Malware Analysis Report

2024-11-16 12:20

Sample ID 230714-h99s7add9y
Target c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94
SHA256 c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94
Tags
phobos rhadamanthys smokeloader systembc backdoor collection evasion persistence ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94

Threat Level: Known bad

The file c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94 was found to be: Known bad.

Malicious Activity Summary

phobos rhadamanthys smokeloader systembc backdoor collection evasion persistence ransomware spyware stealer trojan

Phobos

Detect rhadamanthys stealer shellcode

SystemBC

Suspicious use of NtCreateUserProcessOtherParentProcess

SmokeLoader

Rhadamanthys

Modifies boot configuration data using bcdedit

Renames multiple (345) files with added filename extension

Deletes shadow copies

Downloads MZ/PE file

Modifies Windows Firewall

Deletes backup catalog

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Adds Run key to start application

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Program crash

Suspicious behavior: EnumeratesProcesses

outlook_office_path

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

outlook_win_path

Suspicious behavior: MapViewOfSection

Uses Task Scheduler COM API

Interacts with shadow copies

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-14 07:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-14 07:27

Reported

2023-07-14 07:30

Platform

win10v2004-20230703-en

Max time kernel

150s

Max time network

158s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3920 created 3180 N/A C:\Users\Admin\AppData\Local\Temp\c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94.exe C:\Windows\Explorer.EXE

SystemBC

trojan systembc

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (345) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\ZU1ED@_S.exe C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZU1ED@_S = "C:\\Users\\Admin\\AppData\\Local\\ZU1ED@_S.exe" C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZU1ED@_S = "C:\\Users\\Admin\\AppData\\Local\\ZU1ED@_S.exe" C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1722984668-1829624581-3022101259-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1722984668-1829624581-3022101259-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1040 set thread context of 3884 N/A C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ext.txt C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\VBE7INTL.DLL C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.dll.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\ClassicPhotoAlbum.potx.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.UI.dll.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\PREVIEW.GIF C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\wordvisi.ttf.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-execution.xml.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONRES.DLL.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fi.txt C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected][55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-awt.xml C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\db\LICENSE.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\fontconfig.bfc.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.tree.dat.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\STSCOPY.DLL.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id[55594697-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DatabaseCore.dll C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3920 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94.exe C:\Windows\system32\certreq.exe
PID 3920 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94.exe C:\Windows\system32\certreq.exe
PID 3920 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94.exe C:\Windows\system32\certreq.exe
PID 3920 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94.exe C:\Windows\system32\certreq.exe
PID 1040 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe
PID 1040 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe
PID 1040 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe
PID 1040 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe
PID 1040 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe
PID 1040 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe
PID 4056 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe C:\Windows\system32\cmd.exe
PID 4056 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe C:\Windows\system32\cmd.exe
PID 4056 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe C:\Windows\system32\cmd.exe
PID 4056 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe C:\Windows\system32\cmd.exe
PID 116 wrote to memory of 4588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 116 wrote to memory of 4588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4640 wrote to memory of 2880 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4640 wrote to memory of 2880 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 116 wrote to memory of 4328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 116 wrote to memory of 4328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4640 wrote to memory of 4076 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4640 wrote to memory of 4076 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4640 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4640 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4640 wrote to memory of 2592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4640 wrote to memory of 2592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4640 wrote to memory of 3332 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4640 wrote to memory of 3332 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3180 wrote to memory of 4920 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\BFFF.exe
PID 3180 wrote to memory of 4920 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\BFFF.exe
PID 3180 wrote to memory of 4920 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\BFFF.exe
PID 3180 wrote to memory of 4452 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 4452 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 4452 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 4452 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 4028 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3180 wrote to memory of 4028 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3180 wrote to memory of 4028 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3180 wrote to memory of 4024 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 4024 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 4024 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 4024 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 3432 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 3432 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 3432 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 3432 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 3004 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 3004 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 3004 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 3004 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 1240 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3180 wrote to memory of 1240 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3180 wrote to memory of 1240 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3180 wrote to memory of 3796 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 3796 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 3796 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 3796 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 1948 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3180 wrote to memory of 1948 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3180 wrote to memory of 1948 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3180 wrote to memory of 2148 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 2148 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 2148 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3180 wrote to memory of 2148 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94.exe

