phobos | b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5

Analysis

max time kernel
10s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01-10-2023 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
Size

485KB
MD5

ef5f692e2fa2217e1da225e8270dd704
SHA1

17ec78fad167f76fc93f6b4e723071c3774ac092
SHA256

b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5
SHA512

2cd9f42fb1a8b29017b1b792676bffdee07ac332c1d7eef7e11e0fe0dfb5257774602c628df7e2241d820364bc547b0e8a48ccdc738982b301b2bf90f0ae14e0
SSDEEP

12288:FvLDhgtIO1ogNfJEoohlHr8yfu52/BCP04:BLDOFCLHGY/sJ

Score

10^/10

phobos evasion persistence ransomware

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1212 bcdedit.exe
1792 bcdedit.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1284 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

2908 netsh.exe
2044 netsh.exe

pid	process
1212	bcdedit.exe
1792	bcdedit.exe

pid	process
1284	wbadmin.exe

pid	process
2908	netsh.exe
2044	netsh.exe

Drops startup file 1 IoCs

Processes:

b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5 = "C:\\Users\\Admin\\AppData\\Local\\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe"	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows\CurrentVersion\Run\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5 = "C:\\Users\\Admin\\AppData\\Local\\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe"	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3849525425-30183055-657688904-1000\desktop.ini	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3849525425-30183055-657688904-1000\desktop.ini	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exeb3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

description	pid	process	target process
PID 2356 set thread context of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 set thread context of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

Drops file in Program Files directory 64 IoCs

Processes:

b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\fi.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\7z.sfx.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\7zG.exe.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\descript.ion.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\7-zip.chm.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\7z.exe.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.id[0523D3F6-3483].[[email protected]].8base	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2536 2780 WerFault.exe b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2912 vssadmin.exe

pid	pid_target	process	target process
2536	2780	WerFault.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

pid	process
2912	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

pid	process
2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exeb3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exeb3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
Token: SeDebugPrivilege	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
Token: SeDebugPrivilege	2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
Token: SeBackupPrivilege	2836	vssvc.exe
Token: SeRestorePrivilege	2836	vssvc.exe
Token: SeAuditPrivilege	2836	vssvc.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

description	pid	process	target process
PID 2356 wrote to memory of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2356 wrote to memory of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2356 wrote to memory of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2356 wrote to memory of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2356 wrote to memory of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2356 wrote to memory of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2356 wrote to memory of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2356 wrote to memory of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2356 wrote to memory of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2356 wrote to memory of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2356 wrote to memory of 2804	2356	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 wrote to memory of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 wrote to memory of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 wrote to memory of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 wrote to memory of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 wrote to memory of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 wrote to memory of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 wrote to memory of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 wrote to memory of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 wrote to memory of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 wrote to memory of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2708 wrote to memory of 2780	2708	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
PID 2780 wrote to memory of 2536	2780	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	WerFault.exe
PID 2780 wrote to memory of 2536	2780	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	WerFault.exe
PID 2780 wrote to memory of 2536	2780	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	WerFault.exe
PID 2780 wrote to memory of 2536	2780	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	WerFault.exe
PID 2804 wrote to memory of 2516	2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	cmd.exe
PID 2804 wrote to memory of 2516	2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	cmd.exe
PID 2804 wrote to memory of 2516	2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	cmd.exe
PID 2804 wrote to memory of 2516	2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	cmd.exe
PID 2804 wrote to memory of 2580	2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	cmd.exe
PID 2804 wrote to memory of 2580	2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	cmd.exe
PID 2804 wrote to memory of 2580	2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	cmd.exe
PID 2804 wrote to memory of 2580	2804	b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe	cmd.exe
PID 2516 wrote to memory of 2908	2516	cmd.exe	netsh.exe
PID 2516 wrote to memory of 2908	2516	cmd.exe	netsh.exe
PID 2516 wrote to memory of 2908	2516	cmd.exe	netsh.exe
PID 2580 wrote to memory of 2912	2580	cmd.exe	vssadmin.exe
PID 2580 wrote to memory of 2912	2580	cmd.exe	vssadmin.exe
PID 2580 wrote to memory of 2912	2580	cmd.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
"C:\Users\Admin\AppData\Local\Temp\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
C:\Users\Admin\AppData\Local\Temp\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804

C:\Users\Admin\AppData\Local\Temp\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
"C:\Users\Admin\AppData\Local\Temp\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708

C:\Users\Admin\AppData\Local\Temp\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
C:\Users\Admin\AppData\Local\Temp\b3e80316dc1e01af60bcea7218ab5ebfe81432643d29ab46b22e3b11658606d5.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 164
5⤵
- Program crash
PID:2536

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2912

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
PID:2240

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:1212

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:1792

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:1284

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2516

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:2908

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:2044

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2016

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1880

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[0523D3F6-3483].[[email protected]].8base

Filesize
143.1MB

MD5
2c71a6befc78eda6e30aebd104f32f61

SHA1
a1527d33b6d582b9f610ed8b27ab6b5f7f37312b

SHA256
16cb86c7f6183dd4426db19cfb1a6796eb3cd3d2551e24df4aa18be2cedf5755

SHA512
7a214ba0711588c7734860d65a48c28f481b1a4340a4b5d0aed4394c501644edf82b5ee685cad2a870ddb033344aa19773a6a2b8ff94a20204bb5d1794d851b6

Download Submit
memory/2356-6-0x0000000000940000-0x000000000098C000-memory.dmp

Filesize
304KB

Download
memory/2356-2-0x0000000000D60000-0x0000000000DA0000-memory.dmp

Filesize
256KB

Download
memory/2356-3-0x0000000000690000-0x00000000006D6000-memory.dmp

Filesize
280KB

Download
memory/2356-4-0x0000000000430000-0x0000000000476000-memory.dmp

Filesize
280KB

Download
memory/2356-5-0x0000000000770000-0x00000000007A4000-memory.dmp

Filesize
208KB

Download
memory/2356-17-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/2356-1-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/2356-0-0x0000000000EC0000-0x0000000000F40000-memory.dmp

Filesize
512KB

Download
memory/2708-35-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download
memory/2708-22-0x00000000046E0000-0x0000000004720000-memory.dmp

Filesize
256KB

Download
memory/2708-21-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download
memory/2708-20-0x0000000000EC0000-0x0000000000F40000-memory.dmp

Filesize
512KB

Download
memory/2780-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2804-11-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-18-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-19-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2804-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-9-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-46-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-48-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-51-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-52-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-58-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-53-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-15-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-81-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-90-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-92-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-98-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-113-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-105-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-146-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-144-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-170-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-299-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-800-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-8807-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-8809-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-8826-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2804-10260-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download