Analysis
-
max time kernel
151s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
19-04-2021 12:33
Static task
static1
Behavioral task
behavioral1
Sample
Fast.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Fast.exe
Resource
win10v20210410
General
-
Target
Fast.exe
-
Size
56KB
-
MD5
570c8f24ff863f286366b9469d289a39
-
SHA1
ed5400599d048c7a0ffd32459ffb9852904aacd9
-
SHA256
c7703c115b1ec3fb755e570ee94c782e03097ed6c054c7872d34d2379409181f
-
SHA512
57903a5f1d463d5b978018670c686d462f37bb8db8c60ba8b83054ab9413ef5b122b39fc59c2d6dcb320e84f933200e80a1e10a7a0a43ede9552cd22a61b3c55
Malware Config
Extracted
C:\Users\Admin\Desktop\info.hta
Kaseno@firemail.cc
zezoxo@libertymail.net
togerpo@zohomail.eu
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 388 bcdedit.exe 1256 bcdedit.exe 1360 bcdedit.exe 2016 bcdedit.exe -
Processes:
wbadmin.exewbadmin.exepid process 568 wbadmin.exe 1692 wbadmin.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 3 IoCs
Processes:
Fast.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\Fast.exe Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Fast.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Fast.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe" Fast.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe" Fast.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
Fast.exedescription ioc process File opened for modification C:\Users\Public\Music\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Fast.exe File opened for modification C:\Users\Public\Libraries\desktop.ini Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Fast.exe File opened for modification C:\Program Files (x86)\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Fast.exe File opened for modification C:\Users\Public\desktop.ini Fast.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini Fast.exe File opened for modification C:\Program Files\desktop.ini Fast.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini Fast.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Fast.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Links\desktop.ini Fast.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Fast.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Fast.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini Fast.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VFDYFLB4\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Music\desktop.ini Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Fast.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P8HHGB03\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Fast.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Fast.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Fast.exe File opened for modification C:\Users\Public\Documents\desktop.ini Fast.exe File opened for modification C:\Users\Public\Videos\desktop.ini Fast.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Fast.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198025.WMF Fast.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\msdatasrc.dll Fast.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mousedown.png Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195812.WMF Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota Fast.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp Fast.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\SATIN.ELM Fast.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_02.MID.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14530_.GIF.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_MediumMAsk.bmp Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\LISTBOX.JPG.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.htm Fast.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00775_.WMF.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01246_.GIF.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PEOPLEDATAHANDLER.DLL Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB9.BDR.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf Fast.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\BOLDSTRI.ELM Fast.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\slideShow.css Fast.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)grayStateIcon.png Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad Fast.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_hov.png Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left.gif Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PICTPH.POC Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd Fast.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\RADIAL.INF.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\zh-CN.pak Fast.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa Fast.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\SUMIPNTG.ELM.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21326_.GIF Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH.HXS.