Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08-04-2023 02:33
Static task
static1
Behavioral task
behavioral1
Sample
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe
Resource
win10v2004-20230220-en
General
-
Target
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe
-
Size
57KB
-
MD5
e76c5a5f3b8f69f6b390b812f24bb9af
-
SHA1
107102c804bffc23c2c61f4ec7e554e0d8bbadbb
-
SHA256
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e
-
SHA512
71570a395813b02ad1b25310c7fe6a9eae0ddce1e335c60ef4d23ab073c2566e7df4b15a9b69a2f76eb2cb9c29c89e4bb80d007b5c6a83a135802b10a4b98746
-
SSDEEP
1536:xNeRBl5PT/rx1mzwRMSTdLpJGiEXk2PNtQ:xQRrmzwR5Jm00LQ
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
class='mark'>[email protected]</span>
[email protected]</div>
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\Users\Admin\Desktop\info.hta
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 2044 bcdedit.exe 1824 bcdedit.exe 880 bcdedit.exe 268 bcdedit.exe -
Processes:
wbadmin.exewbadmin.exepid process 1892 wbadmin.exe 1276 wbadmin.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\MergeOut.tiff c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Drops startup file 3 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e = "C:\\Users\\Admin\\AppData\\Local\\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe" c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e = "C:\\Users\\Admin\\AppData\\Local\\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe" c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Documents\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Music\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZJ9QW42R\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Desktop\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8J80AB2T\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Libraries\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Music\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UVP2VCE7\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Videos\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Downloads\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Pictures\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8KR51HKN\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1914912747-3343861975-731272777-1000\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Links\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0P7N10G6\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Searches\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E01563NX\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\77C45YYF\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Drops file in Program Files directory 64 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01462_.WMF.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0230558.WMF.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImages.jpg.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\PREVIEW.GIF c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00636_.WMF c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\PREVIEW.GIF.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\WHOOSH.WAV.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\INLAUNCH.DLL.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\ExportSave.iso c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\SynchronizationEula.rtf c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00308_.WMF.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR15F.GIF.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Newsprint.dotx.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Paris.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01478U.BMP c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18220_.WMF c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MENU98.POC c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS98.POC.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\WMPDMC.exe.mui c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\THMBNAIL.PNG c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1CORE.DLL c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS.XML.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0149887.WMF c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\handsafe.reg c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Windows Mail\de-DE\msoeres.dll.mui c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00057_.WMF c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Essential.eftx.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL086.XML c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21495_.GIF.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GostTitle.XSL c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.id[7795AB23-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1140 vssadmin.exe 1116 vssadmin.exe -
