Malware Analysis Report

2024-11-16 12:19

Sample ID 230714-hee1bscd87
Target 3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8
SHA256 3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8
Tags
phobos evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8

Threat Level: Known bad

The file 3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8 was found to be: Known bad.

Malicious Activity Summary

phobos evasion persistence ransomware spyware stealer

Phobos

Deletes shadow copies

Modifies boot configuration data using bcdedit

Renames multiple (477) files with added filename extension

Deletes backup catalog

Modifies Windows Firewall

Reads user/profile data of web browsers

Drops startup file

Checks computer location settings

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Program crash

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Modifies registry class

Uses Task Scheduler COM API

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-14 06:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-14 06:38

Reported

2023-07-14 06:41

Platform

win10v2004-20230703-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (477) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8 = "C:\\Users\\Admin\\AppData\\Local\\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe" C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8 = "C:\\Users\\Admin\\AppData\\Local\\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe" C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3011986978-2180659500-3669311805-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3011986978-2180659500-3669311805-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\PREVIEW.GIF.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_contrast-white.png C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN010.XML C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\7-Zip\Lang\eu.txt.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\be_get.svg.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OSFROAMINGPROXY.DLL C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\en-US\oledb32r.dll.mui C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-US.PhoneNumber.ot C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\MSFT_PackageManagementSource.strings.psd1.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.winmd C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_hr.json C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_zh-TW.dll C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fy.txt C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as90.xsl.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\lib\cmm\CIEXYZ.pf.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\management\management.properties C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ta.pak.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-40_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\ContainExactly.ps1 C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White.png.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_en.json C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\am.pak.DATA.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\199.png C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinStatusBar.v11.1.dll C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.id[E3033BF8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-30.png C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ui-strings.js C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\WMPMediaSharing.dll.mui C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3328 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\system32\cmd.exe
PID 3328 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\system32\cmd.exe
PID 3328 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\system32\cmd.exe
PID 3328 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\system32\cmd.exe
PID 4244 wrote to memory of 2876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4244 wrote to memory of 2876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3824 wrote to memory of 1220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3824 wrote to memory of 1220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3824 wrote to memory of 4232 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3824 wrote to memory of 4232 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4244 wrote to memory of 4324 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4244 wrote to memory of 4324 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3824 wrote to memory of 1696 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3824 wrote to memory of 1696 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3824 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3824 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3824 wrote to memory of 864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3824 wrote to memory of 864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3328 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\SysWOW64\mshta.exe
PID 3328 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\system32\cmd.exe
PID 3328 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe C:\Windows\system32\cmd.exe
PID 2668 wrote to memory of 5020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2668 wrote to memory of 5020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2668 wrote to memory of 4260 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2668 wrote to memory of 4260 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2668 wrote to memory of 1368 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 1368 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 3180 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 3180 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2668 wrote to memory of 980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe

"C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe"

C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe

"C:\Users\Admin\AppData\Local\Temp\3ec359f6ab125099db4a4f7b6ad6b17ab1411a338be932ea45aea13aad7788c8.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2576 -ip 2576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 460

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 54.120.234.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 9.57.101.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 195.98.74.40.in-addr.arpa udp

Files

memory/3328-134-0x0000000000600000-0x0000000000700000-memory.dmp

memory/3328-135-0x0000000000520000-0x000000000052F000-memory.dmp

memory/3328-136-0x0000000000400000-0x000000000049A000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[E3033BF8-3483].[[email protected]].8base

MD5 d48324cf66ae05185a8d21b64099bb26
SHA1 123dde60a7b561a8a07b1ba4e00c2143f89468ee
SHA256 e9a31f02578a9c763e66b0fc5634d97f92f9f1165465ad0afef2b395fc124c4e
SHA512 d7b1c177dbd56c87ddbf7d383fb81fb5eca4bf705db6f0d5d0bffa9cb197efc3ce0a739734f388e5a1440bd6470baa36e4b85c30d1d9336af7ae014206c05be1

memory/3328-376-0x0000000000600000-0x0000000000700000-memory.dmp

memory/3328-748-0x0000000000520000-0x000000000052F000-memory.dmp

memory/3328-798-0x0000000000400000-0x000000000049A000-memory.dmp

memory/3328-846-0x0000000000400000-0x000000000049A000-memory.dmp

memory/2576-1404-0x0000000000740000-0x0000000000840000-memory.dmp

memory/2576-1436-0x0000000000400000-0x000000000049A000-memory.dmp

memory/3328-3566-0x0000000000400000-0x000000000049A000-memory.dmp

memory/3328-4959-0x0000000000400000-0x000000000049A000-memory.dmp

memory/3328-6653-0x0000000000400000-0x000000000049A000-memory.dmp

memory/3328-9956-0x0000000000400000-0x000000000049A000-memory.dmp

C:\info.hta

MD5 9d93025d57f0cbc72150ab2c2d85619e
SHA1 a7462e1a15d186d030ec35f7e1b121c7f96a0ded
SHA256 bf4af8560b9e60c4085251e285b11e54ce99dff7edf99755b1173f6ec84a2e43
SHA512 f72f0ac614c9d6566ebf9aecc991a74f694cad9c61c1a63bd572a81293344d09982f062816079b744496cfcbdc959e1c9c12e70e1599b9bd8c9093b17c1c40f5

C:\info.hta

MD5 9d93025d57f0cbc72150ab2c2d85619e
SHA1 a7462e1a15d186d030ec35f7e1b121c7f96a0ded
SHA256 bf4af8560b9e60c4085251e285b11e54ce99dff7edf99755b1173f6ec84a2e43
SHA512 f72f0ac614c9d6566ebf9aecc991a74f694cad9c61c1a63bd572a81293344d09982f062816079b744496cfcbdc959e1c9c12e70e1599b9bd8c9093b17c1c40f5

C:\Users\Admin\Desktop\info.hta

MD5 9d93025d57f0cbc72150ab2c2d85619e
SHA1 a7462e1a15d186d030ec35f7e1b121c7f96a0ded
SHA256 bf4af8560b9e60c4085251e285b11e54ce99dff7edf99755b1173f6ec84a2e43
SHA512 f72f0ac614c9d6566ebf9aecc991a74f694cad9c61c1a63bd572a81293344d09982f062816079b744496cfcbdc959e1c9c12e70e1599b9bd8c9093b17c1c40f5

F:\info.hta

MD5 9d93025d57f0cbc72150ab2c2d85619e
SHA1 a7462e1a15d186d030ec35f7e1b121c7f96a0ded
SHA256 bf4af8560b9e60c4085251e285b11e54ce99dff7edf99755b1173f6ec84a2e43
SHA512 f72f0ac614c9d6566ebf9aecc991a74f694cad9c61c1a63bd572a81293344d09982f062816079b744496cfcbdc959e1c9c12e70e1599b9bd8c9093b17c1c40f5

C:\users\public\desktop\info.hta

MD5 9d93025d57f0cbc72150ab2c2d85619e
SHA1 a7462e1a15d186d030ec35f7e1b121c7f96a0ded
SHA256 bf4af8560b9e60c4085251e285b11e54ce99dff7edf99755b1173f6ec84a2e43
SHA512 f72f0ac614c9d6566ebf9aecc991a74f694cad9c61c1a63bd572a81293344d09982f062816079b744496cfcbdc959e1c9c12e70e1599b9bd8c9093b17c1c40f5

memory/3328-12156-0x0000000000400000-0x000000000049A000-memory.dmp