Malware Analysis Report

2024-11-16 12:20

Sample ID 230714-3gyknshc8z
Target a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA256 a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
Tags
phobos evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855

Threat Level: Known bad

The file a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855 was found to be: Known bad.

Malicious Activity Summary

phobos evasion persistence ransomware spyware stealer

Phobos

Modifies boot configuration data using bcdedit

Deletes shadow copies

Renames multiple (448) files with added filename extension

Deletes backup catalog

Modifies Windows Firewall

Drops startup file

Reads user/profile data of web browsers

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Interacts with shadow copies

Modifies registry class

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-14 23:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-14 23:29

Reported

2023-07-14 23:32

Platform

win10-20230703-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (448) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Windows\CurrentVersion\Run\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855 = "C:\\Users\\Admin\\AppData\\Local\\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe" C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855 = "C:\\Users\\Admin\\AppData\\Local\\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe" C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2393848421-2120571652-2495149697-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2393848421-2120571652-2495149697-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libsubsdelay_plugin.dll C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\ClrCompression.dll C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\eo.txt C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\LockScreenLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\MedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-press.svg.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\thinking.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp6.scale-200.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_pt-BR.dll C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\WideLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Word.dll C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\ui-strings.js.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Spider\ResPacks\gameplayspider.respack C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-256_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\Perfect\ribbon_3.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Pyramid\Goal_2.jpg C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeWideTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\MedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\MedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Edit.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FREESCPT.TTF.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadco.dll C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\bronze_Badge_Earned.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-400.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-ma\ui-strings.js.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\talking.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-30_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\s_empty_folder_state.svg C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.id[5042EEC8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\pm_16x11.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\10191_40x40x32.png C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1600 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\system32\cmd.exe
PID 1600 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\system32\cmd.exe
PID 1600 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\system32\cmd.exe
PID 1600 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\system32\cmd.exe
PID 3744 wrote to memory of 2600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3744 wrote to memory of 2600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3212 wrote to memory of 4324 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3212 wrote to memory of 4324 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3744 wrote to memory of 836 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3744 wrote to memory of 836 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3212 wrote to memory of 284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 3212 wrote to memory of 284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 3744 wrote to memory of 5008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3744 wrote to memory of 5008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3744 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3744 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3744 wrote to memory of 3400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3744 wrote to memory of 3400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1600 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\SysWOW64\mshta.exe
PID 1600 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\system32\cmd.exe
PID 1600 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe C:\Windows\system32\cmd.exe
PID 4204 wrote to memory of 1384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4204 wrote to memory of 1384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4204 wrote to memory of 4500 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4204 wrote to memory of 4500 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4204 wrote to memory of 4248 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4204 wrote to memory of 4248 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4204 wrote to memory of 4324 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4204 wrote to memory of 4324 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4204 wrote to memory of 2108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4204 wrote to memory of 2108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe

"C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe"

C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe

"C:\Users\Admin\AppData\Local\Temp\a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -Embedding

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 38.148.119.40.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp

Files

memory/1600-123-0x0000000000760000-0x0000000000860000-memory.dmp

memory/1600-124-0x0000000000620000-0x000000000062F000-memory.dmp

memory/1600-125-0x0000000000400000-0x00000000004E3000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[5042EEC8-3483].[[email protected]].8base

MD5 5ce6487f6c615de1ae1116b4f1d68639
SHA1 4f61caf99141edfb3660e1881328ddfe162e01a9
SHA256 045c0f071bd7f35e6ba50d591fff13f865d323afc43e120ad8295cae7fda8e03
SHA512 8d62f896dd4e8cc7af32e729b1e498a063a450324ed298255447e98ce69cf38d29c5e7a8e3db16916d4a19c6a60414332de8ffcae7f4d50faeae7c7abd370e33

memory/1600-376-0x0000000000760000-0x0000000000860000-memory.dmp

memory/1600-747-0x0000000000620000-0x000000000062F000-memory.dmp

memory/1600-793-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/1600-907-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/1392-2607-0x0000000000610000-0x0000000000710000-memory.dmp

memory/1392-2649-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/1600-3986-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/1600-5307-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/1600-6299-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/1600-9739-0x0000000000400000-0x00000000004E3000-memory.dmp

C:\info.hta

MD5 02676683f860d1109805017bcf34ddd2
SHA1 f2e8d1f5c3b71404ac708278f306aa9a7858ab1d
SHA256 a4c4117dd6584a14f725317966de98a1f63f5818855b4c5ea0287a9d51e186a0
SHA512 3b1b343f72c3edb334ca3076fb779c2d6febc065db91708803d31303970e7b38576336a195f42287ad9f24a40742fdd7c32b5b325665b6f03ad154353f70e318

C:\Users\Admin\Desktop\info.hta

MD5 02676683f860d1109805017bcf34ddd2
SHA1 f2e8d1f5c3b71404ac708278f306aa9a7858ab1d
SHA256 a4c4117dd6584a14f725317966de98a1f63f5818855b4c5ea0287a9d51e186a0
SHA512 3b1b343f72c3edb334ca3076fb779c2d6febc065db91708803d31303970e7b38576336a195f42287ad9f24a40742fdd7c32b5b325665b6f03ad154353f70e318

C:\users\public\desktop\info.hta

MD5 02676683f860d1109805017bcf34ddd2
SHA1 f2e8d1f5c3b71404ac708278f306aa9a7858ab1d
SHA256 a4c4117dd6584a14f725317966de98a1f63f5818855b4c5ea0287a9d51e186a0
SHA512 3b1b343f72c3edb334ca3076fb779c2d6febc065db91708803d31303970e7b38576336a195f42287ad9f24a40742fdd7c32b5b325665b6f03ad154353f70e318

F:\info.hta

MD5 02676683f860d1109805017bcf34ddd2
SHA1 f2e8d1f5c3b71404ac708278f306aa9a7858ab1d
SHA256 a4c4117dd6584a14f725317966de98a1f63f5818855b4c5ea0287a9d51e186a0
SHA512 3b1b343f72c3edb334ca3076fb779c2d6febc065db91708803d31303970e7b38576336a195f42287ad9f24a40742fdd7c32b5b325665b6f03ad154353f70e318

C:\info.hta

MD5 02676683f860d1109805017bcf34ddd2
SHA1 f2e8d1f5c3b71404ac708278f306aa9a7858ab1d
SHA256 a4c4117dd6584a14f725317966de98a1f63f5818855b4c5ea0287a9d51e186a0
SHA512 3b1b343f72c3edb334ca3076fb779c2d6febc065db91708803d31303970e7b38576336a195f42287ad9f24a40742fdd7c32b5b325665b6f03ad154353f70e318

memory/1600-12136-0x0000000000400000-0x00000000004E3000-memory.dmp