phobos | 33c861023479ddcaea82f2daee9d0394f304d0c33ba210f4c3c53a93cf9a474c

General

Target

23ce1ae76844de9ad9dc0307ed629bb7.exe
Size

304KB
MD5

23ce1ae76844de9ad9dc0307ed629bb7
SHA1

9f70fd29900c659599155e8d758b938db00f43bd
SHA256

33c861023479ddcaea82f2daee9d0394f304d0c33ba210f4c3c53a93cf9a474c
SHA512

f750d46822cb91792dc13fb85beecfffe55ba8f31d2daeb8768e991216ac000ce35ae5ebaf0b7a0211406de27dd351017086e357292202ef4e6f9dedf0a35525
SSDEEP

6144:kcdY7kZx95vjjdluPMFTphrynyqDrOPiZ2oszWiofu50gq+n4P0F6:hdDndlu6PqDrEe2osKNfQ0HM3E

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\info.hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>cartilage</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #C6B5C4; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #B5CC8E; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #e6ecf2; border-left: 10px solid #B58CB2; } .alert { background: #FFE4E4; border-left: 10px solid #FFA07A; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted due to a security problem with your PC.</div> <div class='bold'>If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Or write us to the Tox: <span class='mark'>78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>7605F465-3483</span></div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>

Emails

class='mark'>[email protected]</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Extracted

Path

C:\users\public\desktop\info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Or write us to the Tox: 78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074 Write this ID in the title of your message 7605F465-3483 You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

2404 bcdedit.exe
3116 bcdedit.exe
724 bcdedit.exe
4612 bcdedit.exe
Renames multiple (470) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

4988 wbadmin.exe
116 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

452 netsh.exe
1460 netsh.exe

pid	process
2404	bcdedit.exe
3116	bcdedit.exe
724	bcdedit.exe
4612	bcdedit.exe

pid	process
4988	wbadmin.exe
116	wbadmin.exe

pid	process
452	netsh.exe
1460	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

23ce1ae76844de9ad9dc0307ed629bb7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Control Panel\International\Geo\Nation	23ce1ae76844de9ad9dc0307ed629bb7.exe

Drops startup file 3 IoCs

Processes:

23ce1ae76844de9ad9dc0307ed629bb7.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

23ce1ae76844de9ad9dc0307ed629bb7.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\23ce1ae76844de9ad9dc0307ed629bb7 = "C:\\Users\\Admin\\AppData\\Local\\23ce1ae76844de9ad9dc0307ed629bb7.exe"	23ce1ae76844de9ad9dc0307ed629bb7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\23ce1ae76844de9ad9dc0307ed629bb7 = "C:\\Users\\Admin\\AppData\\Local\\23ce1ae76844de9ad9dc0307ed629bb7.exe"	23ce1ae76844de9ad9dc0307ed629bb7.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

23ce1ae76844de9ad9dc0307ed629bb7.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Links\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1859779917-101786662-3680946609-1000\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1859779917-101786662-3680946609-1000\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Public\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	23ce1ae76844de9ad9dc0307ed629bb7.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

23ce1ae76844de9ad9dc0307ed629bb7.exe23ce1ae76844de9ad9dc0307ed629bb7.exe

description	pid	process	target process
PID 680 set thread context of 4104	680	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4856 set thread context of 1964	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe

Drops file in Program Files directory 64 IoCs

Processes:

23ce1ae76844de9ad9dc0307ed629bb7.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\ui-strings.js	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark.png	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\SystemX86\msvcp140.dll.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.scale-100_contrast-black.png	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\AddressBook2x.png.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-24.png	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nl-nl\ui-strings.js	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-125.png	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ne.pak.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libskiptags_plugin.dll	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\ui-strings.js.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster2x.jpg.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLargeTile.scale-200.png	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotThrow.snippets.ps1xml	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_ja.dll.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-core-xstate-l2-1-0.dll	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\MemMDL2.1.85.ttf	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\LargeTile.scale-200.png	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\jawt.lib	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\cmm\LINEAR_RGB.pf	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-time-l1-1-0.dll	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_contrast-white.png	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-default_32.svg.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\nacl_irt_x86_64.nexe.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_contrast-high.png	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-lightunplated.png	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main-selector.css.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-100_contrast-black.png	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\sl.pak	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\js\url-polyfill.min.js	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_pdf_18.svg	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_thumbnailview_18.svg.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml	23ce1ae76844de9ad9dc0307ed629bb7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll.id[7605F465-3483].[[email protected]].8base	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-125_contrast-white.png	23ce1ae76844de9ad9dc0307ed629bb7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png	23ce1ae76844de9ad9dc0307ed629bb7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

2236 vssadmin.exe
292 vssadmin.exe

pid	process
2236	vssadmin.exe
292	vssadmin.exe

Modifies registry class 1 IoCs

Processes:

