phobos | 356799503f195db260e08a81d42a431b4ebd47cef94eddc96f24a0fd3e49d716

General

Target

e244628c750d40509ef2e3e72e4c2049.exe
Size

630KB
MD5

e244628c750d40509ef2e3e72e4c2049
SHA1

f823f35c00580524fef34d9084721a4cea703016
SHA256

356799503f195db260e08a81d42a431b4ebd47cef94eddc96f24a0fd3e49d716
SHA512

329e78c0f70fb0af13624dc83263ef5ea3a5382e69b36ceb957d052db670d720fc99ff1275543bdc47d388d2cb4ffe560d468230fbe71dcb2f870c57d24b3cb8
SSDEEP

12288:Etj+xbGF2Wi8qpq3ll2iEpiXH7Nu6GKy:aj0E2WNq03l0rpiXHhp

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\info.hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>cartilage</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #C6B5C4; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #B5CC8E; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #e6ecf2; border-left: 10px solid #B58CB2; } .alert { background: #FFE4E4; border-left: 10px solid #FFA07A; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted due to a security problem with your PC.</div> <div class='bold'>If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Or write us to the Tox: <span class='mark'>78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>701CA4AD-3483</span></div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>

Emails

class='mark'>[email protected]</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Extracted

Path

F:\info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Or write us to the Tox: 78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074 Write this ID in the title of your message 701CA4AD-3483 You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

2148 bcdedit.exe
1648 bcdedit.exe
2400 bcdedit.exe
660 bcdedit.exe
Renames multiple (320) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

3052 wbadmin.exe
2896 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

2580 netsh.exe
280 netsh.exe

pid	process
2148	bcdedit.exe
1648	bcdedit.exe
2400	bcdedit.exe
660	bcdedit.exe

pid	process
3052	wbadmin.exe
2896	wbadmin.exe

pid	process
2580	netsh.exe
280	netsh.exe

Drops startup file 3 IoCs

Processes:

e244628c750d40509ef2e3e72e4c2049.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e244628c750d40509ef2e3e72e4c2049.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e244628c750d40509ef2e3e72e4c2049 = "C:\\Users\\Admin\\AppData\\Local\\e244628c750d40509ef2e3e72e4c2049.exe"	e244628c750d40509ef2e3e72e4c2049.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\e244628c750d40509ef2e3e72e4c2049 = "C:\\Users\\Admin\\AppData\\Local\\e244628c750d40509ef2e3e72e4c2049.exe"	e244628c750d40509ef2e3e72e4c2049.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

e244628c750d40509ef2e3e72e4c2049.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HJMUORIZ\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3750544865-3773649541-1858556521-1000\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3750544865-3773649541-1858556521-1000\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDLDGKZQ\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RIT0VQ4M\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YK5VI4QL\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Public\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	e244628c750d40509ef2e3e72e4c2049.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

e244628c750d40509ef2e3e72e4c2049.exee244628c750d40509ef2e3e72e4c2049.exe

description	pid	process	target process
PID 2468 set thread context of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 set thread context of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe

Drops file in Program Files directory 64 IoCs

Processes:

e244628c750d40509ef2e3e72e4c2049.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\RSSFeeds.js	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IPIRM.XML	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00443_.WMF.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099182.WMF.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01838_.GIF	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\subscription.xsd	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\Graph.jtp	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_dot.png	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105410.WMF.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIcons.jpg.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Top.accdt.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239965.WMF.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DISTLSTL.ICO	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\redStateIcon.png	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0282932.WMF.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Java\jre7\lib\resources.jar.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSSKETLG.WMF.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186348.WMF	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182946.WMF	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSAEXP30.DLL	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00629_.WMF.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\Java\jre7\bin\awt.dll.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME11.CSS.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\libvlccore.dll.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\STUDIO.ELM.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099170.WMF.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00656_.WMF.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FINCL_02.MID.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00395_.WMF	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot_lrg.png	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File created	C:\Program Files\Java\jre7\bin\klist.exe.id[701CA4AD-3483].[[email protected]].8base	e244628c750d40509ef2e3e72e4c2049.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\LASER.WAV	e244628c750d40509ef2e3e72e4c2049.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

