Analysis
-
max time kernel
100s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 02:56
Static task
static1
Behavioral task
behavioral1
Sample
de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe
Resource
win10v2004-20220414-en
General
-
Target
de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe
-
Size
195KB
-
MD5
e6d10e0728948343745188e29e9e4c0a
-
SHA1
e97a20c518c9ecbb2b05a52b815809224d418821
-
SHA256
de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4
-
SHA512
877b447fa337bd88b601ea7048ee76ee76afaec8749dd978d847827554571be9e18d22f4fa28b300b2317c61b30ca488c893458e00b3ac0f75bfb9121d422651
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 4100 created 3388 4100 svchost.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 1996 bcdedit.exe 1876 bcdedit.exe -
Processes:
wbadmin.exepid process 4324 wbadmin.exe -
Drops startup file 1 IoCs
Processes:
de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4 = "C:\\Users\\Admin\\AppData\\Local\\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe" de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4 = "C:\\Users\\Admin\\AppData\\Local\\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe" de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\desktop.ini de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exede7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exedescription pid process target process PID 2688 set thread context of 3388 2688 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4264 set thread context of 4108 4264 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe -
Drops file in Program Files directory 40 IoCs
Processes:
de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7-zip.chm de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\descript.ion.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\History.txt de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\7-zip.dll.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\7-zip32.dll.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\7z.exe.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\7z.sfx.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\7zG.exe.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\Lang\ar.txt.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\7z.dll.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\7zG.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\History.txt.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\Lang\af.txt.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\Lang\bg.txt.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\descript.ion de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\Lang\ba.txt.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\7z.sfx de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\Lang\bn.txt.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\Lang\an.txt.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\Lang\ast.txt.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\7-zip.chm.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\7z.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\Lang\be.txt.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\7zCon.sfx.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\7zFM.exe.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File created C:\Program Files\7-Zip\Lang\az.txt.id[1DBD89E3-2275].[[email protected]].eking de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1072 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exepid process 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
svchost.exede7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exevssvc.exeWMIC.exedescription pid process Token: SeTcbPrivilege 4100 svchost.exe Token: SeTcbPrivilege 4100 svchost.exe Token: SeDebugPrivilege 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe Token: SeBackupPrivilege 3876 vssvc.exe Token: SeRestorePrivilege 3876 vssvc.exe Token: SeAuditPrivilege 3876 vssvc.exe Token: SeIncreaseQuotaPrivilege 3828 WMIC.exe Token: SeSecurityPrivilege 3828 WMIC.exe Token: SeTakeOwnershipPrivilege 3828 WMIC.exe Token: SeLoadDriverPrivilege 3828 WMIC.exe Token: SeSystemProfilePrivilege 3828 WMIC.exe Token: SeSystemtimePrivilege 3828 WMIC.exe Token: SeProfSingleProcessPrivilege 3828 WMIC.exe Token: SeIncBasePriorityPrivilege 3828 WMIC.exe Token: SeCreatePagefilePrivilege 3828 WMIC.exe Token: SeBackupPrivilege 3828 WMIC.exe Token: SeRestorePrivilege 3828 WMIC.exe Token: SeShutdownPrivilege 3828 WMIC.exe Token: SeDebugPrivilege 3828 WMIC.exe Token: SeSystemEnvironmentPrivilege 3828 WMIC.exe Token: SeRemoteShutdownPrivilege 3828 WMIC.exe Token: SeUndockPrivilege 3828 WMIC.exe Token: SeManageVolumePrivilege 3828 WMIC.exe Token: 33 3828 WMIC.exe Token: 34 3828 WMIC.exe Token: 35 3828 WMIC.exe Token: 36 3828 WMIC.exe Token: SeIncreaseQuotaPrivilege 3828 WMIC.exe Token: SeSecurityPrivilege 3828 WMIC.exe Token: SeTakeOwnershipPrivilege 3828 WMIC.exe Token: SeLoadDriverPrivilege 3828 WMIC.exe Token: SeSystemProfilePrivilege 3828 WMIC.exe Token: SeSystemtimePrivilege 3828 WMIC.exe Token: SeProfSingleProcessPrivilege 3828 WMIC.exe Token: SeIncBasePriorityPrivilege 3828 WMIC.exe Token: SeCreatePagefilePrivilege 3828 WMIC.exe Token: SeBackupPrivilege 3828 WMIC.exe Token: SeRestorePrivilege 3828 WMIC.exe Token: SeShutdownPrivilege 3828 WMIC.exe Token: SeDebugPrivilege 3828 WMIC.exe Token: SeSystemEnvironmentPrivilege 3828 WMIC.exe Token: SeRemoteShutdownPrivilege 3828 WMIC.exe Token: SeUndockPrivilege 3828 WMIC.exe Token: SeManageVolumePrivilege 3828 WMIC.exe Token: 33 3828 WMIC.exe Token: 34 3828 WMIC.exe Token: 35 3828 WMIC.exe Token: 36 3828 WMIC.