Malware Analysis Report

2024-10-16 03:11

Sample ID 220112-r7pjxachb7
Target a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample
SHA256 a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b
Tags
hive evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b

Threat Level: Known bad

The file a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample was found to be: Known bad.

Malicious Activity Summary

hive evasion ransomware spyware stealer trojan

Hive

Modifies security service

Deletes Windows Defender Definitions

Modifies Windows Defender Real-time Protection settings

Deletes shadow copies

Clears Windows event logs

Reads user/profile data of web browsers

Drops file in Program Files directory

Launches sc.exe

Modifies registry class

Suspicious use of WriteProcessMemory

Runs net.exe

Opens file in notepad (likely ransom note)

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-12 14:50

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-12 14:50

Reported

2022-01-12 14:55

Platform

win7-en-20211208

Max time kernel

179s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Windows\SysWOW64\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02405_.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\security\javafx.policy.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\currency.html C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\wPfq_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BUTTON.JPG.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\RSSFeeds.css C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\wPfq_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\THEMES.INF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01785_.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00097_.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Waveform.xml.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR22F.GIF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\wPfq_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02265_.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\VCTRN_01.MID.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\glow.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01066_.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00476_.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\wPfq_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Beirut.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Northwind.accdt.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0252629.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02950_.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00670_.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR44B.GIF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\weather.css C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\VIBE.WAV.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152590.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN048.XML.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\wPfq_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.ES.XML.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341551.JPG.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10300_.GIF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\PASSWORD.JPG.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\wPfq_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0205462.WMF.VMuWMPCmER_fOivFzC-WS25meDmEEGPOluQ4TT7gRYH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 964 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 1876 wrote to memory of 660 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1876 wrote to memory of 660 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1876 wrote to memory of 660 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1876 wrote to memory of 660 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 964 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 472 wrote to memory of 272 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 472 wrote to memory of 272 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 472 wrote to memory of 272 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 472 wrote to memory of 272 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 964 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 580 wrote to memory of 1492 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 580 wrote to memory of 1492 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 580 wrote to memory of 1492 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 580 wrote to memory of 1492 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 964 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 1652 wrote to memory of 1800 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1652 wrote to memory of 1800 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1652 wrote to memory of 1800 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1652 wrote to memory of 1800 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 964 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 892 wrote to memory of 1324 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 892 wrote to memory of 1324 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 892 wrote to memory of 1324 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 892 wrote to memory of 1324 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 964 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 1620 wrote to memory of 1984 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1620 wrote to memory of 1984 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1620 wrote to memory of 1984 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1620 wrote to memory of 1984 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 964 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 1804 wrote to memory of 1220 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1804 wrote to memory of 1220 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1804 wrote to memory of 1220 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1804 wrote to memory of 1220 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 964 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 964 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 1552 wrote to memory of 1952 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1552 wrote to memory of 1952 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1552 wrote to memory of 1952 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1552 wrote to memory of 1952 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe

"C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe"

C:\Windows\SysWOW64\net.exe

net.exe stop "NetMsmqActivator" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "NetMsmqActivator" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "SamSs" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "VSS" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "wbengine" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "WebClient" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SysWOW64\sc.exe

sc.exe config "NetMsmqActivator" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SysWOW64\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SysWOW64\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SysWOW64\wevtutil.exe

wevtutil.exe cl application

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SysWOW64\notepad.exe

notepad.exe C:\wPfq_HOW_TO_DECRYPT.txt

C:\Windows\SysWOW64\cmd.exe

cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe"