"C:\Users\Admin\AppData\Local\Temp\c21da75b52a0bc699a83bf0eebc5216573533962d425f875191af178c19bab94.exe"

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3920 -ip 3920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 968

C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe

"C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe"

C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe

"C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe"

C:\Users\Admin\AppData\Local\Microsoft\iPlR5R.exe

"C:\Users\Admin\AppData\Local\Microsoft\iPlR5R.exe"

C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe

"C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe"

C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe

"C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3484 -ip 3484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 460

C:\Users\Admin\AppData\Local\Temp\BFFF.exe

C:\Users\Admin\AppData\Local\Temp\BFFF.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4920 -ip 4920

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 500

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4920 -ip 4920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4920 -ip 4920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 544

C:\Users\Admin\AppData\Roaming\thfffje

C:\Users\Admin\AppData\Roaming\thfffje

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 254.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 servblog25.xyz udp
DE 45.131.66.61:80 servblog25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
DE 45.131.66.61:80 servblog25.xyz tcp
DE 45.131.66.61:80 servblog25.xyz tcp
US 8.8.8.8:53 serverxlogs21.xyz udp
DE 45.131.66.120:80 serverxlogs21.xyz tcp
US 8.8.8.8:53 fexstat257.xyz udp
DE 45.89.125.136:80 fexstat257.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 136.125.89.45.in-addr.arpa udp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
DE 45.131.66.120:80 serverxlogs21.xyz tcp
US 8.8.8.8:53 76.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 131.72.42.20.in-addr.arpa udp

Files

memory/3920-134-0x00000000006F0000-0x00000000007F0000-memory.dmp

memory/3920-135-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/3920-136-0x0000000002210000-0x0000000002281000-memory.dmp

memory/3920-137-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/3920-138-0x00000000022B0000-0x00000000022B7000-memory.dmp

memory/3920-139-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/3920-140-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/3920-141-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/3920-142-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/1756-143-0x000001F62F7F0000-0x000001F62F7F3000-memory.dmp

memory/3920-144-0x00000000006F0000-0x00000000007F0000-memory.dmp

memory/3920-145-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/3920-146-0x0000000003340000-0x0000000003376000-memory.dmp

memory/3920-153-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/3920-152-0x0000000003340000-0x0000000003376000-memory.dmp

memory/3920-155-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/3920-156-0x0000000002640000-0x0000000002A40000-memory.dmp

memory/1756-157-0x000001F62F7F0000-0x000001F62F7F3000-memory.dmp

memory/1756-158-0x000001F62FBB0000-0x000001F62FBB7000-memory.dmp

memory/1756-159-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-160-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-161-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-162-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-163-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-165-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-167-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-168-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-169-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-170-0x00007FFC3C970000-0x00007FFC3CB65000-memory.dmp

memory/1756-171-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-172-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-173-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-174-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

memory/1756-175-0x00007FF46CB00000-0x00007FF46CC2D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe

MD5 1b2b02b4b524fe02b8b96bd781c8eceb
SHA1 36e2eb7e1ae58b103b2d1cca5991786b0118534b
SHA256 e780a1b2be7dab91bdc77bd313dd5a4456e0d92164fc1e54894f086f269d85c6
SHA512 80caf55a2f2a63e99c5ee6199b3b8357fd5d2bf92cb671f80a0b05385cc79f78fc689d60197176fc1bae67ab331e8bdf71adf44c88423bbbf95e7926e31e5bc8

C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe

MD5 1b2b02b4b524fe02b8b96bd781c8eceb
SHA1 36e2eb7e1ae58b103b2d1cca5991786b0118534b
SHA256 e780a1b2be7dab91bdc77bd313dd5a4456e0d92164fc1e54894f086f269d85c6
SHA512 80caf55a2f2a63e99c5ee6199b3b8357fd5d2bf92cb671f80a0b05385cc79f78fc689d60197176fc1bae67ab331e8bdf71adf44c88423bbbf95e7926e31e5bc8

