Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
03-08-2023 17:40
Static task
static1
Behavioral task
behavioral1
Sample
MsMpEng.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
MsMpEng.exe
Resource
win10v2004-20230703-en
General
-
Target
MsMpEng.exe
-
Size
56KB
-
MD5
feac4d584524d823436a85d12ddcea84
-
SHA1
682bace188ab95cdf872bfd58e5570411f2b0d35
-
SHA256
b298eb79516d68aba301ccef3b664f9d81092127650301b15f9b249945d527f4
-
SHA512
d0d9653a6d895041549f7935e0e7b7eb10ff17731f7d644b5ce8e41a6940a9ee5215efd43c0e171aaeea2678829de973365a088df3064dd2d527e9367272b9d7
-
SSDEEP
1536:dNeRBl5PT/rx1mzwRMSTdLpJCfaHIHzs189:dQRrmzwR5JOHz1
Malware Config
Extracted
C:\info.hta
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\Users\Admin\Desktop\info.hta
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 1128 bcdedit.exe 764 bcdedit.exe 2688 bcdedit.exe 1648 bcdedit.exe -
Renames multiple (315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exewbadmin.exepid process 1472 wbadmin.exe 1080 wbadmin.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 3 IoCs
Processes:
MsMpEng.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini MsMpEng.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\MsMpEng.exe MsMpEng.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
MsMpEng.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsMpEng = "C:\\Users\\Admin\\AppData\\Local\\MsMpEng.exe" MsMpEng.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\Run\MsMpEng = "C:\\Users\\Admin\\AppData\\Local\\MsMpEng.exe" MsMpEng.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
MsMpEng.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini MsMpEng.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini MsMpEng.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini MsMpEng.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini MsMpEng.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini MsMpEng.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini MsMpEng.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VMTMQO7B\desktop.ini MsMpEng.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini MsMpEng.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini MsMpEng.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini MsMpEng.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini MsMpEng.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\7N1WTHAY\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini MsMpEng.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini MsMpEng.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini MsMpEng.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4219371764-2579186923-3390623117-1000\desktop.ini MsMpEng.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z13CS2YQ\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini MsMpEng.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini MsMpEng.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini MsMpEng.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini MsMpEng.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini MsMpEng.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini MsMpEng.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini MsMpEng.exe File opened for modification C:\Users\Public\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\WQH5U7RP\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\Music\desktop.ini MsMpEng.exe File opened for modification C:\Users\Public\Pictures\desktop.ini MsMpEng.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-4219371764-2579186923-3390623117-1000\desktop.ini MsMpEng.exe File opened for modification C:\Program Files (x86)\desktop.ini MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W493OQIZ\desktop.ini MsMpEng.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini MsMpEng.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini MsMpEng.exe File opened for modification C:\Users\Public\Music\desktop.ini MsMpEng.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\Documents\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\Links\desktop.ini MsMpEng.exe File opened for modification C:\Users\Public\Downloads\desktop.ini MsMpEng.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini MsMpEng.exe File opened for modification C:\Users\Public\Documents\desktop.ini MsMpEng.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini MsMpEng.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini MsMpEng.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\S87W4FRX\desktop.ini MsMpEng.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini MsMpEng.exe -