C:\Windows\SysWOW64\PING.EXE

ping.exe -n 5 127.0.0.1

Network

N/A

Files

memory/1876-54-0x0000000000000000-mapping.dmp

memory/660-55-0x0000000000000000-mapping.dmp

memory/472-56-0x0000000000000000-mapping.dmp

memory/272-57-0x0000000000000000-mapping.dmp

memory/580-58-0x0000000000000000-mapping.dmp

memory/1492-59-0x0000000000000000-mapping.dmp

memory/1652-60-0x0000000000000000-mapping.dmp

memory/1800-61-0x0000000000000000-mapping.dmp

memory/892-62-0x0000000000000000-mapping.dmp

memory/1324-63-0x0000000000000000-mapping.dmp

memory/1620-64-0x0000000000000000-mapping.dmp

memory/1984-65-0x0000000000000000-mapping.dmp

memory/1804-66-0x0000000000000000-mapping.dmp

memory/1220-67-0x0000000000000000-mapping.dmp

memory/1552-68-0x0000000000000000-mapping.dmp

memory/1952-69-0x0000000000000000-mapping.dmp

memory/1716-70-0x0000000000000000-mapping.dmp

memory/1796-71-0x0000000000000000-mapping.dmp

memory/1004-72-0x0000000000000000-mapping.dmp

memory/1516-73-0x0000000000000000-mapping.dmp

memory/1748-74-0x0000000000000000-mapping.dmp

memory/1328-75-0x0000000000000000-mapping.dmp

memory/2004-76-0x0000000000000000-mapping.dmp

memory/996-77-0x0000000000000000-mapping.dmp

memory/904-78-0x0000000000000000-mapping.dmp

memory/1488-79-0x0000000000000000-mapping.dmp

memory/516-80-0x0000000000000000-mapping.dmp

memory/1868-81-0x0000000000000000-mapping.dmp

memory/296-82-0x0000000000000000-mapping.dmp

memory/1984-83-0x0000000000000000-mapping.dmp

memory/1364-84-0x0000000000000000-mapping.dmp

memory/1592-85-0x0000000000000000-mapping.dmp

memory/1688-86-0x0000000000000000-mapping.dmp

memory/1824-87-0x0000000000000000-mapping.dmp

memory/1388-88-0x0000000000000000-mapping.dmp

memory/1744-89-0x0000000000000000-mapping.dmp

memory/1060-90-0x0000000000000000-mapping.dmp

memory/924-91-0x0000000000000000-mapping.dmp

memory/1524-92-0x0000000000000000-mapping.dmp

memory/1508-93-0x0000000000000000-mapping.dmp

memory/1692-94-0x0000000000000000-mapping.dmp

memory/1108-95-0x0000000000000000-mapping.dmp

memory/1548-96-0x0000000000000000-mapping.dmp

memory/972-97-0x0000000000000000-mapping.dmp

memory/1336-98-0x0000000000000000-mapping.dmp

memory/1776-99-0x0000000000000000-mapping.dmp

memory/1728-100-0x0000000000000000-mapping.dmp

memory/1736-101-0x0000000000000000-mapping.dmp

memory/1484-102-0x0000000000000000-mapping.dmp

memory/932-103-0x0000000000000000-mapping.dmp

memory/1976-104-0x0000000000000000-mapping.dmp

memory/2000-105-0x0000000000000000-mapping.dmp

memory/1752-106-0x0000000000000000-mapping.dmp

memory/1356-107-0x0000000000000000-mapping.dmp

memory/1496-108-0x0000000000000000-mapping.dmp

memory/1324-109-0x0000000000000000-mapping.dmp

memory/1696-110-0x0000000000000000-mapping.dmp

memory/1960-111-0x0000000000000000-mapping.dmp

memory/1500-112-0x0000000000000000-mapping.dmp

memory/1916-113-0x0000000000000000-mapping.dmp

memory/868-114-0x0000000000000000-mapping.dmp

memory/1992-115-0x0000000000000000-mapping.dmp

memory/1360-116-0x0000000000000000-mapping.dmp

memory/2084-117-0x0000000000000000-mapping.dmp

memory/2140-118-0x0000000075341000-0x0000000075343000-memory.dmp

memory/2140-120-0x0000000002390000-0x0000000002FDA000-memory.dmp

memory/2140-119-0x0000000002390000-0x0000000002FDA000-memory.dmp

memory/2140-121-0x0000000002390000-0x0000000002FDA000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 352a482d3076e201ca52f100f02bc42a
SHA1 27c6bdabdc3ea33a49a75d1377ba6aaf9261b93d
SHA256 114bb2f120c0bc0bd5d9f24bc5334a21bd9ab27b6d4e3921cd33cf7c84fe3ce5
SHA512 a55a64392b02bdfa77dc35aea3e57fd4ecc5e83aa84e041c7dcd974170284b4caf2c10ee0f76ef04ab90d1e89e5a886886095ddbc4331b5fe55145de9dc64ccd

C:\wPfq_HOW_TO_DECRYPT.txt

MD5 3d3aab4fac96343c7e4bf9f111f89193
SHA1 550d2ea76bb0a789e4bfbefef4a899c4fbad254c
SHA256 54643189ee659f0e200ac4eb1ae678f35c016e0905eca63e675dbeadfc2422d8
SHA512 15b065276f0f8acd76c54462a6f71153e0df65a10aff76412bf2582940b46ff64124e2577e320220aa9c0daf1e4d3f5fc5d4d78aee5979e60a10690a702badda