C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe

MD5 65ba8303fabfb2652158af69f7124772
SHA1 e7a679c504b8f00c995da10f1fa66fb6458832a2
SHA256 3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8
SHA512 cc77310aa5caf21cfcfd318b97f804d565fb0ecb8ad6f3335bd9883a9c3db3d94e784b4b9ac54b04ee71172d62fb23e8b99de93237e9d798cb02d5359a83c5f0

C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe

MD5 65ba8303fabfb2652158af69f7124772
SHA1 e7a679c504b8f00c995da10f1fa66fb6458832a2
SHA256 3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8
SHA512 cc77310aa5caf21cfcfd318b97f804d565fb0ecb8ad6f3335bd9883a9c3db3d94e784b4b9ac54b04ee71172d62fb23e8b99de93237e9d798cb02d5359a83c5f0

C:\Users\Admin\AppData\Local\Microsoft\iPlR5R.exe

MD5 3524139d7687147f53dc7df4f4867093
SHA1 77a6308dc4981ac164a887ed54a0e01c63c17c63
SHA256 954429625375fc965c2151a8b109c07d1f6de6fbf9c3b95660400d9b4bf79081
SHA512 48df3de51b20e20660804f92a699f9b3886406c1872c8df02e220bf23415838ada393fc540f878aad8ebe61f7023161b15152942509b63030b6fd4a458a82db3

C:\Users\Admin\AppData\Local\Microsoft\iPlR5R.exe

MD5 3524139d7687147f53dc7df4f4867093
SHA1 77a6308dc4981ac164a887ed54a0e01c63c17c63
SHA256 954429625375fc965c2151a8b109c07d1f6de6fbf9c3b95660400d9b4bf79081
SHA512 48df3de51b20e20660804f92a699f9b3886406c1872c8df02e220bf23415838ada393fc540f878aad8ebe61f7023161b15152942509b63030b6fd4a458a82db3

memory/1756-188-0x00007FFC3C970000-0x00007FFC3CB65000-memory.dmp

memory/1756-189-0x000001F62FBB0000-0x000001F62FBB5000-memory.dmp

memory/1756-190-0x00007FFC3C970000-0x00007FFC3CB65000-memory.dmp

memory/1040-192-0x0000000000620000-0x0000000000629000-memory.dmp

memory/1040-191-0x00000000004C0000-0x00000000005C0000-memory.dmp

memory/3884-193-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3884-195-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\RrcF8ac9.exe

MD5 1b2b02b4b524fe02b8b96bd781c8eceb
SHA1 36e2eb7e1ae58b103b2d1cca5991786b0118534b
SHA256 e780a1b2be7dab91bdc77bd313dd5a4456e0d92164fc1e54894f086f269d85c6
SHA512 80caf55a2f2a63e99c5ee6199b3b8357fd5d2bf92cb671f80a0b05385cc79f78fc689d60197176fc1bae67ab331e8bdf71adf44c88423bbbf95e7926e31e5bc8

memory/4056-197-0x0000000000700000-0x000000000070F000-memory.dmp

memory/4056-196-0x0000000000770000-0x0000000000870000-memory.dmp

memory/1804-198-0x0000000001F60000-0x0000000001F65000-memory.dmp

memory/4056-199-0x0000000000400000-0x000000000049A000-memory.dmp

memory/1804-200-0x0000000000400000-0x000000000049A000-memory.dmp

memory/1804-201-0x00000000005B0000-0x00000000006B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\ZU1ED@_S.exe

MD5 65ba8303fabfb2652158af69f7124772
SHA1 e7a679c504b8f00c995da10f1fa66fb6458832a2
SHA256 3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8
SHA512 cc77310aa5caf21cfcfd318b97f804d565fb0ecb8ad6f3335bd9883a9c3db3d94e784b4b9ac54b04ee71172d62fb23e8b99de93237e9d798cb02d5359a83c5f0

memory/3180-206-0x0000000003320000-0x0000000003336000-memory.dmp

memory/3884-207-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[55594697-3483].[[email protected]].8base