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exesvchost.exede7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exede7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.execmd.exedescription pid process target process PID 2688 wrote to memory of 3388 2688 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 2688 wrote to memory of 3388 2688 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 2688 wrote to memory of 3388 2688 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 2688 wrote to memory of 3388 2688 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 2688 wrote to memory of 3388 2688 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 2688 wrote to memory of 3388 2688 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 2688 wrote to memory of 3388 2688 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 2688 wrote to memory of 3388 2688 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 2688 wrote to memory of 3388 2688 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 2688 wrote to memory of 3388 2688 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4100 wrote to memory of 4264 4100 svchost.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4100 wrote to memory of 4264 4100 svchost.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4100 wrote to memory of 4264 4100 svchost.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4264 wrote to memory of 4108 4264 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4264 wrote to memory of 4108 4264 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4264 wrote to memory of 4108 4264 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4264 wrote to memory of 4108 4264 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4264 wrote to memory of 4108 4264 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4264 wrote to memory of 4108 4264 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4264 wrote to memory of 4108 4264 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4264 wrote to memory of 4108 4264 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4264 wrote to memory of 4108 4264 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 4264 wrote to memory of 4108 4264 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe PID 3388 wrote to memory of 1712 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe cmd.exe PID 3388 wrote to memory of 1712 3388 de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe cmd.exe PID 1712 wrote to memory of 1072 1712 cmd.exe vssadmin.exe PID 1712 wrote to memory of 1072 1712 cmd.exe vssadmin.exe PID 1712 wrote to memory of 3828 1712 cmd.exe WMIC.exe PID 1712 wrote to memory of 3828 1712 cmd.exe WMIC.exe PID 1712 wrote to memory of 1996 1712 cmd.exe bcdedit.exe PID 1712 wrote to memory of 1996 1712 cmd.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe"C:\Users\Admin\AppData\Local\Temp\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe"{path}"2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe"C:\Users\Admin\AppData\Local\Temp\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe"{path}"4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\de7350681f5bacfaeceaff015c0ec34028ac1edaaec70ff4f3641006039d7de4.exe.logFilesize
496B
MD5cb76b18ebed3a9f05a14aed43d35fba6
SHA1836a4b4e351846fca08b84149cb734cb59b8c0d6
SHA2568d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349
SHA5127631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c
-
memory/1072-145-0x0000000000000000-mapping.dmp
-
memory/1712-144-0x0000000000000000-mapping.dmp
-
memory/1876-148-0x0000000000000000-mapping.dmp
-
memory/1996-147-0x0000000000000000-mapping.dmp
-
memory/2688-130-0x0000000075320000-0x00000000758D1000-memory.dmpFilesize
5.7MB
-
memory/3388-132-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3388-134-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3388-131-0x0000000000000000-mapping.dmp
-
memory/3388-137-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3828-146-0x0000000000000000-mapping.dmp
-
memory/4108-143-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4108-139-0x0000000000000000-mapping.dmp
-
memory/4264-138-0x00000000753C0000-0x0000000075971000-memory.dmpFilesize
5.7MB
-
memory/4264-135-0x0000000000000000-mapping.dmp
-
memory/4324-149-0x0000000000000000-mapping.dmp