Malware Analysis Report

2025-01-02 15:37

Sample ID 210220-qleyx9hfex
Target 210112-79w2gbpjga_pw_infected.zip
SHA256 43a6a97fd9a5f8d1c37aa46e7891d19da546167387e57eec8fb4111fc48fefc7
Tags
ransomware avaddon evasion trojan bootkit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

43a6a97fd9a5f8d1c37aa46e7891d19da546167387e57eec8fb4111fc48fefc7

Threat Level: Known bad

The file 210112-79w2gbpjga_pw_infected.zip was found to be: Known bad.

Malicious Activity Summary

ransomware avaddon evasion trojan bootkit

Avaddon family

UAC bypass

Process spawned unexpected child process

Avaddon Ransomware

Deletes shadow copies

Modifies extensions of user files

Modifies WinLogon to allow AutoLogon

Drops desktop.ini file(s)

Enumerates connected drives

Checks whether UAC is enabled

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

Modifies data under HKEY_USERS

Suspicious use of SetWindowsHookEx

System policy modification

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-02-20 12:39

Signatures

Avaddon Ransomware

ransomware
Description Indicator Process Target
N/A N/A N/A N/A

Avaddon family

avaddon

Analysis: behavioral1

Detonation Overview

Submitted

2021-02-20 12:39

Reported

2021-02-20 12:40

Platform

win7v20201028

Max time kernel

55s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\wbem\wmic.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\wbem\wmic.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\wbem\wmic.exe

UAC bypass

evasion trojan

Deletes shadow copies

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\OptimizeMerge.tiff => C:\Users\Admin\Pictures\OptimizeMerge.tiff.eaedDeABa C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened for modification C:\Users\Admin\Pictures\UndoOptimize.tiff C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File renamed C:\Users\Admin\Pictures\UndoOptimize.tiff => C:\Users\Admin\Pictures\UndoOptimize.tiff.eaedDeABa C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File renamed C:\Users\Admin\Pictures\ConvertToResume.raw => C:\Users\Admin\Pictures\ConvertToResume.raw.eaedDeABa C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File renamed C:\Users\Admin\Pictures\EnterWatch.crw => C:\Users\Admin\Pictures\EnterWatch.crw.eaedDeABa C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened for modification C:\Users\Admin\Pictures\OptimizeMerge.tiff C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File renamed C:\Users\Admin\Pictures\RequestTest.raw => C:\Users\Admin\Pictures\RequestTest.raw.eaedDeABa C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File renamed C:\Users\Admin\Pictures\RevokeRepair.crw => C:\Users\Admin\Pictures\RevokeRepair.crw.eaedDeABa C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File renamed C:\Users\Admin\Pictures\StartJoin.png => C:\Users\Admin\Pictures\StartJoin.png.eaedDeABa C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3825035466-2522850611-591511364-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2008 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2008 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2008 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe

"C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe"

C:\Windows\system32\wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\system32\wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\system32\wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\vssadmin.exe

vssadmin Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin Delete Shadows /All /Quiet

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x1f8

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2008-2-0x0000000076641000-0x0000000076643000-memory.dmp

memory/1912-3-0x0000000000000000-mapping.dmp

memory/1720-4-0x0000000000000000-mapping.dmp

memory/1300-5-0x0000000000000000-mapping.dmp

memory/1924-6-0x0000000000000000-mapping.dmp

memory/1300-7-0x0000000000000000-mapping.dmp

memory/1476-8-0x0000000000000000-mapping.dmp

memory/1532-9-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

memory/1532-10-0x00000000027C0000-0x00000000027C1000-memory.dmp

memory/220-12-0x00000000028A0000-0x00000000028A1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-02-20 12:39

Reported

2021-02-20 12:40

Platform

win10v20201028

Max time kernel

65s

Max time network

65s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\wbem\wmic.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\wbem\wmic.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\wbem\wmic.exe

UAC bypass

evasion trojan

Deletes shadow copies

ransomware

Modifies WinLogon to allow AutoLogon

ransomware bootkit
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked C:\Windows\system32\LogonUI.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\SetSave.tiff C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened for modification C:\Users\Admin\Pictures\StopEnter.tiff C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File renamed C:\Users\Admin\Pictures\ProtectTrace.png => C:\Users\Admin\Pictures\ProtectTrace.png.aDadadbeEd C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File renamed C:\Users\Admin\Pictures\SetSave.tiff => C:\Users\Admin\Pictures\SetSave.tiff.aDadadbeEd C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File renamed C:\Users\Admin\Pictures\StopEnter.tiff => C:\Users\Admin\Pictures\StopEnter.tiff.aDadadbeEd C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File renamed C:\Users\Admin\Pictures\FormatUse.tif => C:\Users\Admin\Pictures\FormatUse.tif.aDadadbeEd C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File renamed C:\Users\Admin\Pictures\OutCopy.crw => C:\Users\Admin\Pictures\OutCopy.crw.aDadadbeEd C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3920 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3920 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3920 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3920 wrote to memory of 204 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3920 wrote to memory of 204 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3920 wrote to memory of 204 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3920 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3920 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3920 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3920 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3920 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3920 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3920 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3920 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3920 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3920 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3920 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3920 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe C:\Windows\SysWOW64\vssadmin.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe

"C:\Users\Admin\AppData\Local\Temp\2a2a770ed80f8101bcff73b791ccd14391d2df3a4e152cbcacbd7df24878e312.exe"

C:\Windows\system32\wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\system32\wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\system32\wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\vssadmin.exe

vssadmin Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic SHADOWCOPY DELETE /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin Delete Shadows /All /Quiet

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0 /state0:0xa3ad8855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
N/A 10.10.0.1:445 tcp
N/A 10.10.0.1:139 tcp
N/A 52.114.128.74:443 self.events.data.microsoft.com tcp

Files

memory/196-2-0x0000000000000000-mapping.dmp

memory/204-3-0x0000000000000000-mapping.dmp

memory/1540-4-0x0000000000000000-mapping.dmp

memory/268-5-0x0000000000000000-mapping.dmp

memory/1308-6-0x0000000000000000-mapping.dmp

memory/2112-7-0x0000000000000000-mapping.dmp