Processes:
mshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exepid process 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe Token: SeBackupPrivilege 1044 vssvc.exe Token: SeRestorePrivilege 1044 vssvc.exe Token: SeAuditPrivilege 1044 vssvc.exe Token: SeIncreaseQuotaPrivilege 1192 WMIC.exe Token: SeSecurityPrivilege 1192 WMIC.exe Token: SeTakeOwnershipPrivilege 1192 WMIC.exe Token: SeLoadDriverPrivilege 1192 WMIC.exe Token: SeSystemProfilePrivilege 1192 WMIC.exe Token: SeSystemtimePrivilege 1192 WMIC.exe Token: SeProfSingleProcessPrivilege 1192 WMIC.exe Token: SeIncBasePriorityPrivilege 1192 WMIC.exe Token: SeCreatePagefilePrivilege 1192 WMIC.exe Token: SeBackupPrivilege 1192 WMIC.exe Token: SeRestorePrivilege 1192 WMIC.exe Token: SeShutdownPrivilege 1192 WMIC.exe Token: SeDebugPrivilege 1192 WMIC.exe Token: SeSystemEnvironmentPrivilege 1192 WMIC.exe Token: SeRemoteShutdownPrivilege 1192 WMIC.exe Token: SeUndockPrivilege 1192 WMIC.exe Token: SeManageVolumePrivilege 1192 WMIC.exe Token: 33 1192 WMIC.exe Token: 34 1192 WMIC.exe Token: 35 1192 WMIC.exe Token: SeIncreaseQuotaPrivilege 1192 WMIC.exe Token: SeSecurityPrivilege 1192 WMIC.exe Token: SeTakeOwnershipPrivilege 1192 WMIC.exe Token: SeLoadDriverPrivilege 1192 WMIC.exe Token: SeSystemProfilePrivilege 1192 WMIC.exe Token: SeSystemtimePrivilege 1192 WMIC.exe Token: SeProfSingleProcessPrivilege 1192 WMIC.exe Token: SeIncBasePriorityPrivilege 1192 WMIC.exe Token: SeCreatePagefilePrivilege 1192 WMIC.exe Token: SeBackupPrivilege 1192 WMIC.exe Token: SeRestorePrivilege 1192 WMIC.exe Token: SeShutdownPrivilege 1192 WMIC.exe Token: SeDebugPrivilege 1192 WMIC.exe Token: SeSystemEnvironmentPrivilege 1192 WMIC.exe Token: SeRemoteShutdownPrivilege 1192 WMIC.exe Token: SeUndockPrivilege 1192 WMIC.exe Token: SeManageVolumePrivilege 1192 WMIC.exe Token: 33 1192 WMIC.exe Token: 34 1192 WMIC.exe Token: 35 1192 WMIC.exe Token: SeBackupPrivilege 1624 wbengine.exe Token: SeRestorePrivilege 1624 wbengine.exe Token: SeSecurityPrivilege 1624 wbengine.exe Token: SeIncreaseQuotaPrivilege 1448 WMIC.exe Token: SeSecurityPrivilege 1448 WMIC.exe Token: SeTakeOwnershipPrivilege 1448 WMIC.exe Token: SeLoadDriverPrivilege 1448 WMIC.exe Token: SeSystemProfilePrivilege 1448 WMIC.exe Token: SeSystemtimePrivilege 1448 WMIC.exe Token: SeProfSingleProcessPrivilege 1448 WMIC.exe Token: SeIncBasePriorityPrivilege 1448 WMIC.exe Token: SeCreatePagefilePrivilege 1448 WMIC.exe Token: SeBackupPrivilege 1448 WMIC.exe Token: SeRestorePrivilege 1448 WMIC.exe Token: SeShutdownPrivilege 1448 WMIC.exe Token: SeDebugPrivilege 1448 WMIC.exe Token: SeSystemEnvironmentPrivilege 1448 WMIC.exe Token: SeRemoteShutdownPrivilege 1448 WMIC.exe Token: SeUndockPrivilege 1448 WMIC.exe Token: SeManageVolumePrivilege 1448 WMIC.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.execmd.execmd.execmd.exedescription pid process target process PID 1520 wrote to memory of 1196 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1520 wrote to memory of 1196 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1520 wrote to memory of 1196 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1520 wrote to memory of 1196 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1520 wrote to memory of 428 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1520 wrote to memory of 428 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1520 wrote to memory of 428 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1520 wrote to memory of 428 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1196 wrote to memory of 1140 1196 cmd.exe vssadmin.exe PID 1196 wrote to memory of 1140 1196 cmd.exe vssadmin.exe PID 1196 wrote to memory of 1140 1196 cmd.exe vssadmin.exe PID 428 wrote to memory of 1064 428 cmd.exe netsh.exe PID 428 wrote to memory of 1064 428 cmd.exe netsh.exe PID 428 wrote to memory of 1064 428 cmd.exe netsh.exe PID 428 wrote to memory of 1680 428 cmd.exe netsh.exe PID 428 wrote to memory of 1680 428 cmd.exe netsh.exe PID 428 wrote to memory of 1680 428 cmd.exe netsh.exe PID 1196 wrote to memory of 1192 1196 cmd.exe WMIC.exe PID 1196 wrote to memory of 1192 1196 cmd.exe WMIC.exe PID 1196 wrote to memory of 1192 1196 cmd.exe WMIC.exe PID 1196 wrote to memory of 2044 1196 cmd.exe bcdedit.exe PID 1196 wrote to memory of 2044 1196 cmd.exe bcdedit.exe PID 1196 wrote to memory of 2044 1196 cmd.exe bcdedit.exe PID 1196 wrote to memory of 1824 1196 cmd.exe bcdedit.exe PID 1196 wrote to memory of 1824 1196 cmd.exe bcdedit.exe PID 1196 wrote to memory of 1824 1196 cmd.exe bcdedit.exe PID 1196 wrote to memory of 1892 