Malware Analysis Report

2024-11-16 12:14

Sample ID 230619-nn8lwsef5s
Target e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0
SHA256 e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0
Tags
phobos smokeloader backdoor collection evasion persistence ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0

Threat Level: Known bad

The file e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0 was found to be: Known bad.

Malicious Activity Summary

phobos smokeloader backdoor collection evasion persistence ransomware spyware stealer trojan

Phobos

SmokeLoader

Renames multiple (136) files with added filename extension

Deletes shadow copies

Modifies boot configuration data using bcdedit

Deletes backup catalog

Blocklisted process makes network request

Modifies Windows Firewall

Downloads MZ/PE file

Reads user/profile data of web browsers

Executes dropped EXE

Drops startup file

Drops desktop.ini file(s)

Adds Run key to start application

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Unsigned PE

Program crash

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

outlook_win_path

Uses Volume Shadow Copy service COM API

outlook_office_path

Uses Task Scheduler COM API

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-06-19 11:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-06-19 11:33

Reported

2023-06-19 11:36

Platform

win10v2004-20230220-en

Max time kernel

85s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe"

Signatures

Phobos

ransomware phobos

SmokeLoader

trojan backdoor smokeloader

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (136) files with added filename extension

ransomware

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\4BE0.exe C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4BE0 = "C:\\Users\\Admin\\AppData\\Local\\4BE0.exe" C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rhyivhytef = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rhyivhytef.exe\"" C:\Users\Admin\AppData\Local\Temp\46EC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4BE0 = "C:\\Users\\Admin\\AppData\\Local\\4BE0.exe" C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-4238149048-355649189-894321705-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\ps.txt C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\boot_ja.jar C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_zh_CN.properties.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\jfluid-server-15.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Common Files\Services\verisign.bmp C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\sa-jdi.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\7-Zip\Lang\uk.txt.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-compat.xml.id[A9F33F38-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\4BE0.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4BE0.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\46EC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe
PID 2292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe
PID 2292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe
PID 2292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe
PID 2292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe
PID 2292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe
PID 3156 wrote to memory of 400 N/A N/A C:\Users\Admin\AppData\Local\Temp\46EC.exe
PID 3156 wrote to memory of 400 N/A N/A C:\Users\Admin\AppData\Local\Temp\46EC.exe
PID 3156 wrote to memory of 4916 N/A N/A C:\Users\Admin\AppData\Local\Temp\497D.exe
PID 3156 wrote to memory of 4916 N/A N/A C:\Users\Admin\AppData\Local\Temp\497D.exe
PID 3156 wrote to memory of 4916 N/A N/A C:\Users\Admin\AppData\Local\Temp\497D.exe
PID 3156 wrote to memory of 4428 N/A N/A C:\Users\Admin\AppData\Local\Temp\4BE0.exe
PID 3156 wrote to memory of 4428 N/A N/A C:\Users\Admin\AppData\Local\Temp\4BE0.exe
PID 3156 wrote to memory of 4428 N/A N/A C:\Users\Admin\AppData\Local\Temp\4BE0.exe
PID 3156 wrote to memory of 3184 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 3184 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 3184 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 3184 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 3284 N/A N/A C:\Windows\explorer.exe
PID 3156 wrote to memory of 3284 N/A N/A C:\Windows\explorer.exe
PID 3156 wrote to memory of 3284 N/A N/A C:\Windows\explorer.exe
PID 3156 wrote to memory of 4444 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4444 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4444 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4444 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 4916 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\497D.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4916 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\497D.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4916 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\497D.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3156 wrote to memory of 3476 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 3476 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 3476 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 3476 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4412 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4412 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4412 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4412 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4228 N/A N/A C:\Windows\explorer.exe
PID 3156 wrote to memory of 4228 N/A N/A C:\Windows\explorer.exe
PID 3156 wrote to memory of 4228 N/A N/A C:\Windows\explorer.exe
PID 4428 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\4BE0.exe C:\Windows\system32\cmd.exe
PID 4428 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\4BE0.exe C:\Windows\system32\cmd.exe
PID 4428 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\4BE0.exe C:\Windows\system32\cmd.exe
PID 4428 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\4BE0.exe C:\Windows\system32\cmd.exe
PID 3156 wrote to memory of 4768 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4768 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4768 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4768 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 2256 N/A N/A C:\Windows\explorer.exe
PID 3156 wrote to memory of 2256 N/A N/A C:\Windows\explorer.exe
PID 3156 wrote to memory of 2256 N/A N/A C:\Windows\explorer.exe
PID 3156 wrote to memory of 1292 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 1292 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 1292 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 1292 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 4028 wrote to memory of 5088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4028 wrote to memory of 5088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3156 wrote to memory of 4856 N/A N/A C:\Windows\explorer.exe
PID 3156 wrote to memory of 4856 N/A N/A C:\Windows\explorer.exe
PID 3156 wrote to memory of 4856 N/A N/A C:\Windows\explorer.exe
PID 4220 wrote to memory of 3808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4220 wrote to memory of 3808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3156 wrote to memory of 4920 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4920 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3156 wrote to memory of 4920 N/A N/A C:\Windows\SysWOW64\explorer.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe

"C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe"

C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe

"C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe"

C:\Users\Admin\AppData\Local\Temp\46EC.exe

C:\Users\Admin\AppData\Local\Temp\46EC.exe

C:\Users\Admin\AppData\Local\Temp\497D.exe

C:\Users\Admin\AppData\Local\Temp\497D.exe

C:\Users\Admin\AppData\Local\Temp\4BE0.exe

C:\Users\Admin\AppData\Local\Temp\4BE0.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Users\Admin\AppData\Local\Temp\4BE0.exe

"C:\Users\Admin\AppData\Local\Temp\4BE0.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4388 -ip 4388

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 252

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
FR 51.11.192.48:443 tcp
US 8.8.8.8:53 123.108.74.40.in-addr.arpa udp
US 8.8.8.8:53 serverlogs37.xyz udp
EE 5.45.127.9:80 serverlogs37.xyz tcp
US 8.8.8.8:53 admlogs25.xyz udp
EE 159.253.18.136:80 admlogs25.xyz tcp
US 8.8.8.8:53 9.127.45.5.in-addr.arpa udp
US 8.8.8.8:53 136.18.253.159.in-addr.arpa udp
EE 5.45.127.9:80 serverlogs37.xyz tcp
US 52.242.101.226:443 tcp
NL 8.238.177.126:80 tcp
NL 173.223.113.164:443 tcp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 52.242.101.226:443 tcp
RU 91.215.85.210:51186 91.215.85.210 tcp
NL 8.238.177.126:80 tcp
US 8.8.8.8:53 210.85.215.91.in-addr.arpa udp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
FI 79.137.206.188:46578 tcp
US 8.8.8.8:53 188.206.137.79.in-addr.arpa udp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp

Files

memory/2292-133-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

memory/2292-134-0x0000000000AE0000-0x0000000000AE9000-memory.dmp

memory/1780-135-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1780-136-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1780-138-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3156-137-0x0000000002670000-0x0000000002686000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\46EC.exe

MD5 e7ac55d61ab9cfcf180c92c1381a2fa1
SHA1 f79fe555c492a9effe26ead87ec7eb3c53899083
SHA256 afddec37cdc1d196a1136e2252e925c0dcfe587963069d78775e0f174ae9cfe3
SHA512 e3fa85d3af3625384ecea090a7c205325825a1b91ad43e1f86f56a719ad733d71b4be9c34edd03d8ff774e28b3feb605dc073f66f4a01359f8e4bad5b8bcfae2

C:\Users\Admin\AppData\Local\Temp\46EC.exe

MD5 e7ac55d61ab9cfcf180c92c1381a2fa1
SHA1 f79fe555c492a9effe26ead87ec7eb3c53899083
SHA256 afddec37cdc1d196a1136e2252e925c0dcfe587963069d78775e0f174ae9cfe3
SHA512 e3fa85d3af3625384ecea090a7c205325825a1b91ad43e1f86f56a719ad733d71b4be9c34edd03d8ff774e28b3feb605dc073f66f4a01359f8e4bad5b8bcfae2

memory/400-152-0x0000022B0D700000-0x0000022B0D9A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\497D.exe

MD5 d1f12c03b8ce33b36d8423b057c7d6c5
SHA1 d6d0631a1f95e3972a803ed1c57b120815b2b5cf
SHA256 c6bd5b8e14551eb899bbe4decb6942581d28b2a42b159146bbc28316e6e14a64
SHA512 43b51f630d631d4f5cac97242595b25d07306280e183c22821f351af1fc2fc118b836df8bd8e06984f5e0cb21b25954dbd335666bd2cd2c5b98b22948bedbf41

C:\Users\Admin\AppData\Local\Temp\497D.exe

MD5 d1f12c03b8ce33b36d8423b057c7d6c5
SHA1 d6d0631a1f95e3972a803ed1c57b120815b2b5cf
SHA256 c6bd5b8e14551eb899bbe4decb6942581d28b2a42b159146bbc28316e6e14a64
SHA512 43b51f630d631d4f5cac97242595b25d07306280e183c22821f351af1fc2fc118b836df8bd8e06984f5e0cb21b25954dbd335666bd2cd2c5b98b22948bedbf41

C:\Users\Admin\AppData\Local\Temp\4BE0.exe

MD5 2809e15a3a54484e042fe65fffd17409
SHA1 4a8f0331abaf8f629b3c8220f0d55339cfa30223
SHA256 518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
SHA512 698e16fd67861377e2ccaace4d0e1a619a8b7c68e8aefc4090e9d1cbbcdfb8d8aede76f9e63f81479f5a035e8008699a4d7175da6248e6e49eb7c81b3dba30c3

C:\Users\Admin\AppData\Local\Temp\4BE0.exe

MD5 2809e15a3a54484e042fe65fffd17409
SHA1 4a8f0331abaf8f629b3c8220f0d55339cfa30223
SHA256 518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
SHA512 698e16fd67861377e2ccaace4d0e1a619a8b7c68e8aefc4090e9d1cbbcdfb8d8aede76f9e63f81479f5a035e8008699a4d7175da6248e6e49eb7c81b3dba30c3

memory/4916-163-0x0000000000840000-0x000000000087E000-memory.dmp

memory/400-164-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-165-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-167-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-170-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/4916-168-0x00000000057B0000-0x0000000005D54000-memory.dmp

memory/400-172-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-174-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/4428-178-0x0000000002550000-0x000000000255F000-memory.dmp

memory/3184-180-0x0000000000ED0000-0x0000000000F45000-memory.dmp

memory/3184-181-0x0000000000E60000-0x0000000000ECB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4BE0.exe

MD5 2809e15a3a54484e042fe65fffd17409
SHA1 4a8f0331abaf8f629b3c8220f0d55339cfa30223
SHA256 518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
SHA512 698e16fd67861377e2ccaace4d0e1a619a8b7c68e8aefc4090e9d1cbbcdfb8d8aede76f9e63f81479f5a035e8008699a4d7175da6248e6e49eb7c81b3dba30c3

memory/400-185-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/3284-187-0x0000000000DE0000-0x0000000000DEC000-memory.dmp

memory/400-188-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-179-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-190-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/4916-175-0x00000000052A0000-0x0000000005332000-memory.dmp

memory/3184-177-0x0000000000E60000-0x0000000000ECB000-memory.dmp

memory/400-192-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/3284-194-0x0000000000DE0000-0x0000000000DEC000-memory.dmp

memory/400-200-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/4916-201-0x0000000005290000-0x00000000052A0000-memory.dmp

memory/400-195-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/4444-203-0x0000000000F40000-0x0000000000F49000-memory.dmp

memory/400-208-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/4916-207-0x0000000005250000-0x000000000525A000-memory.dmp

memory/400-222-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-224-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-226-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-228-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-231-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/4444-232-0x0000000000F40000-0x0000000000F49000-memory.dmp

memory/400-235-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/3476-233-0x0000000000480000-0x000000000048B000-memory.dmp

memory/4444-230-0x0000000000F50000-0x0000000000F54000-memory.dmp

memory/400-237-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/3476-239-0x0000000000480000-0x000000000048B000-memory.dmp

memory/400-240-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-242-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-244-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/400-246-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/4004-249-0x0000000004850000-0x0000000004886000-memory.dmp

memory/400-248-0x0000022B27FC0000-0x0000022B28108000-memory.dmp

memory/4004-254-0x0000000004EC0000-0x00000000054E8000-memory.dmp

memory/3184-251-0x0000000000E60000-0x0000000000ECB000-memory.dmp

memory/4412-257-0x0000000000E70000-0x0000000000E77000-memory.dmp

memory/4412-260-0x0000000000E60000-0x0000000000E6B000-memory.dmp

memory/4004-262-0x0000000004840000-0x0000000004850000-memory.dmp

memory/4004-263-0x0000000004840000-0x0000000004850000-memory.dmp

memory/4004-282-0x0000000005660000-0x0000000005682000-memory.dmp

memory/4004-287-0x0000000005730000-0x0000000005796000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ijqunb2k.hpf.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4004-290-0x0000000005810000-0x0000000005876000-memory.dmp