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-12 14:50

Reported

2022-01-12 14:55

Platform

win10-en-20211208

Max time kernel

134s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SysWOW64\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xecd0.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\plugin.js.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__KAAAACgAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\de-DE\mshwLatin.dll.mui.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\EmbossBitmaps\Rectangle_icon.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\4774_32x32x32.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-white\SplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\ui-strings.js.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__FAAAABQAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jce.jar.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__MgAAADIAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__PAAAADwAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPageState2\spider_bp_920.jpg C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Jumbo\mask\11d.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__KAAAACgAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Eye.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]_H6p_VnJ5P__DAAAAAwAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__LAAAACwAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\188.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\orcl7.xsl.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\Deal\New-Deal-up.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\5601_24x24x32.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\rofl.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1849_24x24x32.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\ui-strings.js.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\ProjectionCylindric.scale-180.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\91.jpg C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Xaml.Toolkit\Assets\CardsLoadingSpritesheet.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-150.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\ui-strings.js.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__JAAAACQAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\trdtv2r41.xsl.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__CAAAAAgAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast.png.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Effects\CherryBlossoms.jpg C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\en-us\styles\wefgallerywinrt.css C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ru_135x40.svg.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\fr-FR\rtscom.dll.mui.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__FgAAABYAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6416_40x40x32.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__GAAAABgAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__OgAAADoAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\classic_10h.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__CAAAAAgAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-white\Icon.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_ZH-TW.respack C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-100.png C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close.svg.dfp-1MIfcdzpX90xYKH8dYaSWWIJ40RQ_H6p_VnJ5P__AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP C:\Windows\SysWOW64\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP C:\Windows\SysWOW64\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP C:\Windows\SysWOW64\reg.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 860 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 1416 wrote to memory of 2904 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1416 wrote to memory of 2904 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1416 wrote to memory of 2904 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 860 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 1836 wrote to memory of 784 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1836 wrote to memory of 784 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1836 wrote to memory of 784 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 860 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 2832 wrote to memory of 2264 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2832 wrote to memory of 2264 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2832 wrote to memory of 2264 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 860 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 3392 wrote to memory of 1360 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3392 wrote to memory of 1360 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3392 wrote to memory of 1360 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 860 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 2392 wrote to memory of 1348 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2392 wrote to memory of 1348 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2392 wrote to memory of 1348 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 860 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 836 wrote to memory of 1848 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 836 wrote to memory of 1848 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 836 wrote to memory of 1848 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 860 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 2344 wrote to memory of 1204 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2344 wrote to memory of 1204 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2344 wrote to memory of 1204 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 860 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 4088 wrote to memory of 1548 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4088 wrote to memory of 1548 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4088 wrote to memory of 1548 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 860 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 860 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\net.exe
PID 1608 wrote to memory of 1800 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1608 wrote to memory of 1800 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1608 wrote to memory of 1800 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 860 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 860 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 860 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 860 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 860 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 860 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 860 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 860 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 860 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\sc.exe
PID 860 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe C:\Windows\SysWOW64\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe

"C:\Users\Admin\AppData\Local\Temp\a235bb61d1eb9f2f39767b844c28086a4582e58afdca4678d309395f28a65a5b.bin.sample.exe"

C:\Windows\SysWOW64\net.exe

net.exe stop "SamSs" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "vmicvss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "VSS" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "wbengine" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "WebClient" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SysWOW64\net.exe

net.exe stop "UnistoreSvc_1509d" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_1509d" /y

C:\Windows\SysWOW64\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SysWOW64\sc.exe

sc.exe config "UnistoreSvc_1509d" start= disabled

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SysWOW64\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SysWOW64\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SysWOW64\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SysWOW64\wevtutil.exe

wevtutil.exe cl application

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

Network

Country Destination Domain Proto
IE 52.109.76.32:443 tcp
US 8.8.8.8:53 time.windows.com udp
NL 40.119.148.38:123 time.windows.com udp