23ce1ae76844de9ad9dc0307ed629bb7.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000_Classes\Local Settings	23ce1ae76844de9ad9dc0307ed629bb7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

23ce1ae76844de9ad9dc0307ed629bb7.exe

pid	process
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
4104	23ce1ae76844de9ad9dc0307ed629bb7.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

23ce1ae76844de9ad9dc0307ed629bb7.exe23ce1ae76844de9ad9dc0307ed629bb7.exe23ce1ae76844de9ad9dc0307ed629bb7.exevssvc.exeWMIC.exewbengine.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	680	23ce1ae76844de9ad9dc0307ed629bb7.exe
Token: SeDebugPrivilege	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe
Token: SeDebugPrivilege	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe
Token: SeBackupPrivilege	3420	vssvc.exe
Token: SeRestorePrivilege	3420	vssvc.exe
Token: SeAuditPrivilege	3420	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2504	WMIC.exe
Token: SeSecurityPrivilege	2504	WMIC.exe
Token: SeTakeOwnershipPrivilege	2504	WMIC.exe
Token: SeLoadDriverPrivilege	2504	WMIC.exe
Token: SeSystemProfilePrivilege	2504	WMIC.exe
Token: SeSystemtimePrivilege	2504	WMIC.exe
Token: SeProfSingleProcessPrivilege	2504	WMIC.exe
Token: SeIncBasePriorityPrivilege	2504	WMIC.exe
Token: SeCreatePagefilePrivilege	2504	WMIC.exe
Token: SeBackupPrivilege	2504	WMIC.exe
Token: SeRestorePrivilege	2504	WMIC.exe
Token: SeShutdownPrivilege	2504	WMIC.exe
Token: SeDebugPrivilege	2504	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2504	WMIC.exe
Token: SeRemoteShutdownPrivilege	2504	WMIC.exe
Token: SeUndockPrivilege	2504	WMIC.exe
Token: SeManageVolumePrivilege	2504	WMIC.exe
Token: 33	2504	WMIC.exe
Token: 34	2504	WMIC.exe
Token: 35	2504	WMIC.exe
Token: 36	2504	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2504	WMIC.exe
Token: SeSecurityPrivilege	2504	WMIC.exe
Token: SeTakeOwnershipPrivilege	2504	WMIC.exe
Token: SeLoadDriverPrivilege	2504	WMIC.exe
Token: SeSystemProfilePrivilege	2504	WMIC.exe
Token: SeSystemtimePrivilege	2504	WMIC.exe
Token: SeProfSingleProcessPrivilege	2504	WMIC.exe
Token: SeIncBasePriorityPrivilege	2504	WMIC.exe
Token: SeCreatePagefilePrivilege	2504	WMIC.exe
Token: SeBackupPrivilege	2504	WMIC.exe
Token: SeRestorePrivilege	2504	WMIC.exe
Token: SeShutdownPrivilege	2504	WMIC.exe
Token: SeDebugPrivilege	2504	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2504	WMIC.exe
Token: SeRemoteShutdownPrivilege	2504	WMIC.exe
Token: SeUndockPrivilege	2504	WMIC.exe
Token: SeManageVolumePrivilege	2504	WMIC.exe
Token: 33	2504	WMIC.exe
Token: 34	2504	WMIC.exe
Token: 35	2504	WMIC.exe
Token: 36	2504	WMIC.exe
Token: SeBackupPrivilege	1108	wbengine.exe
Token: SeRestorePrivilege	1108	wbengine.exe
Token: SeSecurityPrivilege	1108	wbengine.exe
Token: SeIncreaseQuotaPrivilege	2452	WMIC.exe
Token: SeSecurityPrivilege	2452	WMIC.exe
Token: SeTakeOwnershipPrivilege	2452	WMIC.exe
Token: SeLoadDriverPrivilege	2452	WMIC.exe
Token: SeSystemProfilePrivilege	2452	WMIC.exe
Token: SeSystemtimePrivilege	2452	WMIC.exe
Token: SeProfSingleProcessPrivilege	2452	WMIC.exe
Token: SeIncBasePriorityPrivilege	2452	WMIC.exe
Token: SeCreatePagefilePrivilege	2452	WMIC.exe
Token: SeBackupPrivilege	2452	WMIC.exe
Token: SeRestorePrivilege	2452	WMIC.exe
Token: SeShutdownPrivilege	2452	WMIC.exe
Token: SeDebugPrivilege	2452	WMIC.exe

Suspicious use of WriteProcessMemory 62 IoCs

Processes:

23ce1ae76844de9ad9dc0307ed629bb7.exe23ce1ae76844de9ad9dc0307ed629bb7.exe23ce1ae76844de9ad9dc0307ed629bb7.execmd.execmd.execmd.exe

description	pid	process	target process
PID 680 wrote to memory of 4104	680	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 680 wrote to memory of 4104	680	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 680 wrote to memory of 4104	680	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 680 wrote to memory of 4104	680	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 680 wrote to memory of 4104	680	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 680 wrote to memory of 4104	680	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 680 wrote to memory of 4104	680	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 680 wrote to memory of 4104	680	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 680 wrote to memory of 4104	680	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 680 wrote to memory of 4104	680	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4856 wrote to memory of 1964	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4856 wrote to memory of 1964	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4856 wrote to memory of 1964	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4856 wrote to memory of 1964	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4856 wrote to memory of 1964	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4856 wrote to memory of 1964	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4856 wrote to memory of 1964	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4856 wrote to memory of 1964	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4856 wrote to memory of 1964	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4856 wrote to memory of 1964	4856	23ce1ae76844de9ad9dc0307ed629bb7.exe	23ce1ae76844de9ad9dc0307ed629bb7.exe
PID 4104 wrote to memory of 2124	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	cmd.exe
PID 4104 wrote to memory of 2124	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	cmd.exe
PID 4104 wrote to memory of 3448	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	cmd.exe
PID 4104 wrote to memory of 3448	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	cmd.exe
PID 3448 wrote to memory of 452	3448	cmd.exe	netsh.exe
PID 3448 wrote to memory of 452	3448	cmd.exe	netsh.exe
PID 2124 wrote to memory of 2236	2124	cmd.exe	vssadmin.exe
PID 2124 wrote to memory of 2236	2124	cmd.exe	vssadmin.exe
PID 2124 wrote to memory of 2504	2124	cmd.exe	WMIC.exe
PID 2124 wrote to memory of 2504	2124	cmd.exe	WMIC.exe
PID 3448 wrote to memory of 1460	3448	cmd.exe	netsh.exe
PID 3448 wrote to memory of 1460	3448	cmd.exe	netsh.exe
PID 2124 wrote to memory of 2404	2124	cmd.exe	bcdedit.exe
PID 2124 wrote to memory of 2404	2124	cmd.exe	bcdedit.exe
PID 2124 wrote to memory of 3116	2124	cmd.exe	bcdedit.exe
PID 2124 wrote to memory of 3116	2124	cmd.exe	bcdedit.exe
PID 2124 wrote to memory of 4988	2124	cmd.exe	wbadmin.exe
PID 2124 wrote to memory of 4988	2124	cmd.exe	wbadmin.exe
PID 4104 wrote to memory of 1936	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 1936	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 1936	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 1412	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 1412	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 1412	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 3080	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 3080	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 3080	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 4720	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 4720	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 4720	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	mshta.exe
PID 4104 wrote to memory of 3468	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	cmd.exe
PID 4104 wrote to memory of 3468	4104	23ce1ae76844de9ad9dc0307ed629bb7.exe	cmd.exe
PID 3468 wrote to memory of 292	3468	cmd.exe	vssadmin.exe
PID 3468 wrote to memory of 292	3468	cmd.exe	vssadmin.exe
PID 3468 wrote to memory of 2452	3468	cmd.exe	WMIC.exe
PID 3468 wrote to memory of 2452	3468	cmd.exe	WMIC.exe
PID 3468 wrote to memory of 724	3468	cmd.exe	bcdedit.exe
PID 3468 wrote to memory of 724	3468	cmd.exe	bcdedit.exe
PID 3468 wrote to memory of 4612	3468	cmd.exe	bcdedit.exe
PID 3468 wrote to memory of 4612	3468	cmd.exe	bcdedit.exe
PID 3468 wrote to memory of 116	3468	cmd.exe	wbadmin.exe
PID 3468 wrote to memory of 116	3468	cmd.exe	wbadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\23ce1ae76844de9ad9dc0307ed629bb7.exe
"C:\Users\Admin\AppData\Local\Temp\23ce1ae76844de9ad9dc0307ed629bb7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680

C:\Users\Admin\AppData\Local\Temp\23ce1ae76844de9ad9dc0307ed629bb7.exe
C:\Users\Admin\AppData\Local\Temp\23ce1ae76844de9ad9dc0307ed629bb7.exe
2⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104

C:\Users\Admin\AppData\Local\Temp\23ce1ae76844de9ad9dc0307ed629bb7.exe
"C:\Users\Admin\AppData\Local\Temp\23ce1ae76844de9ad9dc0307ed629bb7.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856

C:\Users\Admin\AppData\Local\Temp\23ce1ae76844de9ad9dc0307ed629bb7.exe
C:\Users\Admin\AppData\Local\Temp\23ce1ae76844de9ad9dc0307ed629bb7.exe
4⤵
PID:1964