2588 vssadmin.exe
1836 vssadmin.exe

pid	process
2588	vssadmin.exe
1836	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exemshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e244628c750d40509ef2e3e72e4c2049.exee244628c750d40509ef2e3e72e4c2049.exee244628c750d40509ef2e3e72e4c2049.exe

pid	process
2468	e244628c750d40509ef2e3e72e4c2049.exe
2664	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe
2168	e244628c750d40509ef2e3e72e4c2049.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e244628c750d40509ef2e3e72e4c2049.exee244628c750d40509ef2e3e72e4c2049.exee244628c750d40509ef2e3e72e4c2049.exevssvc.exeWMIC.exewbengine.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2468	e244628c750d40509ef2e3e72e4c2049.exe
Token: SeDebugPrivilege	2664	e244628c750d40509ef2e3e72e4c2049.exe
Token: SeDebugPrivilege	2168	e244628c750d40509ef2e3e72e4c2049.exe
Token: SeBackupPrivilege	1084	vssvc.exe
Token: SeRestorePrivilege	1084	vssvc.exe
Token: SeAuditPrivilege	1084	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2744	WMIC.exe
Token: SeSecurityPrivilege	2744	WMIC.exe
Token: SeTakeOwnershipPrivilege	2744	WMIC.exe
Token: SeLoadDriverPrivilege	2744	WMIC.exe
Token: SeSystemProfilePrivilege	2744	WMIC.exe
Token: SeSystemtimePrivilege	2744	WMIC.exe
Token: SeProfSingleProcessPrivilege	2744	WMIC.exe
Token: SeIncBasePriorityPrivilege	2744	WMIC.exe
Token: SeCreatePagefilePrivilege	2744	WMIC.exe
Token: SeBackupPrivilege	2744	WMIC.exe
Token: SeRestorePrivilege	2744	WMIC.exe
Token: SeShutdownPrivilege	2744	WMIC.exe
Token: SeDebugPrivilege	2744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2744	WMIC.exe
Token: SeRemoteShutdownPrivilege	2744	WMIC.exe
Token: SeUndockPrivilege	2744	WMIC.exe
Token: SeManageVolumePrivilege	2744	WMIC.exe
Token: 33	2744	WMIC.exe
Token: 34	2744	WMIC.exe
Token: 35	2744	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2744	WMIC.exe
Token: SeSecurityPrivilege	2744	WMIC.exe
Token: SeTakeOwnershipPrivilege	2744	WMIC.exe
Token: SeLoadDriverPrivilege	2744	WMIC.exe
Token: SeSystemProfilePrivilege	2744	WMIC.exe
Token: SeSystemtimePrivilege	2744	WMIC.exe
Token: SeProfSingleProcessPrivilege	2744	WMIC.exe
Token: SeIncBasePriorityPrivilege	2744	WMIC.exe
Token: SeCreatePagefilePrivilege	2744	WMIC.exe
Token: SeBackupPrivilege	2744	WMIC.exe
Token: SeRestorePrivilege	2744	WMIC.exe
Token: SeShutdownPrivilege	2744	WMIC.exe
Token: SeDebugPrivilege	2744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2744	WMIC.exe
Token: SeRemoteShutdownPrivilege	2744	WMIC.exe
Token: SeUndockPrivilege	2744	WMIC.exe
Token: SeManageVolumePrivilege	2744	WMIC.exe
Token: 33	2744	WMIC.exe
Token: 34	2744	WMIC.exe
Token: 35	2744	WMIC.exe
Token: SeBackupPrivilege	2812	wbengine.exe
Token: SeRestorePrivilege	2812	wbengine.exe
Token: SeSecurityPrivilege	2812	wbengine.exe
Token: SeIncreaseQuotaPrivilege	2588	WMIC.exe
Token: SeSecurityPrivilege	2588	WMIC.exe
Token: SeTakeOwnershipPrivilege	2588	WMIC.exe
Token: SeLoadDriverPrivilege	2588	WMIC.exe
Token: SeSystemProfilePrivilege	2588	WMIC.exe
Token: SeSystemtimePrivilege	2588	WMIC.exe
Token: SeProfSingleProcessPrivilege	2588	WMIC.exe
Token: SeIncBasePriorityPrivilege	2588	WMIC.exe
Token: SeCreatePagefilePrivilege	2588	WMIC.exe
Token: SeBackupPrivilege	2588	WMIC.exe
Token: SeRestorePrivilege	2588	WMIC.exe
Token: SeShutdownPrivilege	2588	WMIC.exe
Token: SeDebugPrivilege	2588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2588	WMIC.exe
Token: SeRemoteShutdownPrivilege	2588	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e244628c750d40509ef2e3e72e4c2049.exee244628c750d40509ef2e3e72e4c2049.exee244628c750d40509ef2e3e72e4c2049.execmd.execmd.exe

