Malware Analysis Report

2024-09-22 14:42

Sample ID 220724-z4k2bagfe6
Target 877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb
SHA256 877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb
Tags
maze ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb

Threat Level: Known bad

The file 877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb was found to be: Known bad.

Malicious Activity Summary

maze ransomware spyware stealer trojan

Maze

Deletes shadow copies

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Drops file in Program Files directory

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-07-24 21:16

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-24 21:16

Reported

2022-07-25 17:58

Platform

win7-20220718-en

Max time kernel

151s

Max time network

172s

Command Line

"C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe"

Signatures

Maze

trojan ransomware maze

Deletes shadow copies

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\UnregisterConnect.png => C:\Users\Admin\Pictures\UnregisterConnect.png.wbamD C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File renamed C:\Users\Admin\Pictures\AssertConvert.png => C:\Users\Admin\Pictures\AssertConvert.png.fRSj3 C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Users\Admin\Pictures\ConfirmCompress.tiff C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Users\Admin\Pictures\NewSuspend.tiff C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File renamed C:\Users\Admin\Pictures\NewSuspend.tiff => C:\Users\Admin\Pictures\NewSuspend.tiff.sIyU C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File renamed C:\Users\Admin\Pictures\RestoreClear.raw => C:\Users\Admin\Pictures\RestoreClear.raw.sIyU C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File renamed C:\Users\Admin\Pictures\ConfirmCompress.tiff => C:\Users\Admin\Pictures\ConfirmCompress.tiff.fRSj3 C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File renamed C:\Users\Admin\Pictures\ConvertFromDisconnect.png => C:\Users\Admin\Pictures\ConvertFromDisconnect.png.fRSj3 C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File renamed C:\Users\Admin\Pictures\NewBackup.tif => C:\Users\Admin\Pictures\NewBackup.tif.sIyU C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File renamed C:\Users\Admin\Pictures\RestoreFind.crw => C:\Users\Admin\Pictures\RestoreFind.crw.sIyU C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File renamed C:\Users\Admin\Pictures\TestWait.crw => C:\Users\Admin\Pictures\TestWait.crw.sIyU C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8798098848a9e75a.tmp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A

Reads user/profile data of web browsers

spyware stealer

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\UndoUnprotect.3g2 C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\8798098848a9e75a.tmp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\8798098848a9e75a.tmp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\8798098848a9e75a.tmp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\CompareDebug.bmp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\CopyFind.ttf C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\RedoWait.ram C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\SelectMove.temp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File created C:\Program Files (x86)\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\InvokeConvertFrom.tif C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\JoinCopy.mp4 C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\NewWait.au3 C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\ResolveFormat.eps C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File created C:\Program Files\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\AssertInvoke.ico C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\8798098848a9e75a.tmp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\AssertLock.m4a C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\BackupNew.shtml C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\WatchSearch.M2TS C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files (x86)\8798098848a9e75a.tmp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe

"C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbem\wmic.exe

"C:\xfbwy\ljeqg\..\..\Windows\dlub\g\..\..\system32\qu\kvm\unc\..\..\..\wbem\knok\..\wmic.exe" shadowcopy delete

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x568

Network

Country Destination Domain Proto
RU 91.218.114.4:80 91.218.114.4 tcp
RU 91.218.114.4:80 91.218.114.4 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.4:80 91.218.114.4 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.25:80 tcp
RU 91.218.114.25:80 tcp
RU 91.218.114.25:80 tcp
RU 91.218.114.25:80 tcp
RU 91.218.114.25:80 tcp

Files

memory/1780-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

memory/1780-55-0x0000000000400000-0x000000000051B000-memory.dmp

memory/1780-56-0x0000000001D50000-0x0000000001E03000-memory.dmp

memory/1780-57-0x0000000000400000-0x000000000051B000-memory.dmp

memory/1780-58-0x0000000000400000-0x000000000051B000-memory.dmp

memory/1760-59-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-24 21:16

Reported

2022-07-25 17:59

Platform

win10v2004-20220721-en

Max time kernel

149s

Max time network

172s

Command Line

"C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe"

Signatures

Maze

trojan ransomware maze

Deletes shadow copies

ransomware

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\8712097de3d01abf.tmp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8712097de3d01abf.tmp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A

Reads user/profile data of web browsers

spyware stealer

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\8712097de3d01abf.tmp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\LockFormat.mpv2 C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\PingResume.ppt C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\RevokeCompress.pot C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\RevokeTest.jpeg C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\SendWait.dotx C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\WaitSubmit.mpeg2 C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File created C:\Program Files\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\CompressPublish.vsx C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\ConfirmUndo.TS C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\RemoveFormat.wpl C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File created C:\Program Files (x86)\DECRYPT-FILES.txt C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\PushDebug.mp4v C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files\StartWrite.xlsb C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A
File opened for modification C:\Program Files (x86)\8712097de3d01abf.tmp C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe

"C:\Users\Admin\AppData\Local\Temp\877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbem\wmic.exe

"C:\qp\li\nw\..\..\..\Windows\ewvku\..\system32\i\d\nerf\..\..\..\wbem\ls\..\wmic.exe" shadowcopy delete

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x30c 0x240

Network

Country Destination Domain Proto
NL 67.26.105.254:80 tcp
NL 88.221.144.170:80 tcp
RU 91.218.114.4:80 tcp
NL 40.126.32.140:443 tcp
FR 2.18.109.224:443 tcp
US 52.152.110.14:443 tcp
RU 91.218.114.4:80 tcp
US 93.184.221.240:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.4:80 tcp
US 204.79.197.200:443 www.bing.com tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.25:80 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.25:80 tcp
RU 91.218.114.25:80 tcp
RU 91.218.114.26:80 tcp
RU 91.218.114.25:80 tcp

Files

memory/3332-130-0x0000000000400000-0x000000000051B000-memory.dmp

memory/3332-131-0x0000000000AC0000-0x0000000000B73000-memory.dmp

memory/3332-132-0x0000000000400000-0x000000000051B000-memory.dmp

memory/3036-133-0x0000000000000000-mapping.dmp