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2236

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:2404

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:3116

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:4988

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:452

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:1460

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
PID:1936

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
PID:1412

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
PID:3080

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
PID:4720

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:292

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:724

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:4612

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:116

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4272

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:300

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

3

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[7605F465-3483].[[email protected]].8base
Filesize
2.7MB

MD5
871b719bb519537a07f777926f1077e1

SHA1
70a8a001363c1810503f3358bef60584c2432f93

SHA256
750c2a6dcaf0134645c7260a281cab402d39b626c7f1afec13415120a38af644

SHA512
d94f9722d844a03b7b9c84ad7e96acb68f4ae2aa3990b356324c1152a123ec209381b3cee110489d5313ad5738f7b893e57862fff1fe7c3b79f1911dcc6ac8cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\23ce1ae76844de9ad9dc0307ed629bb7.exe.log
Filesize
927B

MD5
4a911455784f74e368a4c2c7876d76f4

SHA1
a1700a0849ffb4f26671eb76da2489946b821c34

SHA256
264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c

SHA512
4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

Download Submit
C:\Users\Admin\Desktop\info.hta
Filesize
5KB

MD5
ff6e10108c3e791104207b176b73ccae

SHA1
c4ca00c26133b89ea0a46563122c90f1ffb5ff1c

SHA256
5af1771c0f7cd0d02ceeeeea3c6a7edd1bde2c265ddc1f23251982aa3144eed4

SHA512
2f6566d0e03ccd0225f7a5f409fa84af0866c7a31b5e6276d5cc2e00e853043fc42bb83a42aee3d6a0e7e008ee5a828e9e9cf134e1479d834154a1ba046aeedb

Download Submit
C:\info.hta
Filesize
5KB

MD5
ff6e10108c3e791104207b176b73ccae

SHA1
c4ca00c26133b89ea0a46563122c90f1ffb5ff1c

SHA256
5af1771c0f7cd0d02ceeeeea3c6a7edd1bde2c265ddc1f23251982aa3144eed4

SHA512
2f6566d0e03ccd0225f7a5f409fa84af0866c7a31b5e6276d5cc2e00e853043fc42bb83a42aee3d6a0e7e008ee5a828e9e9cf134e1479d834154a1ba046aeedb

Download Submit
C:\info.hta
Filesize
5KB

MD5
ff6e10108c3e791104207b176b73ccae

SHA1
c4ca00c26133b89ea0a46563122c90f1ffb5ff1c

SHA256
5af1771c0f7cd0d02ceeeeea3c6a7edd1bde2c265ddc1f23251982aa3144eed4

SHA512
2f6566d0e03ccd0225f7a5f409fa84af0866c7a31b5e6276d5cc2e00e853043fc42bb83a42aee3d6a0e7e008ee5a828e9e9cf134e1479d834154a1ba046aeedb

Download Submit
C:\users\public\desktop\info.hta
Filesize
5KB

MD5
ff6e10108c3e791104207b176b73ccae

SHA1
c4ca00c26133b89ea0a46563122c90f1ffb5ff1c

SHA256
5af1771c0f7cd0d02ceeeeea3c6a7edd1bde2c265ddc1f23251982aa3144eed4

SHA512
2f6566d0e03ccd0225f7a5f409fa84af0866c7a31b5e6276d5cc2e00e853043fc42bb83a42aee3d6a0e7e008ee5a828e9e9cf134e1479d834154a1ba046aeedb

Download Submit
F:\info.hta
Filesize
5KB

MD5
ff6e10108c3e791104207b176b73ccae

SHA1
c4ca00c26133b89ea0a46563122c90f1ffb5ff1c

SHA256
5af1771c0f7cd0d02ceeeeea3c6a7edd1bde2c265ddc1f23251982aa3144eed4

SHA512
2f6566d0e03ccd0225f7a5f409fa84af0866c7a31b5e6276d5cc2e00e853043fc42bb83a42aee3d6a0e7e008ee5a828e9e9cf134e1479d834154a1ba046aeedb

Download Submit
memory/680-3-0x00000000061A0000-0x0000000006744000-memory.dmp

Filesize
5.6MB

Download
memory/680-8-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/680-0-0x0000000000FD0000-0x0000000001022000-memory.dmp

Filesize
328KB

Download
memory/680-2-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/680-1-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/1964-17-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-221-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-51-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-31-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-33-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-34-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-35-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-40-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-100-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-149-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-180-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-216-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-27-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-184-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-215-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-191-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-162-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-4-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-29-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-83-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-255-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-245-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-256-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-258-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-522-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-607-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-780-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-1990-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-1988-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-2000-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-12115-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4104-9-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4856-11-0x00000000752F0000-0x0000000075AA0000-memory.dmp

Filesize
7.7MB

Download
memory/4856-12-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/4856-15-0x00000000752F0000-0x0000000075AA0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads