Malware Analysis Report

2024-11-16 12:19

Sample ID 230703-gj8yjagb5x
Target 2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb
SHA256 2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb
Tags
phobos evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb

Threat Level: Known bad

The file 2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb was found to be: Known bad.

Malicious Activity Summary

phobos evasion persistence ransomware spyware stealer

Phobos

Renames multiple (318) files with added filename extension

Renames multiple (474) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes shadow copies

Deletes backup catalog

Modifies extensions of user files

Modifies Windows Firewall

Checks computer location settings

Drops startup file

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Adds Run key to start application

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Program crash

Modifies Internet Explorer settings

Uses Task Scheduler COM API

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Interacts with shadow copies

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-03 05:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-07-03 05:51

Reported

2023-07-03 06:01

Platform

win10v2004-20230621-en

Max time kernel

600s

Max time network

602s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (474) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\ClearWatch.tiff C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Pictures\GetRequest.tiff C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb = "C:\\Users\\Admin\\AppData\\Local\\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe" C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb = "C:\\Users\\Admin\\AppData\\Local\\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe" C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-4025927695-1301755775-2607443251-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_checkbox_selected_18.svg.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SpreadsheetIQ.ExcelAddIn.dll.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\ui-strings.js.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-150.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-80.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\WideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-96_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d2.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected][0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ITCKRIST.TTF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msmgdsrv.dll.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\MedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Entertainment.winmd C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\PSGet.Resource.psd1 C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\stdole.dll.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-40_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Net.Primitives.dll C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.Tests.ps1 C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fil_get.svg C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-fullcolor.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalSplashScreen.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\TransparentAdvertisers.DATA.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\ui-strings.js.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\PNG32.FLT.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id[0B71F471-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4312 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 4312 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 4312 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 4312 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 2740 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2740 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2016 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2016 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2740 wrote to memory of 456 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2740 wrote to memory of 456 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2016 wrote to memory of 4596 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2016 wrote to memory of 4596 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2740 wrote to memory of 4588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2740 wrote to memory of 4588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2740 wrote to memory of 4876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2740 wrote to memory of 4876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2740 wrote to memory of 1912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2740 wrote to memory of 1912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4312 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 4312 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 4312 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 4436 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4436 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4436 wrote to memory of 1112 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4436 wrote to memory of 1112 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4436 wrote to memory of 4128 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4436 wrote to memory of 4128 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4436 wrote to memory of 976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4436 wrote to memory of 976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4436 wrote to memory of 3140 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4436 wrote to memory of 3140 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe

"C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe"

C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe

"C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1384 -ip 1384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 216

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 20.42.65.88:443 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 202.74.101.95.in-addr.arpa udp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

memory/4312-135-0x00000000007F0000-0x00000000007FF000-memory.dmp

memory/1384-136-0x0000000000400000-0x0000000000695000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[0B71F471-3483].[[email protected]].8base

MD5 5b94982600fc53f246252fb324bdaddf
SHA1 d9042794d938ed26c6a8b81b1484f42393c6c1f7
SHA256 01a7540dc1b3a663e2031687c8ee04e9a1053535ebde8d1589d66036e69c0861
SHA512 c2085e4403447f55bdd0ae69e3f3db79146e73473d8d392c835afb8cc6e388acbeb87d33b38133ccd3533432ef962a38b74efaca04056d06274c27a0691e3c15

memory/4312-801-0x0000000000400000-0x0000000000695000-memory.dmp

memory/4312-3033-0x0000000000400000-0x0000000000695000-memory.dmp

memory/4312-4560-0x0000000000400000-0x0000000000695000-memory.dmp

memory/4312-6308-0x0000000000400000-0x0000000000695000-memory.dmp

memory/4312-10277-0x0000000000400000-0x0000000000695000-memory.dmp

C:\info.hta

MD5 fa409036dce5b3c8bb4253e46f004418
SHA1 9f3cc572e732de138fcc9749bfecb5f5b0219913
SHA256 85f8a1b6eb4c6c5bc66eaae60edfd0a702f02d86b54bc930420209e47691ba03
SHA512 99a84803066edc9d107973ce2eb082054309d03d0cc14a7e4e54bf05d9648d932253d36ed18347b1073d8230ff4cb86764ba87358046f54515a8b738d3a214c1