Files

memory/1416-118-0x0000000000000000-mapping.dmp

memory/2904-119-0x0000000000000000-mapping.dmp

memory/1836-120-0x0000000000000000-mapping.dmp

memory/784-121-0x0000000000000000-mapping.dmp

memory/2832-122-0x0000000000000000-mapping.dmp

memory/2264-123-0x0000000000000000-mapping.dmp

memory/3392-124-0x0000000000000000-mapping.dmp

memory/1360-125-0x0000000000000000-mapping.dmp

memory/2392-126-0x0000000000000000-mapping.dmp

memory/1348-127-0x0000000000000000-mapping.dmp

memory/836-128-0x0000000000000000-mapping.dmp

memory/1848-129-0x0000000000000000-mapping.dmp

memory/2344-130-0x0000000000000000-mapping.dmp

memory/1204-131-0x0000000000000000-mapping.dmp

memory/4088-132-0x0000000000000000-mapping.dmp

memory/1548-133-0x0000000000000000-mapping.dmp

memory/1608-134-0x0000000000000000-mapping.dmp

memory/1800-135-0x0000000000000000-mapping.dmp

memory/1716-136-0x0000000000000000-mapping.dmp

memory/1980-137-0x0000000000000000-mapping.dmp

memory/2148-138-0x0000000000000000-mapping.dmp

memory/2580-139-0x0000000000000000-mapping.dmp

memory/3268-140-0x0000000000000000-mapping.dmp

memory/3968-141-0x0000000000000000-mapping.dmp

memory/1668-142-0x0000000000000000-mapping.dmp

memory/3432-143-0x0000000000000000-mapping.dmp

memory/3688-144-0x0000000000000000-mapping.dmp

memory/3228-145-0x0000000000000000-mapping.dmp

memory/3860-146-0x0000000000000000-mapping.dmp

memory/2040-147-0x0000000000000000-mapping.dmp

memory/3920-148-0x0000000000000000-mapping.dmp

memory/1216-149-0x0000000000000000-mapping.dmp

memory/3224-150-0x0000000000000000-mapping.dmp

memory/2116-151-0x0000000000000000-mapping.dmp

memory/2260-152-0x0000000000000000-mapping.dmp

memory/2600-153-0x0000000000000000-mapping.dmp

memory/60-154-0x0000000000000000-mapping.dmp

memory/3056-155-0x0000000000000000-mapping.dmp

memory/684-156-0x0000000000000000-mapping.dmp

memory/544-157-0x0000000000000000-mapping.dmp

memory/2276-158-0x0000000000000000-mapping.dmp

memory/1468-159-0x0000000000000000-mapping.dmp

memory/1736-160-0x0000000000000000-mapping.dmp

memory/1564-161-0x0000000000000000-mapping.dmp

memory/2200-162-0x0000000000000000-mapping.dmp

memory/2188-163-0x0000000000000000-mapping.dmp

memory/2744-164-0x0000000000000000-mapping.dmp

memory/2984-165-0x0000000000000000-mapping.dmp

memory/724-166-0x0000000000000000-mapping.dmp

memory/2964-167-0x0000000000000000-mapping.dmp

memory/3728-168-0x0000000000000000-mapping.dmp

memory/3500-169-0x0000000000000000-mapping.dmp

memory/1844-170-0x0000000000000000-mapping.dmp

memory/1228-171-0x0000000000000000-mapping.dmp

memory/3776-172-0x0000000000000000-mapping.dmp

memory/1596-173-0x0000000000000000-mapping.dmp

memory/2120-174-0x0000000000000000-mapping.dmp

memory/1360-175-0x0000000000000000-mapping.dmp

memory/1224-176-0x0000000000000000-mapping.dmp

memory/396-177-0x0000000000000000-mapping.dmp

memory/2352-178-0x0000000000000000-mapping.dmp

memory/3412-179-0x0000000000000000-mapping.dmp

memory/2104-180-0x0000000000000000-mapping.dmp

memory/1156-181-0x0000000000000000-mapping.dmp

memory/2404-182-0x0000000003600000-0x0000000003601000-memory.dmp

memory/2404-183-0x0000000003600000-0x0000000003601000-memory.dmp

memory/2404-184-0x0000000007300000-0x0000000007336000-memory.dmp

memory/2404-185-0x0000000007400000-0x0000000007401000-memory.dmp

memory/2404-186-0x0000000007402000-0x0000000007403000-memory.dmp

memory/2404-187-0x0000000007A40000-0x0000000008068000-memory.dmp

memory/2404-188-0x00000000078E0000-0x0000000007902000-memory.dmp

memory/2404-189-0x0000000008160000-0x00000000081C6000-memory.dmp

memory/2404-190-0x00000000081D0000-0x0000000008236000-memory.dmp

memory/2404-191-0x00000000084F0000-0x0000000008840000-memory.dmp

memory/2404-192-0x0000000008300000-0x000000000831C000-memory.dmp

