Malware Analysis Report

2024-09-22 14:41

Sample ID 220216-24s32aebg4
Target 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0
SHA256 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0
Tags
maze ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0

Threat Level: Known bad

The file 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0 was found to be: Known bad.

Malicious Activity Summary

maze ransomware spyware stealer trojan

Maze

Deletes shadow copies

Modifies extensions of user files

Reads user/profile data of web browsers

Drops startup file

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-02-16 23:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-16 23:08

Reported

2022-02-16 23:18

Platform

win7-en-20211208

Max time kernel

163s

Max time network

181s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe"

Signatures

Maze

trojan ransomware maze

Deletes shadow copies

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\ExitWait.crw => C:\Users\Admin\Pictures\ExitWait.crw.x0eG C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File renamed C:\Users\Admin\Pictures\ExpandConvertTo.png => C:\Users\Admin\Pictures\ExpandConvertTo.png.IEZ4 C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File renamed C:\Users\Admin\Pictures\ResumeBackup.tif => C:\Users\Admin\Pictures\ResumeBackup.tif.blNlG C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File renamed C:\Users\Admin\Pictures\SyncRestore.tif => C:\Users\Admin\Pictures\SyncRestore.tif.jgZVlX C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Users\Admin\Pictures\ConnectInvoke.tiff C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File renamed C:\Users\Admin\Pictures\ConnectInvoke.tiff => C:\Users\Admin\Pictures\ConnectInvoke.tiff.hv7ng1 C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File renamed C:\Users\Admin\Pictures\ConvertFromUse.png => C:\Users\Admin\Pictures\ConvertFromUse.png.hv7ng1 C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File renamed C:\Users\Admin\Pictures\NewSuspend.tif => C:\Users\Admin\Pictures\NewSuspend.tif.IEZ4 C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File renamed C:\Users\Admin\Pictures\SetMerge.crw => C:\Users\Admin\Pictures\SetMerge.crw.tCYI9r C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File renamed C:\Users\Admin\Pictures\TestCopy.crw => C:\Users\Admin\Pictures\TestCopy.crw.jgZVlX C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File renamed C:\Users\Admin\Pictures\CheckpointPush.raw => C:\Users\Admin\Pictures\CheckpointPush.raw.rnhp6 C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\892e099c951f85bc.tmp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A

Reads user/profile data of web browsers

spyware stealer

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\AddReset.au C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\MoveSend.001 C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ResumeSend.temp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\TraceSync.search-ms C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\EnableRequest.wma C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\FormatRestart.WTV C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\HideWrite.bat C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\InitializeSwitch.ttc C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\MountOpen.xltx C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\MoveMeasure.css C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\PopRead.pot C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ReceiveConvertFrom.wax C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ResolveConvert.docm C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\RestartCompare.wax C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\CompleteFormat.tmp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ExitSearch.html C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\RevokePublish.potx C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\892e099c951f85bc.tmp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\DenyExit.emf C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ExpandCheckpoint.ods C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\PublishOpen.ppsm C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files (x86)\892e099c951f85bc.tmp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\892e099c951f85bc.tmp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\LockRedo.pptm C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\RequestFind.3gpp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\RequestTrace.jpe C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\CheckpointRepair.xml C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\InitializeUnregister.wma C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\LimitEnable.rle C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File created C:\Program Files (x86)\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\892e099c951f85bc.tmp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File created C:\Program Files\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ApproveFormat.vst C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\AssertExpand.wma C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\DisableRename.potm C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\MeasureDisable.mpp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\PushSearch.rtf C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\RequestLimit.edrwx C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ResolveSwitch.ppt C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\RestartConvertFrom.raw C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\SwitchCompare.tiff C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\892e099c951f85bc.tmp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe

"C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbem\wmic.exe

"C:\ajqpk\..\Windows\dtox\oaoa\..\..\system32\rijci\wof\rmhli\..\..\..\wbem\hv\kqmsm\a\..\..\..\wmic.exe" shadowcopy delete

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}

Network

Country Destination Domain Proto
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp

Files

memory/1548-54-0x0000000076451000-0x0000000076453000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-16 23:08

Reported

2022-02-16 23:19

Platform

win10v2004-en-20220113

Max time kernel

166s

Max time network

181s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe"

Signatures

Maze

trojan ransomware maze

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\ClearUnlock.ico C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\SearchUndo.csv C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ShowSelect.xltm C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\WriteResume.vbs C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\HideRemove.vb C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\MergeComplete.i64 C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\RepairDisconnect.ADTS C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files (x86)\8802099c8c199081.tmp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\8802099c8c199081.tmp C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\DenyGrant.cab C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\DismountDebug.mov C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ExportConfirm.mpe C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\GroupAdd.rmi C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\RestartRemove.tiff C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File created C:\Program Files (x86)\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File created C:\Program Files\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ApproveRestart.potm C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\AssertMeasure.m3u C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\MeasureRename.vbs C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\OptimizePing.dotx C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\RevokeUnprotect.mpeg3 C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\StepExit.mht C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\CheckpointGet.iso C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ClearInvoke.vssx C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\CompareEdit.mp4v C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\CompareRevoke.xml C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ExportConfirm.odt C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ProtectMount.png C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ConvertEnter.dxf C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\CopyUnlock.mp4 C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\DisconnectWatch.docx C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\MergeConvert.TS C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\UnregisterImport.xla C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\ImportStep.mpeg2 C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\NewSplit.ico C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A
File opened for modification C:\Program Files\StartRename.xlt C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe

"C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

Network

Country Destination Domain Proto
RU 91.218.114.4:80 tcp
DE 67.24.27.254:80 tcp
DE 67.24.27.254:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp

Files

memory/1720-131-0x000001929B120000-0x000001929B130000-memory.dmp

memory/1720-130-0x000001929AB60000-0x000001929AB70000-memory.dmp

memory/1720-132-0x000001929D7E0000-0x000001929D7E4000-memory.dmp