Drops file in Program Files directory 64 IoCs
Processes:
MsMpEng.exedescription ioc process File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03668_.WMF.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238983.WMF MsMpEng.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\IRIS.INF MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF MsMpEng.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN.DPV.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html MsMpEng.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api MsMpEng.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.CNT MsMpEng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar MsMpEng.exe File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24Images.jpg MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx MsMpEng.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\TipBand.dll.mui MsMpEng.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02470U.BMP.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html MsMpEng.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\THMBNAIL.PNG MsMpEng.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui MsMpEng.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png MsMpEng.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0283209.GIF.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSGR3FR.LEX.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanResume.Dotx MsMpEng.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt MsMpEng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau MsMpEng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll MsMpEng.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CUPINST.WMF MsMpEng.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log MsMpEng.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\PREVIEW.GIF.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\xlsrvintl.dll MsMpEng.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00728_.WMF MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay.css MsMpEng.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html MsMpEng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar MsMpEng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar MsMpEng.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui MsMpEng.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseout.png MsMpEng.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt MsMpEng.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdatl3.dll MsMpEng.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png MsMpEng.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0205582.WMF.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR10F.GIF.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR49F.GIF MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00172_.WMF MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105234.WMF MsMpEng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1 MsMpEng.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2iexp.dll MsMpEng.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF MsMpEng.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_choosefont.gif.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_COL.HXT MsMpEng.exe File created C:\Program Files\7-Zip\Lang\kab.txt.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\SWBELL.NET.XML MsMpEng.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.id[D4E39E33-3376].[[email protected]].Elbie MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185780.WMF MsMpEng.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00013_.WMF MsMpEng.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2360 vssadmin.exe 2640 vssadmin.exe -
Processes:
