Malware Analysis Report

2024-09-22 14:40

Sample ID 220216-226w4sebe4
Target 3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3
SHA256 3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3
Tags
maze ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3

Threat Level: Known bad

The file 3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3 was found to be: Known bad.

Malicious Activity Summary

maze ransomware spyware stealer trojan

Maze

Deletes shadow copies

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-02-16 23:05

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-16 23:05

Reported

2022-02-16 23:15

Platform

win7-en-20211208

Max time kernel

168s

Max time network

194s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe"

Signatures

Maze

trojan ransomware maze

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\SkipRename.tiff => C:\Users\Admin\Pictures\SkipRename.tiff.fdR2hcJ C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File renamed C:\Users\Admin\Pictures\UnpublishAssert.png => C:\Users\Admin\Pictures\UnpublishAssert.png.fdR2hcJ C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File renamed C:\Users\Admin\Pictures\BlockUnblock.tif => C:\Users\Admin\Pictures\BlockUnblock.tif.9Q0TF C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File renamed C:\Users\Admin\Pictures\MoveResume.crw => C:\Users\Admin\Pictures\MoveResume.crw.NkPvDR C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File renamed C:\Users\Admin\Pictures\PublishBackup.crw => C:\Users\Admin\Pictures\PublishBackup.crw.wXVD7Gt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File renamed C:\Users\Admin\Pictures\RemoveTrace.png => C:\Users\Admin\Pictures\RemoveTrace.png.wXVD7Gt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File renamed C:\Users\Admin\Pictures\ResetConnect.crw => C:\Users\Admin\Pictures\ResetConnect.crw.wXVD7Gt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Users\Admin\Pictures\SkipRename.tiff C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\88380999342c6eb9.tmp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\ApproveSkip.otf C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\RestoreSplit.jfif C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\88380999342c6eb9.tmp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\ConnectMount.css C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\DismountExpand.temp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\UpdateStart.wmv C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File created C:\Program Files (x86)\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files (x86)\88380999342c6eb9.tmp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\DenyWrite.otf C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\DismountUnpublish.crw C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\EditInvoke.dotm C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\MergeDismount.DVR C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\RevokePublish.odt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\UndoWrite.m4v C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\DebugConvertFrom.vsw C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\RemoveCopy.m4v C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\RenameSwitch.vbe C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\UnblockMove.ico C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\88380999342c6eb9.tmp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File created C:\Program Files\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\AddNew.tmp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\ExportDisconnect.jtx C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\LimitPublish.001 C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\ResolveUnprotect.wmv C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\SplitUnprotect.scf C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\ImportRestore.xps C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\ReceiveFormat.mov C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\RedoDismount.M2V C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\UnblockCompress.js C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\88380999342c6eb9.tmp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\CompressShow.xls C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\FindResume.tif C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\MergeRevoke.emf C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\SuspendShow.pot C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\UnlockMerge.xht C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\UnprotectRestore.txt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\RestartRedo.pot C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\SelectDebug.tif C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\CheckpointRequest.TTS C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\DismountSelect.png C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\HideRestart.wma C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\PublishWait.jpeg C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\PushAdd.css C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\RedoReceive.tiff C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\88380999342c6eb9.tmp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe

"C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.25:80 tcp

Files

memory/1672-55-0x0000000075801000-0x0000000075803000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-16 23:05

Reported

2022-02-16 23:14

Platform

win10v2004-en-20220113

Max time kernel

164s

Max time network

186s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe"

Signatures

Maze

trojan ransomware maze

Deletes shadow copies

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\AssertUnlock.crw => C:\Users\Admin\Pictures\AssertUnlock.crw.Wx9t C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File renamed C:\Users\Admin\Pictures\ClearReset.raw => C:\Users\Admin\Pictures\ClearReset.raw.kst8z C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Users\Admin\Pictures\InitializeExit.tiff C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File renamed C:\Users\Admin\Pictures\InitializeExit.tiff => C:\Users\Admin\Pictures\InitializeExit.tiff.kst8z C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File renamed C:\Users\Admin\Pictures\ResolveInvoke.png => C:\Users\Admin\Pictures\ResolveInvoke.png.UVrMBe C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File renamed C:\Users\Admin\Pictures\UpdateShow.tif => C:\Users\Admin\Pictures\UpdateShow.tif.Oyv8yLy C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File renamed C:\Users\Admin\Pictures\ApproveNew.crw => C:\Users\Admin\Pictures\ApproveNew.crw.Wx9t C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\8802099c59a08dfe.tmp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8802099c59a08dfe.tmp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A

Reads user/profile data of web browsers

spyware stealer

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\PingOptimize.mpeg C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\SetResolve.mp2 C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\SwitchUnregister.pptm C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\WatchUnprotect.bat C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\BlockUndo.zip C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\ConfirmUnblock.htm C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\ExportCheckpoint.MOD C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\OpenMount.pub C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files (x86)\8802099c59a08dfe.tmp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\CloseExit.mp4 C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\UpdateUnblock.vsx C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File created C:\Program Files (x86)\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\EnableJoin.wma C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\InstallWrite.mhtml C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\ResizeSearch.xlsb C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\SetStop.ico C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\8802099c59a08dfe.tmp C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\ApproveRemove.pps C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\ApproveResolve.mp2 C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\EditPop.pptm C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\SplitRestart.bat C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File created C:\Program Files\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\FormatRequest.3gp2 C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\LockClear.tiff C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A
File opened for modification C:\Program Files\SwitchSubmit.html C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe

"C:\Users\Admin\AppData\Local\Temp\3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbem\wmic.exe

"C:\n\cdceg\imrm\..\..\..\Windows\fcrb\ht\..\..\system32\bu\ey\vforu\..\..\..\wbem\eivi\..\wmic.exe" shadowcopy delete

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x38c 0x498

Network

Country Destination Domain Proto
NL 67.26.111.254:80 tcp
NL 67.26.111.254:80 tcp
NL 67.26.111.254:80 tcp
NL 67.26.111.254:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.25:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.25:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.26:80 91.218.114.26 tcp
RU 91.218.114.26:80 91.218.114.26 tcp
RU 91.218.114.31:80 tcp

Files

memory/1068-130-0x0000021199F90000-0x0000021199FA0000-memory.dmp

memory/1068-131-0x000002119A620000-0x000002119A630000-memory.dmp

memory/1068-132-0x000002119CD10000-0x000002119CD14000-memory.dmp