MD5 e890c78f51617c4d46cd65f542c241cc
SHA1 fc0e42794433c1dc24e680f948463b8ba5efd835
SHA256 decb7af811a7cac3b850106a2980bdd6385559c9fdd4bd81f43a92f3e9f9f5ac
SHA512 e6c11cb980896a9028d4ae242bd9340b0c3b0e737fd225b354c793a1fe0daa69cc69ee9763b33abc45ff13aa0dfe2fd72387a185234f6907653d75097636e00e

memory/4056-538-0x0000000000770000-0x0000000000870000-memory.dmp

memory/4056-628-0x0000000000400000-0x000000000049A000-memory.dmp

memory/1804-1106-0x00000000005B0000-0x00000000006B0000-memory.dmp

memory/4056-1288-0x0000000000400000-0x000000000049A000-memory.dmp

memory/3484-1548-0x0000000000720000-0x0000000000820000-memory.dmp

memory/3484-1551-0x0000000000400000-0x000000000049A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BFFF.exe

MD5 a2f3d796dc2c2f474188db58d5ca7593
SHA1 dc88893abba370aab576dcc9bd60b5fc7bb5dd4e
SHA256 408d62cbf4789d9533230eff49b8b45c11b01fd8c8d6d65ec339725d7521a48c
SHA512 9a454f6eb65ef53baa5cff2e2dd3b4691e80acc37b78e27b4832a045420942425aa458243d3640fe9b3d5c756cfb8d65d7f828cd4b6633228a6500327c1f2b7c

memory/3484-1784-0x0000000000720000-0x0000000000820000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BFFF.exe

MD5 a2f3d796dc2c2f474188db58d5ca7593
SHA1 dc88893abba370aab576dcc9bd60b5fc7bb5dd4e
SHA256 408d62cbf4789d9533230eff49b8b45c11b01fd8c8d6d65ec339725d7521a48c
SHA512 9a454f6eb65ef53baa5cff2e2dd3b4691e80acc37b78e27b4832a045420942425aa458243d3640fe9b3d5c756cfb8d65d7f828cd4b6633228a6500327c1f2b7c

memory/4452-1962-0x0000000000600000-0x000000000066B000-memory.dmp

memory/4056-1961-0x0000000000400000-0x000000000049A000-memory.dmp

memory/4452-2073-0x0000000000670000-0x00000000006E5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ezoxz0hs.default-release\cookies.sqlite.id[55594697-3483].[[email protected]].8base

MD5 b5c96c34379cbf71bbed7c59aa64d867
SHA1 f429babcaaf019940a9a6aa4c429ded5d23a55fe
SHA256 52cea3d3bac27de5a3e16f5ba853c0993c4d7bde98638e8f0eaa75a8bda19ba5
SHA512 77f56ec68c71a2a607d122d4b033ade1f071289e1915f22fc087e79ace2c1a0ccbad5f3d9ebd95797536f7c75f78f1285f719387fe5fcd811cb61392781254ab

memory/4452-2082-0x0000000000600000-0x000000000066B000-memory.dmp

memory/4028-2196-0x0000000000910000-0x0000000000917000-memory.dmp

memory/4028-2195-0x0000000000900000-0x000000000090C000-memory.dmp

memory/4028-2197-0x0000000000900000-0x000000000090C000-memory.dmp

memory/4024-2198-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4024-2199-0x0000000000410000-0x0000000000414000-memory.dmp

memory/4024-2200-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3432-2201-0x0000000000180000-0x000000000018A000-memory.dmp

memory/3432-2202-0x0000000000170000-0x000000000017B000-memory.dmp

memory/3004-2205-0x0000000000950000-0x0000000000957000-memory.dmp

memory/3004-2209-0x0000000000940000-0x000000000094B000-memory.dmp

memory/1240-2237-0x0000000000CF0000-0x0000000000CFF000-memory.dmp

memory/4452-2239-0x0000000000600000-0x000000000066B000-memory.dmp

memory/1240-2241-0x0000000000CF0000-0x0000000000CFF000-memory.dmp

memory/1240-2240-0x0000000000D00000-0x0000000000D09000-memory.dmp

memory/4452-2238-0x0000000000670000-0x00000000006E5000-memory.dmp

memory/3432-2255-0x0000000000170000-0x000000000017B000-memory.dmp

memory/3796-2303-0x0000000001180000-0x0000000001189000-memory.dmp

memory/3796-2338-0x0000000001190000-0x0000000001195000-memory.dmp

memory/3796-2340-0x0000000001180000-0x0000000001189000-memory.dmp

memory/1948-2515-0x00000000009D0000-0x00000000009DC000-memory.dmp

memory/4024-2516-0x0000000000410000-0x0000000000414000-memory.dmp

memory/1948-2517-0x00000000009E0000-0x00000000009E6000-memory.dmp

memory/1948-2518-0x00000000009D0000-0x00000000009DC000-memory.dmp

memory/2148-2520-0x0000000000BC0000-0x0000000000BC4000-memory.dmp

memory/2148-2519-0x0000000000BB0000-0x0000000000BB9000-memory.dmp

memory/2148-2521-0x0000000000BB0000-0x0000000000BB9000-memory.dmp

memory/964-2882-0x0000000001200000-0x0000000001209000-memory.dmp

memory/3004-2883-0x0000000000950000-0x0000000000957000-memory.dmp

memory/964-2884-0x0000000001210000-0x0000000001215000-memory.dmp

memory/964-2885-0x0000000001200000-0x0000000001209000-memory.dmp

memory/3004-2886-0x0000000000940000-0x000000000094B000-memory.dmp

memory/1628-2887-0x0000000000550000-0x0000000000577000-memory.dmp

memory/4056-2888-0x0000000000400000-0x000000000049A000-memory.dmp

memory/1240-2890-0x0000000000D00000-0x0000000000D09000-memory.dmp

memory/1628-2891-0x0000000000580000-0x00000000005A1000-memory.dmp

memory/1628-2892-0x0000000000550000-0x0000000000577000-memory.dmp

memory/4180-2895-0x00000000006C0000-0x00000000006C5000-memory.dmp

memory/3796-2894-0x0000000001190000-0x0000000001195000-memory.dmp

memory/4180-2893-0x00000000006B0000-0x00000000006B9000-memory.dmp

memory/4180-2896-0x00000000006B0000-0x00000000006B9000-memory.dmp

memory/1628-2899-0x0000000000550000-0x0000000000577000-memory.dmp

memory/3180-2903-0x0000000003140000-0x0000000003150000-memory.dmp

memory/3180-3022-0x0000000003140000-0x0000000003150000-memory.dmp

memory/4900-3053-0x0000000001400000-0x0000000001406000-memory.dmp

memory/4900-3050-0x00000000011F0000-0x00000000011FB000-memory.dmp

memory/1948-2914-0x00000000009E0000-0x00000000009E6000-memory.dmp

memory/4920-3140-0x0000000000590000-0x0000000000690000-memory.dmp

memory/3180-3457-0x0000000003140000-0x0000000003150000-memory.dmp

memory/3180-3352-0x0000000003140000-0x0000000003150000-memory.dmp

C:\Users\Admin\AppData\Roaming\thfffje

MD5 1b2b02b4b524fe02b8b96bd781c8eceb
SHA1 36e2eb7e1ae58b103b2d1cca5991786b0118534b
SHA256 e780a1b2be7dab91bdc77bd313dd5a4456e0d92164fc1e54894f086f269d85c6
SHA512 80caf55a2f2a63e99c5ee6199b3b8357fd5d2bf92cb671f80a0b05385cc79f78fc689d60197176fc1bae67ab331e8bdf71adf44c88423bbbf95e7926e31e5bc8

C:\Users\Admin\AppData\Roaming\thfffje

MD5 1b2b02b4b524fe02b8b96bd781c8eceb
SHA1 36e2eb7e1ae58b103b2d1cca5991786b0118534b
SHA256 e780a1b2be7dab91bdc77bd313dd5a4456e0d92164fc1e54894f086f269d85c6
SHA512 80caf55a2f2a63e99c5ee6199b3b8357fd5d2bf92cb671f80a0b05385cc79f78fc689d60197176fc1bae67ab331e8bdf71adf44c88423bbbf95e7926e31e5bc8