mshta.exemshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MsMpEng.exepid process 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe 2604 MsMpEng.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MsMpEng.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 2604 MsMpEng.exe Token: SeBackupPrivilege 2692 vssvc.exe Token: SeRestorePrivilege 2692 vssvc.exe Token: SeAuditPrivilege 2692 vssvc.exe Token: SeIncreaseQuotaPrivilege 1644 WMIC.exe Token: SeSecurityPrivilege 1644 WMIC.exe Token: SeTakeOwnershipPrivilege 1644 WMIC.exe Token: SeLoadDriverPrivilege 1644 WMIC.exe Token: SeSystemProfilePrivilege 1644 WMIC.exe Token: SeSystemtimePrivilege 1644 WMIC.exe Token: SeProfSingleProcessPrivilege 1644 WMIC.exe Token: SeIncBasePriorityPrivilege 1644 WMIC.exe Token: SeCreatePagefilePrivilege 1644 WMIC.exe Token: SeBackupPrivilege 1644 WMIC.exe Token: SeRestorePrivilege 1644 WMIC.exe Token: SeShutdownPrivilege 1644 WMIC.exe Token: SeDebugPrivilege 1644 WMIC.exe Token: SeSystemEnvironmentPrivilege 1644 WMIC.exe Token: SeRemoteShutdownPrivilege 1644 WMIC.exe Token: SeUndockPrivilege 1644 WMIC.exe Token: SeManageVolumePrivilege 1644 WMIC.exe Token: 33 1644 WMIC.exe Token: 34 1644 WMIC.exe Token: 35 1644 WMIC.exe Token: SeIncreaseQuotaPrivilege 1644 WMIC.exe Token: SeSecurityPrivilege 1644 WMIC.exe Token: SeTakeOwnershipPrivilege 1644 WMIC.exe Token: SeLoadDriverPrivilege 1644 WMIC.exe Token: SeSystemProfilePrivilege 1644 WMIC.exe Token: SeSystemtimePrivilege 1644 WMIC.exe Token: SeProfSingleProcessPrivilege 1644 WMIC.exe Token: SeIncBasePriorityPrivilege 1644 WMIC.exe Token: SeCreatePagefilePrivilege 1644 WMIC.exe Token: SeBackupPrivilege 1644 WMIC.exe Token: SeRestorePrivilege 1644 WMIC.exe Token: SeShutdownPrivilege 1644 WMIC.exe Token: SeDebugPrivilege 1644 WMIC.exe Token: SeSystemEnvironmentPrivilege 1644 WMIC.exe Token: SeRemoteShutdownPrivilege 1644 WMIC.exe Token: SeUndockPrivilege 1644 WMIC.exe Token: SeManageVolumePrivilege 1644 WMIC.exe Token: 33 1644 WMIC.exe Token: 34 1644 WMIC.exe Token: 35 1644 WMIC.exe Token: SeBackupPrivilege 2756 wbengine.exe Token: SeRestorePrivilege 2756 wbengine.exe Token: SeSecurityPrivilege 2756 wbengine.exe Token: SeIncreaseQuotaPrivilege 2472 WMIC.exe Token: SeSecurityPrivilege 2472 WMIC.exe Token: SeTakeOwnershipPrivilege 2472 WMIC.exe Token: SeLoadDriverPrivilege 2472 WMIC.exe Token: SeSystemProfilePrivilege 2472 WMIC.exe Token: SeSystemtimePrivilege 2472 WMIC.exe Token: SeProfSingleProcessPrivilege 2472 WMIC.exe Token: SeIncBasePriorityPrivilege 2472 WMIC.exe Token: SeCreatePagefilePrivilege 2472 WMIC.exe Token: SeBackupPrivilege 2472 WMIC.exe Token: SeRestorePrivilege 2472 WMIC.exe Token: SeShutdownPrivilege 2472 WMIC.exe Token: SeDebugPrivilege 2472 WMIC.exe Token: SeSystemEnvironmentPrivilege 2472 WMIC.exe Token: SeRemoteShutdownPrivilege 2472 WMIC.exe Token: SeUndockPrivilege 2472 WMIC.exe Token: SeManageVolumePrivilege 2472 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
MsMpEng.execmd.execmd.execmd.exedescription pid process target process PID 2604 wrote to memory of 1740 2604 MsMpEng.exe cmd.exe PID 2604 wrote to memory of 1740 2604 MsMpEng.exe cmd.exe PID 2604 wrote to memory of 1740 2604 MsMpEng.exe cmd.exe PID 2604 wrote to memory of 1740 2604 MsMpEng.exe cmd.exe PID 2604 wrote to memory of 284 2604 MsMpEng.exe cmd.exe PID 2604 wrote to memory of 284 2604 MsMpEng.exe cmd.exe PID 2604 wrote to memory of 284 2604 MsMpEng.exe cmd.exe PID 2604 wrote to memory of 284 2604 MsMpEng.exe cmd.exe PID 1740 wrote to memory of 2360 1740 cmd.exe vssadmin.exe PID 1740 wrote to memory of 2360 1740 cmd.exe vssadmin.exe PID 1740 wrote to memory of 2360 1740 cmd.exe vssadmin.exe PID 284 wrote to memory of 3020 284 cmd.exe netsh.exe PID 284 wrote to memory of 3020 284 cmd.exe netsh.exe PID 284 wrote to memory of 3020 284 cmd.exe netsh.exe PID 284 wrote to memory of 2464 284 cmd.exe netsh.exe PID 284 wrote to memory of 2464 284 cmd.exe netsh.exe PID 284 wrote to memory of 2464 284 cmd.exe netsh.exe PID 1740 wrote to memory of 1644 1740 cmd.exe WMIC.exe PID 1740 wrote to memory of 1644 1740 cmd.exe WMIC.exe PID 1740 wrote to memory of 1644 1740 cmd.exe WMIC.exe PID 1740 wrote to memory of 1128 1740 cmd.exe bcdedit.exe PID 1740 wrote to memory of 1128 1740 cmd.exe bcdedit.exe PID 1740 wrote to memory of 1128 1740 cmd.exe bcdedit.exe PID 1740 wrote to memory of 764 1740 cmd.exe bcdedit.exe PID 1740 wrote to memory of 764 1740 cmd.exe bcdedit.exe PID 1740 wrote to memory of 764 1740 cmd.exe bcdedit.exe PID 1740 wrote to memory of 1472 1740 cmd.exe wbadmin.exe PID 1740 wrote to memory of 1472 1740 cmd.exe wbadmin.exe PID 1740 wrote to memory of 1472 1740 cmd.exe wbadmin.exe PID 2604 wrote to memory of 2212 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2212 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2212 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2212 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 3032 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 3032 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 3032 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 3032 