description	pid	process	target process
PID 2468 wrote to memory of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2468 wrote to memory of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2468 wrote to memory of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2468 wrote to memory of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2468 wrote to memory of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2468 wrote to memory of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2468 wrote to memory of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2468 wrote to memory of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2468 wrote to memory of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2468 wrote to memory of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2468 wrote to memory of 2168	2468	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 wrote to memory of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 wrote to memory of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 wrote to memory of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 wrote to memory of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 wrote to memory of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 wrote to memory of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 wrote to memory of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 wrote to memory of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 wrote to memory of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 wrote to memory of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2664 wrote to memory of 2780	2664	e244628c750d40509ef2e3e72e4c2049.exe	e244628c750d40509ef2e3e72e4c2049.exe
PID 2168 wrote to memory of 2540	2168	e244628c750d40509ef2e3e72e4c2049.exe	cmd.exe
PID 2168 wrote to memory of 2540	2168	e244628c750d40509ef2e3e72e4c2049.exe	cmd.exe
PID 2168 wrote to memory of 2540	2168	e244628c750d40509ef2e3e72e4c2049.exe	cmd.exe
PID 2168 wrote to memory of 2540	2168	e244628c750d40509ef2e3e72e4c2049.exe	cmd.exe
PID 2168 wrote to memory of 2552	2168	e244628c750d40509ef2e3e72e4c2049.exe	cmd.exe
PID 2168 wrote to memory of 2552	2168	e244628c750d40509ef2e3e72e4c2049.exe	cmd.exe
PID 2168 wrote to memory of 2552	2168	e244628c750d40509ef2e3e72e4c2049.exe	cmd.exe
PID 2168 wrote to memory of 2552	2168	e244628c750d40509ef2e3e72e4c2049.exe	cmd.exe
PID 2540 wrote to memory of 2580	2540	cmd.exe	netsh.exe
PID 2540 wrote to memory of 2580	2540	cmd.exe	netsh.exe
PID 2540 wrote to memory of 2580	2540	cmd.exe	netsh.exe
PID 2552 wrote to memory of 2588	2552	cmd.exe	vssadmin.exe
PID 2552 wrote to memory of 2588	2552	cmd.exe	vssadmin.exe
PID 2552 wrote to memory of 2588	2552	cmd.exe	vssadmin.exe
PID 2540 wrote to memory of 280	2540	cmd.exe	netsh.exe
PID 2540 wrote to memory of 280	2540	cmd.exe	netsh.exe
PID 2540 wrote to memory of 280	2540	cmd.exe	netsh.exe
PID 2552 wrote to memory of 2744	2552	cmd.exe	WMIC.exe
PID 2552 wrote to memory of 2744	2552	cmd.exe	WMIC.exe
PID 2552 wrote to memory of 2744	2552	cmd.exe	WMIC.exe
PID 2552 wrote to memory of 2148	2552	cmd.exe	bcdedit.exe
PID 2552 wrote to memory of 2148	2552	cmd.exe	bcdedit.exe
PID 2552 wrote to memory of 2148	2552	cmd.exe	bcdedit.exe
PID 2552 wrote to memory of 1648	2552	cmd.exe	bcdedit.exe
PID 2552 wrote to memory of 1648	2552	cmd.exe	bcdedit.exe
PID 2552 wrote to memory of 1648	2552	cmd.exe	bcdedit.exe
PID 2552 wrote to memory of 3052	2552	cmd.exe	wbadmin.exe
PID 2552 wrote to memory of 3052	2552	cmd.exe	wbadmin.exe
PID 2552 wrote to memory of 3052	2552	cmd.exe	wbadmin.exe
PID 2168 wrote to memory of 2860	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 2860	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 2860	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 2860	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 1696	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 1696	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 1696	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 1696	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 1536	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 1536	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 1536	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 1536	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe
PID 2168 wrote to memory of 2592	2168	e244628c750d40509ef2e3e72e4c2049.exe	mshta.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\e244628c750d40509ef2e3e72e4c2049.exe
"C:\Users\Admin\AppData\Local\Temp\e244628c750d40509ef2e3e72e4c2049.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468

C:\Users\Admin\AppData\Local\Temp\e244628c750d40509ef2e3e72e4c2049.exe
C:\Users\Admin\AppData\Local\Temp\e244628c750d40509ef2e3e72e4c2049.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168

C:\Users\Admin\AppData\Local\Temp\e244628c750d40509ef2e3e72e4c2049.exe
"C:\Users\Admin\AppData\Local\Temp\e244628c750d40509ef2e3e72e4c2049.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664

C:\Users\Admin\AppData\Local\Temp\e244628c750d40509ef2e3e72e4c2049.exe
C:\Users\Admin\AppData\Local\Temp\e244628c750d40509ef2e3e72e4c2049.exe
4⤵
PID:2780

