
File opened (read-only)	\??\B:	2560128089.exe
File opened (read-only)	\??\F:	2560128089.exe
File opened (read-only)	\??\G:	2560128089.exe
File opened (read-only)	\??\K:	2560128089.exe
File opened (read-only)	\??\X:	2560128089.exe
File opened (read-only)	\??\A:	2560128089.exe
File opened (read-only)	\??\V:	2560128089.exe
File opened (read-only)	\??\Y:	2560128089.exe
File opened (read-only)	\??\T:	2560128089.exe
File opened (read-only)	\??\J:	2560128089.exe
File opened (read-only)	\??\M:	2560128089.exe
File opened (read-only)	\??\N:	2560128089.exe
File opened (read-only)	\??\P:	2560128089.exe
File opened (read-only)	\??\R:	2560128089.exe
File opened (read-only)	\??\W:	2560128089.exe
File opened (read-only)	\??\H:	2560128089.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

4500 vssadmin.exe
4552 vssadmin.exe
4628 vssadmin.exe

pid	process
4500	vssadmin.exe
4552	vssadmin.exe
4628	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 630 IoCs

Processes:

2560128089.exe

pid	process
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe
200	2560128089.exe

Suspicious use of AdjustPrivilegeToken 66 IoCs

Processes:

WMIC.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1960	WMIC.exe
Token: SeSecurityPrivilege	1960	WMIC.exe
Token: SeTakeOwnershipPrivilege	1960	WMIC.exe
Token: SeLoadDriverPrivilege	1960	WMIC.exe
Token: SeSystemProfilePrivilege	1960	WMIC.exe
Token: SeSystemtimePrivilege	1960	WMIC.exe
Token: SeProfSingleProcessPrivilege	1960	WMIC.exe
Token: SeIncBasePriorityPrivilege	1960	WMIC.exe
Token: SeCreatePagefilePrivilege	1960	WMIC.exe
Token: SeBackupPrivilege	1960	WMIC.exe
Token: SeRestorePrivilege	1960	WMIC.exe
Token: SeShutdownPrivilege	1960	WMIC.exe
Token: SeDebugPrivilege	1960	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1960	WMIC.exe
Token: SeRemoteShutdownPrivilege	1960	WMIC.exe
Token: SeUndockPrivilege	1960	WMIC.exe
Token: SeManageVolumePrivilege	1960	WMIC.exe
Token: 33	1960	WMIC.exe
Token: 34	1960	WMIC.exe
Token: 35	1960	WMIC.exe
Token: 36	1960	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4368	WMIC.exe
Token: SeSecurityPrivilege	4368	WMIC.exe
Token: SeTakeOwnershipPrivilege	4368	WMIC.exe
Token: SeLoadDriverPrivilege	4368	WMIC.exe
Token: SeSystemProfilePrivilege	4368	WMIC.exe
Token: SeSystemtimePrivilege	4368	WMIC.exe
Token: SeProfSingleProcessPrivilege	4368	WMIC.exe
Token: SeIncBasePriorityPrivilege	4368	WMIC.exe
Token: SeCreatePagefilePrivilege	4368	WMIC.exe
Token: SeBackupPrivilege	4368	WMIC.exe
Token: SeRestorePrivilege	4368	WMIC.exe
Token: SeShutdownPrivilege	4368	WMIC.exe
Token: SeDebugPrivilege	4368	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4368	WMIC.exe
Token: SeRemoteShutdownPrivilege	4368	WMIC.exe
Token: SeUndockPrivilege	4368	WMIC.exe
Token: SeManageVolumePrivilege	4368	WMIC.exe
Token: 33	4368	WMIC.exe
Token: 34	4368	WMIC.exe
Token: 35	4368	WMIC.exe
Token: 36	4368	WMIC.exe
Token: SeBackupPrivilege	4576	vssvc.exe
Token: SeRestorePrivilege	4576	vssvc.exe
Token: SeAuditPrivilege	4576	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4544	WMIC.exe
Token: SeSecurityPrivilege	4544	WMIC.exe
Token: SeTakeOwnershipPrivilege	4544	WMIC.exe
Token: SeLoadDriverPrivilege	4544	WMIC.exe
Token: SeSystemProfilePrivilege	4544	WMIC.exe
Token: SeSystemtimePrivilege	4544	WMIC.exe
Token: SeProfSingleProcessPrivilege	4544	WMIC.exe
Token: SeIncBasePriorityPrivilege	4544	WMIC.exe
Token: SeCreatePagefilePrivilege	4544	WMIC.exe
Token: SeBackupPrivilege	4544	WMIC.exe
Token: SeRestorePrivilege	4544	WMIC.exe
Token: SeShutdownPrivilege	4544	WMIC.exe
Token: SeDebugPrivilege	4544	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4544	WMIC.exe
Token: SeRemoteShutdownPrivilege	4544	WMIC.exe
Token: SeUndockPrivilege	4544	WMIC.exe
Token: SeManageVolumePrivilege	4544	WMIC.exe
Token: 33	4544	WMIC.exe
Token: 34	4544	WMIC.exe

Suspicious use of WriteProcessMemory 81 IoCs

Processes:

b76e77b52d682f0938d120f3fe011660.exewinsvcs.exe2560128089.execmd.execmd.exe

description	pid	process	target process
PID 3524 wrote to memory of 3632	3524	b76e77b52d682f0938d120f3fe011660.exe	winsvcs.exe
PID 3524 wrote to memory of 3632	3524	b76e77b52d682f0938d120f3fe011660.exe	winsvcs.exe
PID 3524 wrote to memory of 3632	3524	b76e77b52d682f0938d120f3fe011660.exe	winsvcs.exe
PID 3632 wrote to memory of 200	3632	winsvcs.exe	2560128089.exe
PID 3632 wrote to memory of 200	3632	winsvcs.exe	2560128089.exe
PID 3632 wrote to memory of 200	3632	winsvcs.exe	2560128089.exe
PID 200 wrote to memory of 8	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 8	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 8	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 2080	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 2080	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 2080	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3304	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3304	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3304	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 1904	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 1904	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 1904	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 2792	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 2792	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 2792	200	2560128089.exe	cmd.exe
PID 8 wrote to memory of 1960	8	cmd.exe	WMIC.exe
PID 8 wrote to memory of 1960	8	cmd.exe	WMIC.exe
PID 8 wrote to memory of 1960	8	cmd.exe	WMIC.exe
PID 200 wrote to memory of 1864	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 1864	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 1864	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 496	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 496	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 496	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3068	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3068	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3068	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 208	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 208	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 208	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 2544	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 2544	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 2544	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3880	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3880	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3880	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3948	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3948	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3948	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3460	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3460	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 3460	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4144	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4144	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4144	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4192	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4192	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4192	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4244	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4244	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4244	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4292	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4292	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4292	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4352	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4352	200	2560128089.exe	cmd.exe
PID 200 wrote to memory of 4352	200	2560128089.exe	cmd.exe
PID 496 wrote to memory of 4368	496	cmd.exe	WMIC.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

2560128089.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2560128089.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2560128089.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	2560128089.exe

C:\Users\Admin\AppData\Local\Temp\b76e77b52d682f0938d120f3fe011660.exe
"C:\Users\Admin\AppData\Local\Temp\b76e77b52d682f0938d120f3fe011660.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3524

C:\132732751115422\winsvcs.exe
C:\132732751115422\winsvcs.exe
2⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:3632

C:\Users\Admin\AppData\Local\Temp\2560128089.exe
C:\Users\Admin\AppData\Local\Temp\2560128089.exe
3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:200

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c wmic.exe SHADOWCOPY /nointeractive
4⤵
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic.exe SHADOWCOPY /nointeractive
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP
4⤵
PID:2080

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
4⤵
PID:3304

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} recoveryenabled No
4⤵
PID:1904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
4⤵
PID:2792

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet
4⤵
PID:1864

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
5⤵
- Interacts with shadow copies
PID:4500

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c wmic.exe SHADOWCOPY /nointeractive
4⤵
- Suspicious use of WriteProcessMemory
PID:496

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic.exe SHADOWCOPY /nointeractive
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP
4⤵
PID:3068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
4⤵
PID:208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} recoveryenabled No
4⤵
PID:2544

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
4⤵
PID:3880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet
4⤵
PID:3948

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
5⤵
- Interacts with shadow copies
PID:4552

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c wmic.exe SHADOWCOPY /nointeractive
4⤵
PID:3460

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic.exe SHADOWCOPY /nointeractive
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP
4⤵
PID:4144

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
4⤵
PID:4192

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} recoveryenabled No
4⤵
PID:4244

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
4⤵
PID:4292

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet
4⤵
PID:4352

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
5⤵
- Interacts with shadow copies
PID:4628

C:\Users\Admin\AppData\Local\Temp\2271737858.exe
C:\Users\Admin\AppData\Local\Temp\2271737858.exe
3⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:4576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

File Deletion

T1107

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\132732751115422\winsvcs.exe
MD5
b76e77b52d682f0938d120f3fe011660

SHA1
c1fdc71284b5a34b170470a6071626f40f4a4f65

SHA256
0ba5efbb88dd3a6cf12923ed9f6abe16431e839cf0d0beebc3e2e0cdf1a6af5a

SHA512
5547b31fd4635d81e8ea4d426c0133f291b0a1caa3237efb21f849fe71d2d504bf59a1d25e3a20265e6a6f8ce108e6adda47f66eed2c64ecfa96c593efb80177

Download Submit
C:\132732751115422\winsvcs.exe
MD5
b76e77b52d682f0938d120f3fe011660

SHA1
c1fdc71284b5a34b170470a6071626f40f4a4f65

SHA256
0ba5efbb88dd3a6cf12923ed9f6abe16431e839cf0d0beebc3e2e0cdf1a6af5a

SHA512
5547b31fd4635d81e8ea4d426c0133f291b0a1caa3237efb21f849fe71d2d504bf59a1d25e3a20265e6a6f8ce108e6adda47f66eed2c64ecfa96c593efb80177

Download Submit
C:\Users\Admin\AppData\Local\Temp\2271737858.exe
MD5
f653e6890e4afe6eb4081b3f94189dad

SHA1
a19718f52fa1f2dcba2acec7a4556f0dc77793d9

SHA256
d8432d6eca2162786cc16d694cf0a1a7e08095870325e46f3067bd654e47cfb2

SHA512
e8883ff02069766d8b2f8f8aac75292344d9dcc508084d7a96d26db2d8fdd8fac375d9d327b8c51a5e493304f5dc908a542c42e271856624157a7a0807c82bd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2271737858.exe
MD5
f653e6890e4afe6eb4081b3f94189dad

SHA1
a19718f52fa1f2dcba2acec7a4556f0dc77793d9

SHA256
d8432d6eca2162786cc16d694cf0a1a7e08095870325e46f3067bd654e47cfb2

SHA512
e8883ff02069766d8b2f8f8aac75292344d9dcc508084d7a96d26db2d8fdd8fac375d9d327b8c51a5e493304f5dc908a542c42e271856624157a7a0807c82bd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2560128089.exe
MD5
f653e6890e4afe6eb4081b3f94189dad

SHA1
a19718f52fa1f2dcba2acec7a4556f0dc77793d9

SHA256
d8432d6eca2162786cc16d694cf0a1a7e08095870325e46f3067bd654e47cfb2

SHA512
e8883ff02069766d8b2f8f8aac75292344d9dcc508084d7a96d26db2d8fdd8fac375d9d327b8c51a5e493304f5dc908a542c42e271856624157a7a0807c82bd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2560128089.exe
MD5
f653e6890e4afe6eb4081b3f94189dad

SHA1
a19718f52fa1f2dcba2acec7a4556f0dc77793d9

SHA256
d8432d6eca2162786cc16d694cf0a1a7e08095870325e46f3067bd654e47cfb2

SHA512
e8883ff02069766d8b2f8f8aac75292344d9dcc508084d7a96d26db2d8fdd8fac375d9d327b8c51a5e493304f5dc908a542c42e271856624157a7a0807c82bd2

Download Submit
memory/8-6-0x0000000000000000-mapping.dmp

Download
memory/200-3-0x0000000000000000-mapping.dmp

Download
memory/208-15-0x0000000000000000-mapping.dmp

Download
memory/496-13-0x0000000000000000-mapping.dmp

Download
memory/1864-12-0x0000000000000000-mapping.dmp

Download
memory/1904-9-0x0000000000000000-mapping.dmp

Download
memory/1960-11-0x0000000000000000-mapping.dmp

Download
memory/2080-7-0x0000000000000000-mapping.dmp

Download
memory/2544-16-0x0000000000000000-mapping.dmp

Download
memory/2792-10-0x0000000000000000-mapping.dmp

Download
memory/3068-14-0x0000000000000000-mapping.dmp

Download
memory/3304-8-0x0000000000000000-mapping.dmp

Download
memory/3460-19-0x0000000000000000-mapping.dmp

Download
memory/3632-0-0x0000000000000000-mapping.dmp

Download
memory/3880-17-0x0000000000000000-mapping.dmp

Download
memory/3948-18-0x0000000000000000-mapping.dmp

Download
memory/4144-20-0x0000000000000000-mapping.dmp

Download
memory/4192-21-0x0000000000000000-mapping.dmp

Download
memory/4244-22-0x0000000000000000-mapping.dmp

Download
memory/4292-23-0x0000000000000000-mapping.dmp

Download
memory/4352-24-0x0000000000000000-mapping.dmp

Download
memory/4368-25-0x0000000000000000-mapping.dmp

Download
memory/4500-26-0x0000000000000000-mapping.dmp

Download
memory/4544-27-0x0000000000000000-mapping.dmp

Download
memory/4552-28-0x0000000000000000-mapping.dmp

Download
memory/4628-29-0x0000000000000000-mapping.dmp

Download
memory/4700-30-0x0000000000000000-mapping.dmp

Download