1196 cmd.exe wbadmin.exe PID 1196 wrote to memory of 1892 1196 cmd.exe wbadmin.exe PID 1196 wrote to memory of 1892 1196 cmd.exe wbadmin.exe PID 1520 wrote to memory of 2044 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 2044 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 2044 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 2044 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 1944 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 1944 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 1944 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 1944 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 804 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 804 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 804 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 804 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1520 wrote to memory of 888 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1520 wrote to memory of 888 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1520 wrote to memory of 888 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1520 wrote to memory of 888 1520 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 888 wrote to memory of 1116 888 cmd.exe vssadmin.exe PID 888 wrote to memory of 1116 888 cmd.exe vssadmin.exe PID 888 wrote to memory of 1116 888 cmd.exe vssadmin.exe PID 888 wrote to memory of 1448 888 cmd.exe WMIC.exe PID 888 wrote to memory of 1448 888 cmd.exe WMIC.exe PID 888 wrote to memory of 1448 888 cmd.exe WMIC.exe PID 888 wrote to memory of 880 888 cmd.exe bcdedit.exe PID 888 wrote to memory of 880 888 cmd.exe bcdedit.exe PID 888 wrote to memory of 880 888 cmd.exe bcdedit.exe PID 888 wrote to memory of 268 888 cmd.exe bcdedit.exe PID 888 wrote to memory of 268 888 cmd.exe bcdedit.exe PID 888 wrote to memory of 268 888 cmd.exe bcdedit.exe PID 888 wrote to memory of 1276 888 cmd.exe wbadmin.exe PID 888 wrote to memory of 1276 888 cmd.exe wbadmin.exe PID 888 wrote to memory of 1276 888 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe"C:\Users\Admin\AppData\Local\Temp\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe"C:\Users\Admin\AppData\Local\Temp\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe"2⤵PID:1500
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1140
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2044
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1824
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1892
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
PID:1064
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:1680
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2044
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:1944
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:804
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1116
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:880
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:268
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1276
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1596
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:432
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[7795AB23-3390].[[email protected]].fopra
Filesize143.1MB
MD59327ba7dcf654c050571dbb02698b1c3
SHA1a1038392c3f0f150b7d39efea811bd2cb624c3f3
SHA2563fe34543b6a544ecc484049e2a89250ed266eb8e672ea9c4d7b2777cf8ceff42
SHA51298b24b14363d843d59200496e48a5cff958d0e963d9da03a2ca0055b44baf38434224af4d71c0eb25a4b60a534b00a055d2f749accabf157da16b965407e3d98
-
Filesize
5KB
MD5fa1c08bf2c4d7bc348a2670664742fb9
SHA12462ec6605a813abce320bc4b5a0cd1c1866d8bb
SHA2561d915e5035149f48c62bd4a0be485f119366fa26cfd49aaecf99f18a23822c2b
SHA512c8d1745986a3b4509fe4c24bb18afa4b7a6c01c178d7facc10ca12f26d0479f624990b964bb9fb70080e14c444fbfecddbc61b46eab03009c01248c745d2ce56
-
Filesize
5KB
MD5fa1c08bf2c4d7bc348a2670664742fb9
SHA12462ec6605a813abce320bc4b5a0cd1c1866d8bb
SHA2561d915e5035149f48c62bd4a0be485f119366fa26cfd49aaecf99f18a23822c2b
SHA512c8d1745986a3b4509fe4c24bb18afa4b7a6c01c178d7facc10ca12f26d0479f624990b964bb9fb70080e14c444fbfecddbc61b46eab03009c01248c745d2ce56
-
Filesize
5KB
MD5fa1c08bf2c4d7bc348a2670664742fb9
SHA12462ec6605a813abce320bc4b5a0cd1c1866d8bb
SHA2561d915e5035149f48c62bd4a0be485f119366fa26cfd49aaecf99f18a23822c2b
SHA512c8d1745986a3b4509fe4c24bb18afa4b7a6c01c178d7facc10ca12f26d0479f624990b964bb9fb70080e14c444fbfecddbc61b46eab03009c01248c745d2ce56
-
Filesize
5KB
MD5fa1c08bf2c4d7bc348a2670664742fb9
SHA12462ec6605a813abce320bc4b5a0cd1c1866d8bb
SHA2561d915e5035149f48c62bd4a0be485f119366fa26cfd49aaecf99f18a23822c2b
SHA512c8d1745986a3b4509fe4c24bb18afa4b7a6c01c178d7facc10ca12f26d0479f624990b964bb9fb70080e14c444fbfecddbc61b46eab03009c01248c745d2ce56