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2540

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:2580

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:280

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2588

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:2148

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:1648

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:3052

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:2860

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:1696

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:1536

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:2592

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:112

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1836

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:2400

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:660

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:2896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1796

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1228

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

3

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.id[701CA4AD-3483].[[email protected]].8base
Filesize
24.4MB

MD5
fc1b15c0d192ab39d486ae6b5fdf56eb

SHA1
70340b9d1abb8901603271127794827615973abc

SHA256
b879c073e827a5647956df3dd486e0352ea4700e7063ff3fbf175c1b5500219c

SHA512
c2c4d8fd8b9010ede953748b5164c238f1760a1745275175adc5f66b2c5cb759a0453bcfecd544a908b13ba7199d58bc42da942555c4689783c8dbc6165d66f1

Download Submit
C:\Users\Admin\Desktop\info.hta
Filesize
5KB

MD5
54663669883be643cba7828a17f12a33

SHA1
e6376643c53a30d5575c45f7bbca00479b706c9b

SHA256
9f4cb63040227b4047365bd13547406c206b1c46df3b60cfc031522f984e6207

SHA512
7497a5bd364fe3a6f56e8cd3d75a4549a80334d09154c53d2d48cd429f1c1d576c2f7d535fbf077f262f2f69a798cc50ceb40adfc723302931b3d470f79200ea

Download Submit
C:\info.hta
Filesize
5KB

MD5
54663669883be643cba7828a17f12a33

SHA1
e6376643c53a30d5575c45f7bbca00479b706c9b

SHA256
9f4cb63040227b4047365bd13547406c206b1c46df3b60cfc031522f984e6207

SHA512
7497a5bd364fe3a6f56e8cd3d75a4549a80334d09154c53d2d48cd429f1c1d576c2f7d535fbf077f262f2f69a798cc50ceb40adfc723302931b3d470f79200ea

Download Submit
C:\info.hta
Filesize
5KB

MD5
54663669883be643cba7828a17f12a33

SHA1
e6376643c53a30d5575c45f7bbca00479b706c9b

SHA256
9f4cb63040227b4047365bd13547406c206b1c46df3b60cfc031522f984e6207

SHA512
7497a5bd364fe3a6f56e8cd3d75a4549a80334d09154c53d2d48cd429f1c1d576c2f7d535fbf077f262f2f69a798cc50ceb40adfc723302931b3d470f79200ea

Download Submit
C:\users\public\desktop\info.hta
Filesize
5KB

MD5
54663669883be643cba7828a17f12a33

SHA1
e6376643c53a30d5575c45f7bbca00479b706c9b

SHA256
9f4cb63040227b4047365bd13547406c206b1c46df3b60cfc031522f984e6207

SHA512
7497a5bd364fe3a6f56e8cd3d75a4549a80334d09154c53d2d48cd429f1c1d576c2f7d535fbf077f262f2f69a798cc50ceb40adfc723302931b3d470f79200ea

Download Submit
F:\info.hta
Filesize
5KB

MD5
54663669883be643cba7828a17f12a33

SHA1
e6376643c53a30d5575c45f7bbca00479b706c9b

SHA256
9f4cb63040227b4047365bd13547406c206b1c46df3b60cfc031522f984e6207

SHA512
7497a5bd364fe3a6f56e8cd3d75a4549a80334d09154c53d2d48cd429f1c1d576c2f7d535fbf077f262f2f69a798cc50ceb40adfc723302931b3d470f79200ea

Download Submit
memory/2168-47-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-233-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-9-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-11-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2168-14-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-2900-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-17-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-18-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-2325-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-2316-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-2306-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-253-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-99-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-44-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-88-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-46-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-48-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-49-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-50-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-70-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-6-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-80-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-86-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2168-85-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2468-16-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2468-1-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2468-2-0x00000000001C0000-0x0000000000206000-memory.dmp

Filesize
280KB

Download
memory/2468-3-0x00000000043E0000-0x0000000004420000-memory.dmp

Filesize
256KB

Download
memory/2468-4-0x0000000000260000-0x0000000000294000-memory.dmp

Filesize
208KB

Download
memory/2468-5-0x00000000007C0000-0x000000000080C000-memory.dmp

Filesize
304KB

Download
memory/2468-0-0x00000000002C0000-0x0000000000364000-memory.dmp

Filesize
656KB

Download
memory/2664-19-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2664-20-0x00000000002C0000-0x0000000000364000-memory.dmp

Filesize
656KB

Download
memory/2664-21-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download
memory/2664-32-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2780-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2780-34-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads