Malware Analysis Report

2024-09-22 14:41

Sample ID 220216-27pj1sfden
Target 04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e
SHA256 04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e
Tags
maze ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e

Threat Level: Known bad

The file 04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e was found to be: Known bad.

Malicious Activity Summary

maze ransomware spyware stealer trojan

Maze

Deletes shadow copies

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-02-16 23:13

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-16 23:13

Reported

2022-02-16 23:22

Platform

win7-en-20211208

Max time kernel

168s

Max time network

175s

Command Line

"C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe"

Signatures

Maze

trojan ransomware maze

Deletes shadow copies

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\RepairEdit.tiff C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File renamed C:\Users\Admin\Pictures\RepairEdit.tiff => C:\Users\Admin\Pictures\RepairEdit.tiff.mabJ9hx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File renamed C:\Users\Admin\Pictures\RestoreSwitch.png => C:\Users\Admin\Pictures\RestoreSwitch.png.mabJ9hx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File renamed C:\Users\Admin\Pictures\StopSync.crw => C:\Users\Admin\Pictures\StopSync.crw.mabJ9hx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Users\Admin\Pictures\TestPing.tiff C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File renamed C:\Users\Admin\Pictures\TestPing.tiff => C:\Users\Admin\Pictures\TestPing.tiff.SFt7lQ6 C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File renamed C:\Users\Admin\Pictures\PingShow.png => C:\Users\Admin\Pictures\PingShow.png.PxlN0X C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\892e099ca81afa11.tmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A

Reads user/profile data of web browsers

spyware stealer

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\CompleteConvert.dxf C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\EnterBlock.xlsb C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\RestartDismount.mhtml C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\StepDeny.vst C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\SkipOpen.mp4 C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\SubmitReset.wps C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\892e099ca81afa11.tmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\AddCompare.wmv C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\CopyOpen.png C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\InvokeCopy.dwfx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\MeasureGroup.xlsm C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\OutUnpublish.jpg C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\UnblockRemove.docx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\892e099ca81afa11.tmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\ApproveSplit.asx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\ConfirmDisable.vsdx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\CopyMove.DVR C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\EnableSubmit.ocx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\FormatBackup.wmf C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\RevokeSwitch.pub C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\MoveUndo.vbs C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\PopEnable.mid C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File created C:\Program Files\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\BackupGet.mp3 C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\RegisterUnprotect.vdx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\TraceBlock.png C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\892e099ca81afa11.tmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\ConfirmUndo.bmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\ConvertFromMeasure.vb C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\MoveRestore.3gp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\PingCopy.bmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\RegisterStart.ppt C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\ShowGet.mpp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\ExitDebug.vb C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\ProtectStep.vsw C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\UnlockUndo.scf C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files (x86)\892e099ca81afa11.tmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\892e099ca81afa11.tmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\CompressShow.xlsm C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\DenyTest.inf C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\ExportEnable.pcx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\HideSet.dwfx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\SplitRepair.vstx C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File created C:\Program Files (x86)\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe

"C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbem\wmic.exe

"C:\kl\du\uy\..\..\..\Windows\tvc\deg\wd\..\..\..\system32\wlh\..\wbem\eewx\..\wmic.exe" shadowcopy delete

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}

Network

Country Destination Domain Proto
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.11:80 tcp

Files

memory/832-54-0x0000000075891000-0x0000000075893000-memory.dmp

memory/832-56-0x0000000002131000-0x0000000002135000-memory.dmp

memory/832-57-0x0000000000400000-0x000000000045D000-memory.dmp

memory/832-58-0x0000000000400000-0x00000000006AB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-16 23:13

Reported

2022-02-16 23:22

Platform

win10v2004-en-20220113

Max time kernel

184s

Max time network

197s

Command Line

"C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe"

Signatures

Maze

trojan ransomware maze

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8802099c16c7c49d.tmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\8802099c16c7c49d.tmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\DisableStop.mhtml C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\ExitTrace.jpeg C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\InitializeBlock.mp3 C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\ProtectUpdate.ps1 C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File created C:\Program Files\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\8802099c16c7c49d.tmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\CompleteGrant.vsdm C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\ConvertDisable.pptm C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\RenameCheckpoint.zip C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\WatchRemove.xla C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\WatchUnlock.AAC C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files (x86)\8802099c16c7c49d.tmp C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\PingNew.jpeg C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File created C:\Program Files (x86)\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\SelectSync.fon C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\SendCopy.pptm C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\SyncInstall.png C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\WaitUndo.jpg C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\MountDeny.html C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\RevokeUpdate.mov C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\SubmitWait.tiff C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A
File opened for modification C:\Program Files\TestAssert.m4a C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe

"C:\Users\Admin\AppData\Local\Temp\04e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

Network

Country Destination Domain Proto
NL 104.110.191.133:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.11:80 tcp

Files

memory/2104-131-0x0000000002AB0000-0x0000000002AB3000-memory.dmp

memory/2104-133-0x0000000000400000-0x00000000006AB000-memory.dmp

memory/2104-132-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4192-135-0x00000163DD560000-0x00000163DD570000-memory.dmp

memory/4192-136-0x00000163DDB20000-0x00000163DDB30000-memory.dmp

memory/4192-137-0x00000163E01B0000-0x00000163E01B4000-memory.dmp