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar Fast.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac Fast.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.PNG.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02752U.BMP.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00603_.WMF.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\tab_off.gif.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE_K_COL.HXK.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar Fast.exe File created C:\Program Files\Mozilla Firefox\update-settings.ini.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange.css.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBHED98.POC.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd.dll Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_OFF.GIF.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR46B.GIF.id[97C1E0A6-3172].[Kaseno@firemail.cc].Acuna Fast.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml Fast.exe File opened for modification C:\Program Files\Mozilla Firefox\libEGL.dll Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00489_.WMF Fast.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1772 vssadmin.exe 1628 vssadmin.exe -
Processes:
mshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Fast.exepid process 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe 484 Fast.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Fast.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 484 Fast.exe Token: SeBackupPrivilege 740 vssvc.exe Token: SeRestorePrivilege 740 vssvc.exe Token: SeAuditPrivilege 740 vssvc.exe Token: SeIncreaseQuotaPrivilege 348 WMIC.exe Token: SeSecurityPrivilege 348 WMIC.exe Token: SeTakeOwnershipPrivilege 348 WMIC.exe Token: SeLoadDriverPrivilege 348 WMIC.exe Token: SeSystemProfilePrivilege 348 WMIC.exe Token: SeSystemtimePrivilege 348 WMIC.exe Token: SeProfSingleProcessPrivilege 348 WMIC.exe Token: SeIncBasePriorityPrivilege 348 WMIC.exe Token: SeCreatePagefilePrivilege 348 WMIC.exe Token: SeBackupPrivilege 348 WMIC.exe Token: SeRestorePrivilege 348 WMIC.exe Token: SeShutdownPrivilege 348 WMIC.exe Token: SeDebugPrivilege 348 WMIC.exe Token: SeSystemEnvironmentPrivilege 348 WMIC.exe Token: SeRemoteShutdownPrivilege 348 WMIC.exe Token: SeUndockPrivilege 348 WMIC.exe Token: SeManageVolumePrivilege 348 WMIC.exe Token: 33 348 WMIC.exe Token: 34 348 WMIC.exe Token: 35 348 WMIC.exe Token: SeIncreaseQuotaPrivilege 348 WMIC.exe Token: SeSecurityPrivilege 348 WMIC.exe Token: SeTakeOwnershipPrivilege 348 WMIC.exe Token: SeLoadDriverPrivilege 348 WMIC.exe Token: SeSystemProfilePrivilege 348 WMIC.exe Token: SeSystemtimePrivilege 348 WMIC.exe Token: SeProfSingleProcessPrivilege 348 WMIC.exe Token: SeIncBasePriorityPrivilege 348 WMIC.exe Token: SeCreatePagefilePrivilege 348 WMIC.exe Token: SeBackupPrivilege 348 WMIC.exe Token: SeRestorePrivilege 348 WMIC.exe Token: SeShutdownPrivilege 348 WMIC.exe Token: SeDebugPrivilege 348 WMIC.exe Token: SeSystemEnvironmentPrivilege 348 WMIC.exe Token: SeRemoteShutdownPrivilege 348 WMIC.exe Token: SeUndockPrivilege 348 WMIC.exe Token: SeManageVolumePrivilege 348 WMIC.exe Token: 33 348 WMIC.exe Token: 34 348 WMIC.exe Token: 35 348 WMIC.exe Token: SeBackupPrivilege 1624 wbengine.exe Token: SeRestorePrivilege 1624 wbengine.exe Token: SeSecurityPrivilege 1624 wbengine.exe Token: SeIncreaseQuotaPrivilege 1256 WMIC.exe Token: SeSecurityPrivilege 1256 WMIC.exe Token: SeTakeOwnershipPrivilege 1256 WMIC.exe Token: SeLoadDriverPrivilege 1256 WMIC.exe Token: SeSystemProfilePrivilege 1256 WMIC.exe Token: SeSystemtimePrivilege 1256 WMIC.exe Token: SeProfSingleProcessPrivilege 1256 WMIC.exe Token: SeIncBasePriorityPrivilege 1256 WMIC.exe Token: SeCreatePagefilePrivilege 1256 WMIC.exe Token: SeBackupPrivilege 1256 WMIC.exe Token: SeRestorePrivilege 1256 WMIC.exe Token: SeShutdownPrivilege 1256 WMIC.exe Token: SeDebugPrivilege 1256 WMIC.exe Token: SeSystemEnvironmentPrivilege 1256 WMIC.exe Token: SeRemoteShutdownPrivilege 1256 WMIC.exe Token: SeUndockPrivilege 1256 WMIC.exe Token: SeManageVolumePrivilege 1256 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
mshta.exepid process 960 mshta.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