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2732 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2732 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2732 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2732 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2728 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2728 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2728 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2728 2604 MsMpEng.exe mshta.exe PID 2604 wrote to memory of 2164 2604 MsMpEng.exe cmd.exe PID 2604 wrote to memory of 2164 2604 MsMpEng.exe cmd.exe PID 2604 wrote to memory of 2164 2604 MsMpEng.exe cmd.exe PID 2604 wrote to memory of 2164 2604 MsMpEng.exe cmd.exe PID 2164 wrote to memory of 2640 2164 cmd.exe vssadmin.exe PID 2164 wrote to memory of 2640 2164 cmd.exe vssadmin.exe PID 2164 wrote to memory of 2640 2164 cmd.exe vssadmin.exe PID 2164 wrote to memory of 2472 2164 cmd.exe WMIC.exe PID 2164 wrote to memory of 2472 2164 cmd.exe WMIC.exe PID 2164 wrote to memory of 2472 2164 cmd.exe WMIC.exe PID 2164 wrote to memory of 2688 2164 cmd.exe bcdedit.exe PID 2164 wrote to memory of 2688 2164 cmd.exe bcdedit.exe PID 2164 wrote to memory of 2688 2164 cmd.exe bcdedit.exe PID 2164 wrote to memory of 1648 2164 cmd.exe bcdedit.exe PID 2164 wrote to memory of 1648 2164 cmd.exe bcdedit.exe PID 2164 wrote to memory of 1648 2164 cmd.exe bcdedit.exe PID 2164 wrote to memory of 1080 2164 cmd.exe wbadmin.exe PID 2164 wrote to memory of 1080 2164 cmd.exe wbadmin.exe PID 2164 wrote to memory of 1080 2164 cmd.exe wbadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"2⤵PID:2204
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2360 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1128 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:764 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1472 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
PID:3020 -
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:2464 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2212 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:3032 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2732 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2728 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2640 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2688 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1648 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1080
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1060
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1468
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.id[D4E39E33-3376].[[email protected]].Elbie
Filesize189.5MB
MD59b1ac31865cf9557ecab38d92ec1af6e
SHA18d789940375218875c6dc80e357ba6de5eff7147
SHA256e8cb891de17b1e290cfe2e25f64fd1a5ace6ffb9f0221c129986b76ed8b8b126
SHA512c35bd80f0ce4d548205ce78c0bfe9b802b0c34d38286809fd2bc972af317e93c129a26fdc43c03c7fd6036bd156b04b8c8ddec9a2af00db8e6ad92c12b54037a
-
Filesize
5KB
MD52b963217f3219b24a3bb0a6ec0ee630a
SHA16b43109d50a539262b43e294ca758fb667971180
SHA2569f3f44958154172de924b952e570ffc56f23425ed4c6b0953b94ecd2f0ad7c9b
SHA512b73b771b1df71b444bd709a15cf3cf853b275b6e2e17104ed882f4d4ce887ae5a01e4145770b96b6fadcbf0c1550f9f9502cd9d9f55b72710398207605936f36
-
Filesize
5KB
MD52b963217f3219b24a3bb0a6ec0ee630a
SHA16b43109d50a539262b43e294ca758fb667971180
SHA2569f3f44958154172de924b952e570ffc56f23425ed4c6b0953b94ecd2f0ad7c9b
SHA512b73b771b1df71b444bd709a15cf3cf853b275b6e2e17104ed882f4d4ce887ae5a01e4145770b96b6fadcbf0c1550f9f9502cd9d9f55b72710398207605936f36
-
Filesize
5KB
MD52b963217f3219b24a3bb0a6ec0ee630a
SHA16b43109d50a539262b43e294ca758fb667971180
SHA2569f3f44958154172de924b952e570ffc56f23425ed4c6b0953b94ecd2f0ad7c9b
SHA512b73b771b1df71b444bd709a15cf3cf853b275b6e2e17104ed882f4d4ce887ae5a01e4145770b96b6fadcbf0c1550f9f9502cd9d9f55b72710398207605936f36
-
Filesize
5KB
MD52b963217f3219b24a3bb0a6ec0ee630a
SHA16b43109d50a539262b43e294ca758fb667971180
SHA2569f3f44958154172de924b952e570ffc56f23425ed4c6b0953b94ecd2f0ad7c9b
SHA512b73b771b1df71b444bd709a15cf3cf853b275b6e2e17104ed882f4d4ce887ae5a01e4145770b96b6fadcbf0c1550f9f9502cd9d9f55b72710398207605936f36
-
Filesize
5KB
MD52b963217f3219b24a3bb0a6ec0ee630a
SHA16b43109d50a539262b43e294ca758fb667971180
SHA2569f3f44958154172de924b952e570ffc56f23425ed4c6b0953b94ecd2f0ad7c9b
SHA512b73b771b1df71b444bd709a15cf3cf853b275b6e2e17104ed882f4d4ce887ae5a01e4145770b96b6fadcbf0c1550f9f9502cd9d9f55b72710398207605936f36