Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2023 02:33
Static task
static1
Behavioral task
behavioral1
Sample
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe
Resource
win10v2004-20230220-en
General
-
Target
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe
-
Size
57KB
-
MD5
e76c5a5f3b8f69f6b390b812f24bb9af
-
SHA1
107102c804bffc23c2c61f4ec7e554e0d8bbadbb
-
SHA256
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e
-
SHA512
71570a395813b02ad1b25310c7fe6a9eae0ddce1e335c60ef4d23ab073c2566e7df4b15a9b69a2f76eb2cb9c29c89e4bb80d007b5c6a83a135802b10a4b98746
-
SSDEEP
1536:xNeRBl5PT/rx1mzwRMSTdLpJGiEXk2PNtQ:xQRrmzwR5Jm00LQ
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
class='mark'>[email protected]</span>
[email protected]</div>
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\users\public\desktop\info.hta
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 4832 bcdedit.exe 4260 bcdedit.exe 1752 bcdedit.exe 1816 bcdedit.exe -
Processes:
wbadmin.exewbadmin.exepid process 1220 wbadmin.exe 1588 wbadmin.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Drops startup file 3 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e = "C:\\Users\\Admin\\AppData\\Local\\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe" c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e = "C:\\Users\\Admin\\AppData\\Local\\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe" c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Documents\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Links\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Music\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Downloads\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Libraries\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Videos\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Music\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\Searches\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Pictures\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Public\Desktop\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Drops file in Program Files directory 64 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\move.svg c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsBadge.contrast-white_scale-100.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Other.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\glib-lite.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_SplashScreen.scale-200.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\sound.properties c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\hxoutlookintl.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView-Dark.scale-100.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\REFSAN.TTF c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\ui-strings.js.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_uk.dll.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\Fonts\PplMDL2.3.07.ttf c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\MSFT_PackageManagementSource.strings.psd1 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxAccountsStoreLogo.scale-100.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\7-Zip\Lang\uk.txt.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBOB6.CHM c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\ApplySticker.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-256.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-150_contrast-white.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\ShareLogo_15px.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadds.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_thumbnailview_18.svg.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Microsoft Office\root\Office16\PowerPointInterProviderRanker.bin.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Internet Explorer\images\bing.ico c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.ComponentModel.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.CoreProviders.dll.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-200_contrast-white.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.ELM.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-100_contrast-black.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\combine_poster.jpg c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-125_contrast-white.