Malware Analysis Report

2024-11-16 12:20

Sample ID 230715-ee283sgh63
Target 7166d39e9c1cb17e1728d316531242b1.exe
SHA256 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7
Tags
phobos evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7

Threat Level: Known bad

The file 7166d39e9c1cb17e1728d316531242b1.exe was found to be: Known bad.

Malicious Activity Summary

phobos evasion persistence ransomware spyware stealer

Phobos

Modifies boot configuration data using bcdedit

Renames multiple (480) files with added filename extension

Deletes shadow copies

Renames multiple (312) files with added filename extension

Deletes backup catalog

Modifies Windows Firewall

Reads user/profile data of web browsers

Checks computer location settings

Drops startup file

Drops desktop.ini file(s)

Adds Run key to start application

Drops file in Program Files directory

Program crash

Unsigned PE

Enumerates physical storage devices

Interacts with shadow copies

Uses Task Scheduler COM API

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-15 03:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-15 03:52

Reported

2023-07-15 03:54

Platform

win7-20230712-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (312) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\7166d39e9c1cb17e1728d316531242b1.exe C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7166d39e9c1cb17e1728d316531242b1 = "C:\\Users\\Admin\\AppData\\Local\\7166d39e9c1cb17e1728d316531242b1.exe" C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\Run\7166d39e9c1cb17e1728d316531242b1 = "C:\\Users\\Admin\\AppData\\Local\\7166d39e9c1cb17e1728d316531242b1.exe" C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\WQH5U7RP\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z13CS2YQ\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6C1HE16Q\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4219371764-2579186923-3390623117-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VMTMQO7B\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\S87W4FRX\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W493OQIZ\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-4219371764-2579186923-3390623117-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR34F.GIF C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\activity16v.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153089.WMF C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287644.JPG C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\setup_wm.exe.mui C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145272.JPG C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099202.GIF C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105588.WMF.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03379I.JPG C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\BCSRuntime.dll.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBPQT.DPV.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Xlate_Complete.xsn C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\SaveRestore.M2V.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00443_.WMF.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\settings.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\ECHO.INF.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099168.JPG C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195772.WMF.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jre7\bin\net.dll.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00452_.WMF C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jre7\lib\fontconfig.properties.src.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NL7Models0011.DLL.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107302.WMF.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR18F.GIF.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\mscss7en.dll.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Median.xml C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14981_.GIF.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVELOPE.DPV.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar.id[D09FD71D-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2692 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 2044 wrote to memory of 2828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2044 wrote to memory of 2828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2044 wrote to memory of 2828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1996 wrote to memory of 2864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1996 wrote to memory of 2864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1996 wrote to memory of 2864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2044 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2044 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2044 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1996 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1996 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1996 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1996 wrote to memory of 2668 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1996 wrote to memory of 2668 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1996 wrote to memory of 2668 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1996 wrote to memory of 2540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1996 wrote to memory of 2540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1996 wrote to memory of 2540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1996 wrote to memory of 2320 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1996 wrote to memory of 2320 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1996 wrote to memory of 2320 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2692 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 2692 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 1732 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1732 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1732 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1732 wrote to memory of 1212 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1732 wrote to memory of 1212 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1732 wrote to memory of 1212 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1732 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1732 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1732 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1732 wrote to memory of 1388 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1732 wrote to memory of 1388 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1732 wrote to memory of 1388 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1732 wrote to memory of 1232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1732 wrote to memory of 1232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1732 wrote to memory of 1232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe

"C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe"

C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe

"C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

N/A

Files

memory/2692-55-0x0000000000270000-0x0000000000370000-memory.dmp

memory/2692-56-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2692-57-0x00000000001B0000-0x00000000001BF000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[D09FD71D-3483].[[email protected]].8base

MD5 ee991d2cbaed7b9721226feca7ff8a87
SHA1 16fb8611a9e4ad02b80233254f903ef8e24f7c3e
SHA256 cb10efe6d7b81e7287ec9dc21bd764e415ee66307e6d73a9abdba8198616e3d8
SHA512 fbdb3129d17ebe076b2d36719fb98f525dcb27fb22c335d66de06b1c96489f4bb7de100f1993af67f2dd06717c6f93b83a3d5558688396aa4b6d14b1f3ad425c

memory/2692-190-0x0000000000270000-0x0000000000370000-memory.dmp

memory/2508-272-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2508-271-0x00000000005F0000-0x00000000006F0000-memory.dmp

memory/2692-270-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2692-444-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2692-1548-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2692-3367-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2692-6429-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/2692-9111-0x0000000000400000-0x00000000004E3000-memory.dmp