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\4BE0.exe

MD5 2809e15a3a54484e042fe65fffd17409
SHA1 4a8f0331abaf8f629b3c8220f0d55339cfa30223
SHA256 518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
SHA512 698e16fd67861377e2ccaace4d0e1a619a8b7c68e8aefc4090e9d1cbbcdfb8d8aede76f9e63f81479f5a035e8008699a4d7175da6248e6e49eb7c81b3dba30c3

memory/4228-310-0x00000000004B0000-0x00000000004B9000-memory.dmp

memory/4228-323-0x00000000004A0000-0x00000000004AF000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[A9F33F38-3483].[[email protected]].8base

MD5 81c50c607aee227fb6c2340b8660833d
SHA1 4da8afd7b340840e5ea409672b75e0c53828e30e
SHA256 1d9d588ac814c60e4ad5fe9cb89e3fa135a1dd1e5d55b87cea51f48623e4cbb0
SHA512 4d8558e5c3cf00f70e814633171b1338f20fca9bca36e32434c2cb2c01827229ba73faa1597998ee4b38b79d5c8205c3e4d13c7dac08206c0c56c943747e68b5

memory/4768-517-0x0000000000120000-0x0000000000125000-memory.dmp

memory/4768-522-0x0000000000110000-0x0000000000119000-memory.dmp

memory/2256-574-0x0000000000600000-0x0000000000606000-memory.dmp

memory/2256-583-0x00000000003F0000-0x00000000003FC000-memory.dmp

memory/1292-593-0x0000000000D80000-0x0000000000D89000-memory.dmp

memory/1292-589-0x0000000000D90000-0x0000000000D94000-memory.dmp

memory/4856-652-0x00000000001A0000-0x00000000001A9000-memory.dmp

memory/4856-648-0x00000000001B0000-0x00000000001B5000-memory.dmp

memory/4004-682-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

memory/4920-712-0x0000000000430000-0x0000000000451000-memory.dmp

memory/4920-734-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1584-748-0x0000000000BD0000-0x0000000000BD5000-memory.dmp

memory/4256-783-0x0000000000E70000-0x0000000000E76000-memory.dmp

memory/4256-785-0x0000000000E60000-0x0000000000E6B000-memory.dmp

memory/1584-781-0x0000000000BC0000-0x0000000000BC9000-memory.dmp

memory/4916-896-0x0000000005290000-0x00000000052A0000-memory.dmp

memory/5048-922-0x0000000000740000-0x0000000000747000-memory.dmp

memory/5048-935-0x0000000000730000-0x000000000073D000-memory.dmp

memory/1352-946-0x0000000001260000-0x0000000001268000-memory.dmp

memory/1352-954-0x0000000001250000-0x000000000125B000-memory.dmp

memory/4004-987-0x0000000006370000-0x00000000063B4000-memory.dmp

memory/4004-1223-0x0000000004840000-0x0000000004850000-memory.dmp

memory/4444-1180-0x0000000000F50000-0x0000000000F54000-memory.dmp

memory/4004-1293-0x00000000070B0000-0x0000000007126000-memory.dmp

memory/4412-1470-0x0000000000E70000-0x0000000000E77000-memory.dmp

memory/4004-1488-0x0000000004840000-0x0000000004850000-memory.dmp

memory/4004-1504-0x0000000004840000-0x0000000004850000-memory.dmp

memory/4004-1767-0x0000000007800000-0x0000000007E7A000-memory.dmp

memory/4004-1793-0x0000000007130000-0x000000000714A000-memory.dmp

memory/3156-1791-0x0000000002810000-0x0000000002820000-memory.dmp

memory/3156-1804-0x0000000002810000-0x0000000002820000-memory.dmp

memory/3156-1769-0x00000000027F0000-0x0000000002800000-memory.dmp

memory/4228-1765-0x00000000004B0000-0x00000000004B9000-memory.dmp

memory/4768-1874-0x0000000000120000-0x0000000000125000-memory.dmp

memory/3156-1876-0x0000000002810000-0x0000000002820000-memory.dmp

memory/2256-1938-0x0000000000600000-0x0000000000606000-memory.dmp

memory/1292-1940-0x0000000000D90000-0x0000000000D94000-memory.dmp