Fast.execmd.execmd.execmd.exedescription pid process target process PID 484 wrote to memory of 1192 484 Fast.exe cmd.exe PID 484 wrote to memory of 1192 484 Fast.exe cmd.exe PID 484 wrote to memory of 1192 484 Fast.exe cmd.exe PID 484 wrote to memory of 1192 484 Fast.exe cmd.exe PID 484 wrote to memory of 1532 484 Fast.exe cmd.exe PID 484 wrote to memory of 1532 484 Fast.exe cmd.exe PID 484 wrote to memory of 1532 484 Fast.exe cmd.exe PID 484 wrote to memory of 1532 484 Fast.exe cmd.exe PID 1192 wrote to memory of 1480 1192 cmd.exe netsh.exe PID 1192 wrote to memory of 1480 1192 cmd.exe netsh.exe PID 1192 wrote to memory of 1480 1192 cmd.exe netsh.exe PID 1532 wrote to memory of 1772 1532 cmd.exe vssadmin.exe PID 1532 wrote to memory of 1772 1532 cmd.exe vssadmin.exe PID 1532 wrote to memory of 1772 1532 cmd.exe vssadmin.exe PID 1192 wrote to memory of 1700 1192 cmd.exe netsh.exe PID 1192 wrote to memory of 1700 1192 cmd.exe netsh.exe PID 1192 wrote to memory of 1700 1192 cmd.exe netsh.exe PID 1532 wrote to memory of 348 1532 cmd.exe WMIC.exe PID 1532 wrote to memory of 348 1532 cmd.exe WMIC.exe PID 1532 wrote to memory of 348 1532 cmd.exe WMIC.exe PID 1532 wrote to memory of 388 1532 cmd.exe bcdedit.exe PID 1532 wrote to memory of 388 1532 cmd.exe bcdedit.exe PID 1532 wrote to memory of 388 1532 cmd.exe bcdedit.exe PID 1532 wrote to memory of 1256 1532 cmd.exe bcdedit.exe PID 1532 wrote to memory of 1256 1532 cmd.exe bcdedit.exe PID 1532 wrote to memory of 1256 1532 cmd.exe bcdedit.exe PID 1532 wrote to memory of 568 1532 cmd.exe wbadmin.exe PID 1532 wrote to memory of 568 1532 cmd.exe wbadmin.exe PID 1532 wrote to memory of 568 1532 cmd.exe wbadmin.exe PID 484 wrote to memory of 1608 484 Fast.exe mshta.exe PID 484 wrote to memory of 1608 484 Fast.exe mshta.exe PID 484 wrote to memory of 1608 484 Fast.exe mshta.exe PID 484 wrote to memory of 1608 484 Fast.exe mshta.exe PID 484 wrote to memory of 560 484 Fast.exe mshta.exe PID 484 wrote to memory of 560 484 Fast.exe mshta.exe PID 484 wrote to memory of 560 484 Fast.exe mshta.exe PID 484 wrote to memory of 560 484 Fast.exe mshta.exe PID 484 wrote to memory of 960 484 Fast.exe mshta.exe PID 484 wrote to memory of 960 484 Fast.exe mshta.exe PID 484 wrote to memory of 960 484 Fast.exe mshta.exe PID 484 wrote to memory of 960 484 Fast.exe mshta.exe PID 484 wrote to memory of 944 484 Fast.exe cmd.exe PID 484 wrote to memory of 944 484 Fast.exe cmd.exe PID 484 wrote to memory of 944 484 Fast.exe cmd.exe PID 484 wrote to memory of 944 484 Fast.exe cmd.exe PID 944 wrote to memory of 1628 944 cmd.exe vssadmin.exe PID 944 wrote to memory of 1628 944 cmd.exe vssadmin.exe PID 944 wrote to memory of 1628 944 cmd.exe vssadmin.exe PID 944 wrote to memory of 1256 944 cmd.exe WMIC.exe PID 944 wrote to memory of 1256 944 cmd.exe WMIC.exe PID 944 wrote to memory of 1256 944 cmd.exe WMIC.exe PID 944 wrote to memory of 1360 944 cmd.exe bcdedit.exe PID 944 wrote to memory of 1360 944 cmd.exe bcdedit.exe PID 944 wrote to memory of 1360 944 cmd.exe bcdedit.exe PID 944 wrote to memory of 2016 944 cmd.exe bcdedit.exe PID 944 wrote to memory of 2016 944 cmd.exe bcdedit.exe PID 944 wrote to memory of 2016 944 cmd.exe bcdedit.exe PID 944 wrote to memory of 1692 944 cmd.exe wbadmin.exe PID 944 wrote to memory of 1692 944 cmd.exe wbadmin.exe PID 944 wrote to memory of 1692 944 cmd.exe wbadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fast.exe"C:\Users\Admin\AppData\Local\Temp\Fast.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fast.exe"C:\Users\Admin\AppData\Local\Temp\Fast.exe"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\info.htaMD5
e2888f88447d1807746f0ae59b650f1c
SHA17e27ba4698e2130c9cb9deaea6a65e18885d59ad
SHA256824fc4d41da4f112c639a02bc4ac42e3bdc7f81fcac5604b1624958c73929cea
SHA51247a73935baacaa219de1e63a67c7c298cae87238eef27f22b14e9acd58247282bdd3b9c3c37bd497eaacb72543db43378794c60807542dc834e0f00d7dad1eb0
-
C:\info.htaMD5
e2888f88447d1807746f0ae59b650f1c
SHA17e27ba4698e2130c9cb9deaea6a65e18885d59ad
SHA256824fc4d41da4f112c639a02bc4ac42e3bdc7f81fcac5604b1624958c73929cea
SHA51247a73935baacaa219de1e63a67c7c298cae87238eef27f22b14e9acd58247282bdd3b9c3c37bd497eaacb72543db43378794c60807542dc834e0f00d7dad1eb0
-
C:\users\public\desktop\info.htaMD5
e2888f88447d1807746f0ae59b650f1c
SHA17e27ba4698e2130c9cb9deaea6a65e18885d59ad
SHA256824fc4d41da4f112c639a02bc4ac42e3bdc7f81fcac5604b1624958c73929cea
SHA51247a73935baacaa219de1e63a67c7c298cae87238eef27f22b14e9acd58247282bdd3b9c3c37bd497eaacb72543db43378794c60807542dc834e0f00d7dad1eb0
-
memory/348-69-0x0000000000000000-mapping.dmp
-
memory/388-70-0x0000000000000000-mapping.dmp
-
memory/484-60-0x0000000075AD1000-0x0000000075AD3000-memory.dmpFilesize
8KB
-
memory/560-75-0x0000000000000000-mapping.dmp
-
memory/568-72-0x0000000000000000-mapping.dmp
-
memory/944-77-0x0000000000000000-mapping.dmp
-
memory/960-76-0x0000000000000000-mapping.dmp
-
memory/1192-62-0x0000000000000000-mapping.dmp
-
memory/1256-71-0x0000000000000000-mapping.dmp
-
memory/1256-79-0x0000000000000000-mapping.dmp
-
memory/1360-84-0x0000000000000000-mapping.dmp
-
memory/1480-66-0x000007FEFB761000-0x000007FEFB763000-memory.dmpFilesize
8KB
-
memory/1480-64-0x0000000000000000-mapping.dmp
-
memory/1532-63-0x0000000000000000-mapping.dmp
-
memory/1608-74-0x0000000000000000-mapping.dmp
-
memory/1628-78-0x0000000000000000-mapping.dmp
-
memory/1692-86-0x0000000000000000-mapping.dmp
-
memory/1700-67-0x0000000000000000-mapping.dmp
-
memory/1772-65-0x0000000000000000-mapping.dmp
-
memory/2016-85-0x0000000000000000-mapping.dmp