C:\info.hta

MD5 8601e8cc301e8e810237f9c1189217a5
SHA1 3cac7e6ae76f5c117d1595e088382d37dabe11c9
SHA256 a071355e9cdfa6e76cefac544dc2dda0dec1c289c1cd5dcab692f530a17278d1
SHA512 9c43c1ac1b0c514ad16dc91206e2d4cfb391387273eebe499b01a3cd1f909ce173627917a126ea08f4a638235ccc397db5e30842f08812f899ad32b5f0223a7c

C:\info.hta

MD5 8601e8cc301e8e810237f9c1189217a5
SHA1 3cac7e6ae76f5c117d1595e088382d37dabe11c9
SHA256 a071355e9cdfa6e76cefac544dc2dda0dec1c289c1cd5dcab692f530a17278d1
SHA512 9c43c1ac1b0c514ad16dc91206e2d4cfb391387273eebe499b01a3cd1f909ce173627917a126ea08f4a638235ccc397db5e30842f08812f899ad32b5f0223a7c

C:\users\public\desktop\info.hta

MD5 8601e8cc301e8e810237f9c1189217a5
SHA1 3cac7e6ae76f5c117d1595e088382d37dabe11c9
SHA256 a071355e9cdfa6e76cefac544dc2dda0dec1c289c1cd5dcab692f530a17278d1
SHA512 9c43c1ac1b0c514ad16dc91206e2d4cfb391387273eebe499b01a3cd1f909ce173627917a126ea08f4a638235ccc397db5e30842f08812f899ad32b5f0223a7c

F:\info.hta

MD5 8601e8cc301e8e810237f9c1189217a5
SHA1 3cac7e6ae76f5c117d1595e088382d37dabe11c9
SHA256 a071355e9cdfa6e76cefac544dc2dda0dec1c289c1cd5dcab692f530a17278d1
SHA512 9c43c1ac1b0c514ad16dc91206e2d4cfb391387273eebe499b01a3cd1f909ce173627917a126ea08f4a638235ccc397db5e30842f08812f899ad32b5f0223a7c

C:\Users\Admin\Desktop\info.hta

MD5 8601e8cc301e8e810237f9c1189217a5
SHA1 3cac7e6ae76f5c117d1595e088382d37dabe11c9
SHA256 a071355e9cdfa6e76cefac544dc2dda0dec1c289c1cd5dcab692f530a17278d1
SHA512 9c43c1ac1b0c514ad16dc91206e2d4cfb391387273eebe499b01a3cd1f909ce173627917a126ea08f4a638235ccc397db5e30842f08812f899ad32b5f0223a7c

memory/2692-10318-0x0000000000400000-0x00000000004E3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-07-15 03:52

Reported

2023-07-15 03:54

Platform

win10v2004-20230703-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (480) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\7166d39e9c1cb17e1728d316531242b1.exe C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7166d39e9c1cb17e1728d316531242b1 = "C:\\Users\\Admin\\AppData\\Local\\7166d39e9c1cb17e1728d316531242b1.exe" C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7166d39e9c1cb17e1728d316531242b1 = "C:\\Users\\Admin\\AppData\\Local\\7166d39e9c1cb17e1728d316531242b1.exe" C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3011986978-2180659500-3669311805-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3011986978-2180659500-3669311805-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre1.8.0_66\bin\java.dll.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\ui-strings.js C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\LargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\WideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\ado\msadox.dll C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Temp\EU8BB5.tmp\psuser_arm64.dll C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SKU.dll C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCacheMini.scale-100.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\it-IT\msadcer.dll.mui C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-100.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Core.winmd C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_sr-Latn.json C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\gl.pak.DATA C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack.dll C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Internal.msix.DATA C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTEXTRA.TTF C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\ui-strings.js.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\wmplayer.exe.mui C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MotionController_Pair.jpg C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-20_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\ui-strings.js.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\saext.dll C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\Validator.Tests.ps1 C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\DirectInk.dll.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search.png.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\Entities.DATA.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\clrcompression.dll C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\SmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\System\msvcr100.dll.id[811E9C14-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3976 wrote to memory of 416 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 3976 wrote to memory of 416 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 3976 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 3976 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 4732 wrote to memory of 4112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4732 wrote to memory of 4112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 416 wrote to memory of 3684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 416 wrote to memory of 3684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 416 wrote to memory of 4252 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 416 wrote to memory of 4252 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4732 wrote to memory of 4584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4732 wrote to memory of 4584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 416 wrote to memory of 2020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 416 wrote to memory of 2020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 416 wrote to memory of 4256 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 416 wrote to memory of 4256 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 416 wrote to memory of 3280 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 416 wrote to memory of 3280 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3976 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\SysWOW64\mshta.exe
PID 3976 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 3976 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe C:\Windows\system32\cmd.exe
PID 3468 wrote to memory of 4320 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3468 wrote to memory of 4320 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3468 wrote to memory of 316 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3468 wrote to memory of 316 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3468 wrote to memory of 3344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3468 wrote to memory of 3344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3468 wrote to memory of 3032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3468 wrote to memory of 3032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3468 wrote to memory of 4084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3468 wrote to memory of 4084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe

"C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe"

C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe

"C:\Users\Admin\AppData\Local\Temp\7166d39e9c1cb17e1728d316531242b1.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3228 -ip 3228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 464

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 54.120.234.20.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 38.148.119.40.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp

Files

memory/3976-134-0x00000000004F0000-0x00000000005F0000-memory.dmp

memory/3976-135-0x00000000020F0000-0x00000000020FF000-memory.dmp

memory/3976-136-0x0000000000400000-0x00000000004E3000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[811E9C14-3483].[[email protected]].8base

MD5 008f7bd065558ddda863377514ba5380
SHA1 576d76fc3513650bce3e236a9fedf5e29e30ec0b
SHA256 9aabb53eb2cbfd3bb24749431b2234bf28c6b255c18256b15745b5ed739ad828
SHA512 d8a1105e3b641743d906f19fff87d40528e4abf9ab3b941ce6605d0bc887ec6e6e56917dae080eed0972a093f95963aaaab4c720c5cedb2224f04b3d51eb8124

memory/3976-404-0x00000000004F0000-0x00000000005F0000-memory.dmp

memory/3976-779-0x00000000020F0000-0x00000000020FF000-memory.dmp

memory/3976-846-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3976-949-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3228-1355-0x00000000006A0000-0x00000000007A0000-memory.dmp

memory/3228-1400-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3976-2726-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3976-4998-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3976-6428-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/3976-10423-0x0000000000400000-0x00000000004E3000-memory.dmp

C:\info.hta

MD5 c474eaf0dcc8594636e40aa096345b49
SHA1 19567651a92097816aee60febd5e9e75301807c2
SHA256 79f02b2951cecb4402080906f3a892e93808fafe7101e7018fda0572a4f8d263
SHA512 cdb5230c04a01ae1c9fe13b67f29874131b02f11c73124dce8000dd1cdae82c6183d987eae3bede1afe8cc3de9a25865476ee7473d15c08c6b5dc8f91214c3a1

C:\info.hta

MD5 c474eaf0dcc8594636e40aa096345b49
SHA1 19567651a92097816aee60febd5e9e75301807c2
SHA256 79f02b2951cecb4402080906f3a892e93808fafe7101e7018fda0572a4f8d263
SHA512 cdb5230c04a01ae1c9fe13b67f29874131b02f11c73124dce8000dd1cdae82c6183d987eae3bede1afe8cc3de9a25865476ee7473d15c08c6b5dc8f91214c3a1

C:\users\public\desktop\info.hta

MD5 c474eaf0dcc8594636e40aa096345b49
SHA1 19567651a92097816aee60febd5e9e75301807c2
SHA256 79f02b2951cecb4402080906f3a892e93808fafe7101e7018fda0572a4f8d263
SHA512 cdb5230c04a01ae1c9fe13b67f29874131b02f11c73124dce8000dd1cdae82c6183d987eae3bede1afe8cc3de9a25865476ee7473d15c08c6b5dc8f91214c3a1

C:\Users\Admin\Desktop\info.hta

MD5 c474eaf0dcc8594636e40aa096345b49
SHA1 19567651a92097816aee60febd5e9e75301807c2
SHA256 79f02b2951cecb4402080906f3a892e93808fafe7101e7018fda0572a4f8d263
SHA512 cdb5230c04a01ae1c9fe13b67f29874131b02f11c73124dce8000dd1cdae82c6183d987eae3bede1afe8cc3de9a25865476ee7473d15c08c6b5dc8f91214c3a1

F:\info.hta

MD5 c474eaf0dcc8594636e40aa096345b49
SHA1 19567651a92097816aee60febd5e9e75301807c2
SHA256 79f02b2951cecb4402080906f3a892e93808fafe7101e7018fda0572a4f8d263
SHA512 cdb5230c04a01ae1c9fe13b67f29874131b02f11c73124dce8000dd1cdae82c6183d987eae3bede1afe8cc3de9a25865476ee7473d15c08c6b5dc8f91214c3a1

memory/3976-12170-0x0000000000400000-0x00000000004E3000-memory.dmp