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\BadgeLogo.scale-200_contrast-white.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlOuterCircleHover.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Mozilla Firefox\nss3.dll.id[2B089A14-3390].[[email protected]].fopra c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\PaintMedTile.scale-150.png c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vds.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 4588 vssadmin.exe 2412 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exepid process 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe Token: SeBackupPrivilege 3112 vssvc.exe Token: SeRestorePrivilege 3112 vssvc.exe Token: SeAuditPrivilege 3112 vssvc.exe Token: SeIncreaseQuotaPrivilege 564 WMIC.exe Token: SeSecurityPrivilege 564 WMIC.exe Token: SeTakeOwnershipPrivilege 564 WMIC.exe Token: SeLoadDriverPrivilege 564 WMIC.exe Token: SeSystemProfilePrivilege 564 WMIC.exe Token: SeSystemtimePrivilege 564 WMIC.exe Token: SeProfSingleProcessPrivilege 564 WMIC.exe Token: SeIncBasePriorityPrivilege 564 WMIC.exe Token: SeCreatePagefilePrivilege 564 WMIC.exe Token: SeBackupPrivilege 564 WMIC.exe Token: SeRestorePrivilege 564 WMIC.exe Token: SeShutdownPrivilege 564 WMIC.exe Token: SeDebugPrivilege 564 WMIC.exe Token: SeSystemEnvironmentPrivilege 564 WMIC.exe Token: SeRemoteShutdownPrivilege 564 WMIC.exe Token: SeUndockPrivilege 564 WMIC.exe Token: SeManageVolumePrivilege 564 WMIC.exe Token: 33 564 WMIC.exe Token: 34 564 WMIC.exe Token: 35 564 WMIC.exe Token: 36 564 WMIC.exe Token: SeIncreaseQuotaPrivilege 564 WMIC.exe Token: SeSecurityPrivilege 564 WMIC.exe Token: SeTakeOwnershipPrivilege 564 WMIC.exe Token: SeLoadDriverPrivilege 564 WMIC.exe Token: SeSystemProfilePrivilege 564 WMIC.exe Token: SeSystemtimePrivilege 564 WMIC.exe Token: SeProfSingleProcessPrivilege 564 WMIC.exe Token: SeIncBasePriorityPrivilege 564 WMIC.exe Token: SeCreatePagefilePrivilege 564 WMIC.exe Token: SeBackupPrivilege 564 WMIC.exe Token: SeRestorePrivilege 564 WMIC.exe Token: SeShutdownPrivilege 564 WMIC.exe Token: SeDebugPrivilege 564 WMIC.exe Token: SeSystemEnvironmentPrivilege 564 WMIC.exe Token: SeRemoteShutdownPrivilege 564 WMIC.exe Token: SeUndockPrivilege 564 WMIC.exe Token: SeManageVolumePrivilege 564 WMIC.exe Token: 33 564 WMIC.exe Token: 34 564 WMIC.exe Token: 35 564 WMIC.exe Token: 36 564 WMIC.exe Token: SeBackupPrivilege 1368 wbengine.exe Token: SeRestorePrivilege 1368 wbengine.exe Token: SeSecurityPrivilege 1368 wbengine.exe Token: SeIncreaseQuotaPrivilege 4340 WMIC.exe Token: SeSecurityPrivilege 4340 WMIC.exe Token: SeTakeOwnershipPrivilege 4340 WMIC.exe Token: SeLoadDriverPrivilege 4340 WMIC.exe Token: SeSystemProfilePrivilege 4340 WMIC.exe Token: SeSystemtimePrivilege 4340 WMIC.exe Token: SeProfSingleProcessPrivilege 4340 WMIC.exe Token: SeIncBasePriorityPrivilege 4340 WMIC.exe Token: SeCreatePagefilePrivilege 4340 WMIC.exe Token: SeBackupPrivilege 4340 WMIC.exe Token: SeRestorePrivilege 4340 WMIC.exe Token: SeShutdownPrivilege 4340 WMIC.exe Token: SeDebugPrivilege 4340 WMIC.exe Token: SeSystemEnvironmentPrivilege 4340 WMIC.exe Token: SeRemoteShutdownPrivilege 4340 WMIC.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.execmd.execmd.execmd.exedescription pid process target process PID 1156 wrote to memory of 2604 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1156 wrote to memory of 2604 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1156 wrote to memory of 4148 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1156 wrote to memory of 4148 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 4148 wrote to memory of 4280 4148 cmd.exe netsh.exe PID 4148 wrote to memory of 4280 4148 cmd.exe netsh.exe PID 2604 wrote to memory of 4588 2604 cmd.exe vssadmin.exe PID 2604 wrote to memory of 4588 2604 cmd.exe vssadmin.exe PID 2604 wrote to memory of 564 2604 cmd.exe WMIC.exe PID 2604 wrote to memory of 564 2604 cmd.exe WMIC.exe PID 2604 wrote to memory of 4832 2604 cmd.exe bcdedit.exe PID 2604 wrote to memory of 4832 2604 cmd.exe bcdedit.exe PID 2604 wrote to memory of 4260 2604 cmd.exe bcdedit.exe PID 2604 wrote to memory of 4260 2604 cmd.exe bcdedit.exe PID 2604 wrote to memory of 1220 2604 cmd.exe wbadmin.exe PID 2604 wrote to memory of 1220 2604 cmd.exe wbadmin.exe PID 4148 wrote to memory of 292 4148 cmd.exe netsh.exe PID 4148 wrote to memory of 292 4148 cmd.exe netsh.exe PID 1156 wrote to memory of 5040 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1156 wrote to memory of 5040 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1156 wrote to memory of 5040 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1156 wrote to memory of 1496 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1156 wrote to memory of 1496 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1156 wrote to memory of 1496 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1156 wrote to memory of 4248 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1156 wrote to memory of 4248 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1156 wrote to memory of 4248 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe mshta.exe PID 1156 wrote to memory of 1644 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1156 wrote to memory of 1644 1156 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe cmd.exe PID 1644 wrote to memory of 2412 1644 cmd.exe vssadmin.exe PID 1644 wrote to memory of 2412 1644 cmd.exe vssadmin.exe PID 1644 wrote to memory of 4340 1644 cmd.exe WMIC.exe PID 1644 wrote to memory of 4340 1644 cmd.exe WMIC.exe PID 1644 wrote to memory of 1752 1644 cmd.exe bcdedit.exe PID 1644 wrote to memory of 1752 1644 cmd.exe bcdedit.exe PID 1644 wrote to memory of 1816 1644 cmd.exe bcdedit.exe PID 1644 wrote to memory of 1816 1644 cmd.exe bcdedit.exe PID 1644 wrote to memory of 1588 1644 cmd.exe wbadmin.exe PID 1644 wrote to memory of 1588 1644 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe"C:\Users\Admin\AppData\Local\Temp\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe"C:\Users\Admin\AppData\Local\Temp\c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e.exe"2⤵PID:3452
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
PID:4280
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:292
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4588
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:564
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:4832
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:4260
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1220
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:5040
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:1496
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:4248
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2412
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1752
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1816
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1588
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1532
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:1856
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[2B089A14-3390].[[email protected]].fopra
Filesize3.2MB
MD52d2ac0289367f3671d49f884a86c3dd2
SHA1f148825cda3cddfe92fcb517134fb3b4c12924ee
SHA256925c20b089d84c606f9eaa11a8d238a78e9988218b6a5cc77577be142873873d
SHA51282a196240abcb4e99dc148d65fe0d2bb18daefea5b22405d2993eff1a8ada4f48ef234b1f9380b86bc9fa5664848192fe1c40a5d1e6ef06ec2e1c93ff51f957e
-
Filesize
5KB
MD5e51b52d86be061f778c7274ffd993439
SHA1ab9340d0fe2addbfd1f15885fcb381cb561bc1dd
SHA256b344e49c1f89e6ed7a465a60f52a0246af8a48f4ddb3e18877f57eefb367d437
SHA512978430efc34598f451e11ed58bc6af06f8c4033d5910fb65da56b7726953b49752798da25d80233a88dd0b9c691725b8fb767ec21daf68d39f6225c5d3cee7a1
-
Filesize
5KB
MD5e51b52d86be061f778c7274ffd993439
SHA1ab9340d0fe2addbfd1f15885fcb381cb561bc1dd
SHA256b344e49c1f89e6ed7a465a60f52a0246af8a48f4ddb3e18877f57eefb367d437
SHA512978430efc34598f451e11ed58bc6af06f8c4033d5910fb65da56b7726953b49752798da25d80233a88dd0b9c691725b8fb767ec21daf68d39f6225c5d3cee7a1
-
Filesize
5KB
MD5e51b52d86be061f778c7274ffd993439
SHA1ab9340d0fe2addbfd1f15885fcb381cb561bc1dd
SHA256b344e49c1f89e6ed7a465a60f52a0246af8a48f4ddb3e18877f57eefb367d437
SHA512978430efc34598f451e11ed58bc6af06f8c4033d5910fb65da56b7726953b49752798da25d80233a88dd0b9c691725b8fb767ec21daf68d39f6225c5d3cee7a1
-
Filesize
5KB
MD5e51b52d86be061f778c7274ffd993439
SHA1ab9340d0fe2addbfd1f15885fcb381cb561bc1dd
SHA256b344e49c1f89e6ed7a465a60f52a0246af8a48f4ddb3e18877f57eefb367d437
SHA512978430efc34598f451e11ed58bc6af06f8c4033d5910fb65da56b7726953b49752798da25d80233a88dd0b9c691725b8fb767ec21daf68d39f6225c5d3cee7a1