memory/2404-193-0x0000000008840000-0x000000000888B000-memory.dmp

memory/2404-194-0x0000000008AB0000-0x0000000008B26000-memory.dmp

memory/2404-195-0x0000000003600000-0x0000000003601000-memory.dmp

memory/2404-203-0x0000000007A40000-0x0000000008068000-memory.dmp

memory/2404-204-0x0000000009B50000-0x0000000009B83000-memory.dmp

memory/2404-205-0x0000000009B50000-0x0000000009B83000-memory.dmp

memory/2404-206-0x00000000078E0000-0x0000000007902000-memory.dmp

memory/2404-207-0x0000000008160000-0x00000000081C6000-memory.dmp

memory/2404-208-0x00000000081D0000-0x0000000008236000-memory.dmp

memory/2404-209-0x0000000008840000-0x000000000888B000-memory.dmp

memory/2404-210-0x0000000008AB0000-0x0000000008B26000-memory.dmp

memory/2404-211-0x0000000009B10000-0x0000000009B2E000-memory.dmp

memory/2404-212-0x000000007EF30000-0x000000007EF31000-memory.dmp

memory/2404-217-0x0000000009C80000-0x0000000009D25000-memory.dmp

memory/2404-218-0x0000000009EA0000-0x0000000009F34000-memory.dmp

memory/2404-219-0x0000000007403000-0x0000000007404000-memory.dmp

memory/2404-412-0x0000000009E70000-0x0000000009E8A000-memory.dmp

memory/2404-417-0x0000000009E70000-0x0000000009E8A000-memory.dmp

memory/2404-418-0x0000000009E60000-0x0000000009E68000-memory.dmp

memory/2404-423-0x0000000009E60000-0x0000000009E68000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 1c19c16e21c97ed42d5beabc93391fc5
SHA1 8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA256 1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA512 7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

memory/1204-436-0x00000000045A0000-0x00000000045D6000-memory.dmp

memory/1204-437-0x0000000007050000-0x0000000007678000-memory.dmp

memory/1204-438-0x0000000006A10000-0x0000000006A11000-memory.dmp

memory/1204-439-0x0000000006A12000-0x0000000006A13000-memory.dmp

memory/1204-440-0x0000000007010000-0x0000000007032000-memory.dmp

memory/1204-441-0x0000000007A00000-0x0000000007A66000-memory.dmp

memory/1204-442-0x00000000076F0000-0x0000000007756000-memory.dmp

memory/1204-443-0x0000000007A70000-0x0000000007DC0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a76ffec12f485544a5f448dfa2e2ab3d
SHA1 643a49b8123aa1eac8396a0fbccbfc4d0e989f32
SHA256 a41bc189778bb2f6c16074c2083c642dc5b7ccc70c4a199e2d38df64c9352ac5
SHA512 84135e22fe9dca340280db0ffa28858f2a622ed3f60e74f8197a654dbd4d99d4c285e101c3e4f93162947351ef3940dbfa3b37184d40faa2773acad5bd5e3b27

memory/1204-445-0x0000000007E30000-0x0000000007E4C000-memory.dmp

memory/1204-446-0x0000000007FA0000-0x0000000007FEB000-memory.dmp

memory/1204-447-0x0000000008220000-0x0000000008296000-memory.dmp

memory/1204-457-0x0000000009210000-0x0000000009243000-memory.dmp

memory/1204-456-0x0000000007050000-0x0000000007678000-memory.dmp

memory/1204-458-0x0000000009210000-0x0000000009243000-memory.dmp

memory/1204-459-0x0000000007010000-0x0000000007032000-memory.dmp

memory/1204-461-0x00000000076F0000-0x0000000007756000-memory.dmp

memory/1204-460-0x0000000007A00000-0x0000000007A66000-memory.dmp

memory/1204-462-0x0000000007FA0000-0x0000000007FEB000-memory.dmp

memory/1204-463-0x0000000008220000-0x0000000008296000-memory.dmp

memory/1204-464-0x00000000091F0000-0x000000000920E000-memory.dmp

memory/1204-466-0x000000007EAD0000-0x000000007EAD1000-memory.dmp

memory/1204-470-0x0000000009260000-0x0000000009305000-memory.dmp

memory/1204-471-0x0000000009500000-0x0000000009594000-memory.dmp

memory/1204-540-0x0000000006A13000-0x0000000006A14000-memory.dmp

memory/1204-665-0x00000000094D0000-0x00000000094EA000-memory.dmp

memory/1204-670-0x00000000094D0000-0x00000000094EA000-memory.dmp

memory/1204-671-0x00000000094C0000-0x00000000094C8000-memory.dmp

memory/1204-676-0x00000000094C0000-0x00000000094C8000-memory.dmp