C:\info.hta

MD5 fa409036dce5b3c8bb4253e46f004418
SHA1 9f3cc572e732de138fcc9749bfecb5f5b0219913
SHA256 85f8a1b6eb4c6c5bc66eaae60edfd0a702f02d86b54bc930420209e47691ba03
SHA512 99a84803066edc9d107973ce2eb082054309d03d0cc14a7e4e54bf05d9648d932253d36ed18347b1073d8230ff4cb86764ba87358046f54515a8b738d3a214c1

C:\Users\Admin\Desktop\info.hta

MD5 fa409036dce5b3c8bb4253e46f004418
SHA1 9f3cc572e732de138fcc9749bfecb5f5b0219913
SHA256 85f8a1b6eb4c6c5bc66eaae60edfd0a702f02d86b54bc930420209e47691ba03
SHA512 99a84803066edc9d107973ce2eb082054309d03d0cc14a7e4e54bf05d9648d932253d36ed18347b1073d8230ff4cb86764ba87358046f54515a8b738d3a214c1

F:\info.hta

MD5 fa409036dce5b3c8bb4253e46f004418
SHA1 9f3cc572e732de138fcc9749bfecb5f5b0219913
SHA256 85f8a1b6eb4c6c5bc66eaae60edfd0a702f02d86b54bc930420209e47691ba03
SHA512 99a84803066edc9d107973ce2eb082054309d03d0cc14a7e4e54bf05d9648d932253d36ed18347b1073d8230ff4cb86764ba87358046f54515a8b738d3a214c1

C:\users\public\desktop\info.hta

MD5 fa409036dce5b3c8bb4253e46f004418
SHA1 9f3cc572e732de138fcc9749bfecb5f5b0219913
SHA256 85f8a1b6eb4c6c5bc66eaae60edfd0a702f02d86b54bc930420209e47691ba03
SHA512 99a84803066edc9d107973ce2eb082054309d03d0cc14a7e4e54bf05d9648d932253d36ed18347b1073d8230ff4cb86764ba87358046f54515a8b738d3a214c1

memory/4312-12045-0x0000000000400000-0x0000000000695000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-03 05:51

Reported

2023-07-03 06:01

Platform

win7-20230621-en

Max time kernel

600s

Max time network

406s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (318) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb = "C:\\Users\\Admin\\AppData\\Local\\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe" C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Run\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb = "C:\\Users\\Admin\\AppData\\Local\\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe" C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\A4VARS17\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\EN9U4U6V\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\1S8BX0EO\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1CPGG31\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y7S2ALZI\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3950455397-3229124517-1686476975-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215070.WMF.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Minsk.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CUP.WMF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386267.JPG C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImage.jpg C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.HTM C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\micaut.dll.mui C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\PREVIEW.GIF.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200273.WMF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Elegant.dotx C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Windows Mail\wab.exe C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GB.XSL C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\npvlc.dll C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\APA.XSL.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLowMask.bmp C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\SOLVER.XLAM.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\MSN.ICO.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\settings.css C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105306.WMF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\INCOMING.ICO C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400004.PNG C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382965.JPG C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Montreal.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SUBMIT.JS.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\promointl.dll C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107132.WMF.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107494.WMF.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN065.XML.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00965_.WMF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00391_.WMF.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01149_.WMF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03453_.WMF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\SCNPST32.DLL.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSTORYVERT.XML.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\libEGL.dll C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105360.WMF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieproxy.dll C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107158.WMF.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.id[DE6A1762-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1456 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 1456 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 1456 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 1456 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 1456 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 1456 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 1456 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 1456 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 1168 wrote to memory of 1516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1168 wrote to memory of 1516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1168 wrote to memory of 1516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 560 wrote to memory of 1068 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 560 wrote to memory of 1068 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 560 wrote to memory of 1068 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1168 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1168 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1168 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 560 wrote to memory of 796 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 560 wrote to memory of 796 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 560 wrote to memory of 796 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 560 wrote to memory of 936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 560 wrote to memory of 936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 560 wrote to memory of 936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 560 wrote to memory of 212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 560 wrote to memory of 212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 560 wrote to memory of 212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 560 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 560 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 560 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1456 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\SysWOW64\mshta.exe
PID 1456 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 1456 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 1456 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 1456 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe C:\Windows\system32\cmd.exe
PID 2668 wrote to memory of 2712 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2668 wrote to memory of 2712 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2668 wrote to memory of 2712 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2668 wrote to memory of 2752 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2668 wrote to memory of 2752 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2668 wrote to memory of 2752 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2668 wrote to memory of 2816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2796 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2796 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2796 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2668 wrote to memory of 2808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2668 wrote to memory of 2808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe

"C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe"

C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe

"C:\Users\Admin\AppData\Local\Temp\2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

N/A

Files

memory/1456-55-0x0000000000230000-0x000000000023F000-memory.dmp

memory/848-57-0x0000000000400000-0x0000000000695000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[DE6A1762-3483].[[email protected]].8base

MD5 85135cf5f56e06c7cbb6ab29aa0cb805
SHA1 4365446077f3e6296a66a1b9fb6819c0db177e88
SHA256 635ca89f484b4cf2c7559f73ce038810a0f05cb69a71cda6e451e3fbf17dba02
SHA512 ebdf4a686076778aadf98245422bc99a84d0e9338f086caaf35ba2c717fb1fc40af7f1df6e0c2e6f08e191e1144e9c23505d85b7ab9150219744aa9e77201b07

memory/1456-178-0x0000000000400000-0x0000000000695000-memory.dmp

memory/1456-579-0x0000000000400000-0x0000000000695000-memory.dmp

memory/1456-1547-0x0000000000400000-0x0000000000695000-memory.dmp

memory/1456-2860-0x0000000000400000-0x0000000000695000-memory.dmp

memory/1456-3686-0x0000000000400000-0x0000000000695000-memory.dmp

memory/1456-5105-0x0000000000400000-0x0000000000695000-memory.dmp

memory/1456-7694-0x0000000000400000-0x0000000000695000-memory.dmp

memory/1456-9344-0x0000000000400000-0x0000000000695000-memory.dmp

memory/1456-10226-0x0000000000400000-0x0000000000695000-memory.dmp

C:\info.hta

MD5 120aa4e5455230d530244663be46f9d1
SHA1 d191a7ff0febf44be9e7a2007275a1193e1567ce
SHA256 287dffea1edbb704fd9278d1dedde40c8367f94cc289a0618a96652dcadacbc9
SHA512 c7a33aa8a41b0b93f570fadf497a6fde1278fba14cc94d37591da7ce3a8dfd87226db0f39f3b6f7834da51113e25d57328bc4116a5c8f705c027cb4d7be5efe5

C:\Users\Admin\Desktop\info.hta

MD5 120aa4e5455230d530244663be46f9d1
SHA1 d191a7ff0febf44be9e7a2007275a1193e1567ce
SHA256 287dffea1edbb704fd9278d1dedde40c8367f94cc289a0618a96652dcadacbc9
SHA512 c7a33aa8a41b0b93f570fadf497a6fde1278fba14cc94d37591da7ce3a8dfd87226db0f39f3b6f7834da51113e25d57328bc4116a5c8f705c027cb4d7be5efe5

C:\users\public\desktop\info.hta

MD5 120aa4e5455230d530244663be46f9d1
SHA1 d191a7ff0febf44be9e7a2007275a1193e1567ce
SHA256 287dffea1edbb704fd9278d1dedde40c8367f94cc289a0618a96652dcadacbc9
SHA512 c7a33aa8a41b0b93f570fadf497a6fde1278fba14cc94d37591da7ce3a8dfd87226db0f39f3b6f7834da51113e25d57328bc4116a5c8f705c027cb4d7be5efe5

C:\info.hta

MD5 120aa4e5455230d530244663be46f9d1
SHA1 d191a7ff0febf44be9e7a2007275a1193e1567ce
SHA256 287dffea1edbb704fd9278d1dedde40c8367f94cc289a0618a96652dcadacbc9
SHA512 c7a33aa8a41b0b93f570fadf497a6fde1278fba14cc94d37591da7ce3a8dfd87226db0f39f3b6f7834da51113e25d57328bc4116a5c8f705c027cb4d7be5efe5