Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2023, 08:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Fast.ex_.exe
Resource
win7-20230831-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fast.ex_.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
Fast.ex_.exe
-
Size
56KB
-
MD5
85f25d227ff80bfe9fb07eedcf831c50
-
SHA1
99740958fa077db80051ff8243a58b38b9287ee7
-
SHA256
8575dcf7c67612b4d1fc1315bb19318f06bb5abdc6341890e251eb303e386db7
-
SHA512
db453f931f767cd377b2afe0782410ec5766ac8d96d33a64efc9a2723835b7062edca9b8a07c5632bafd00f605c9ac955bbaa2aead706e398a46010de9caad5c
-
SSDEEP
1536:RNeRBl5PT/rx1mzwRMSTdLpJauhIvnbVz9K:RQRrmzwR5J/hWnhJ
Score
10/10
Malware Config
Extracted
Path
C:\info.hta
Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>
<html>
<head>
<meta charset='windows-1251'>
<title>encrypted</title>
<HTA:APPLICATION
ICON='msiexec.exe'
SINGLEINSTANCE='yes'
SysMenu="no">
<script language='JScript'>
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type='text/css'>
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #EDEDED;
}
img {
display:inline-block;
}
.bold {
font-weight: bold;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
text-align: center;
font-size: 30px;
line-height: 50px;
font-weight: bold;
margin-bottom:20px;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
.footer {
position:fixed;
bottom:0;
right:0;
text-align: right;
}
</style>
</head>
<body>
<div class='header'>
<img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='>
<div>All your files have been encrypted!</div>
</div>
<div class='bold'>All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>6DCDD8B3-3404</span></div>
<div class='bold'>In case of no answer in 24 hours write us to this e-mail:<span class='mark'>[email protected]</span></div>
<div>
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
</div>
<div class='note info'>
<div class='title'>Free decryption as guarantee</div>
<ul>Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul>
</div>
<div class='note info'>
<div class='title'>How to obtain Bitcoins</div>
<ul>
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
<br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>
<br> Also you can find other places to buy Bitcoins and beginners guide here:
<br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a>
</ul>
</div>
<div class='note alert'>
<div class='title'>Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>
Emails
URLs
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
Path
C:\info.hta
Ransom Note
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected]
Write this ID in the title of your message 6DCDD8B3-3404
In case of no answer in 24 hours write us to this e-mail: [email protected]
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 3784 bcdedit.exe 1848 bcdedit.exe 5260 bcdedit.exe 5232 bcdedit.exe -
Renames multiple (468) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 4908 wbadmin.exe 5268 wbadmin.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 3680 netsh.exe 1048 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation Fast.ex_.exe -
Drops startup file 3 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\Fast.ex_.exe Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Fast.ex_.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fast.ex_ = "C:\\Users\\Admin\\AppData\\Local\\Fast.ex_.exe" Fast.ex_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fast.ex_ = "C:\\Users\\Admin\\AppData\\Local\\Fast.ex_.exe" Fast.ex_.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\Links\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\Music\desktop.ini Fast.ex_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini Fast.ex_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Fast.ex_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Public\Music\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Public\Videos\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Fast.ex_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Fast.ex_.exe File opened for modification C:\Program Files\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Fast.ex_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI Fast.ex_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Public\Libraries\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Fast.ex_.exe File opened for modification C:\Users\Public\Pictures\desktop.ini Fast.ex_.exe File opened for modification C:\Program Files (x86)\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Fast.ex_.exe File opened for modification C:\Users\Public\Documents\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Fast.ex_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini Fast.ex_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Fast.ex_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Fast.ex_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Fast.ex_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Fast.ex_.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2890696111-2332180956-3312704074-1000\desktop.ini Fast.ex_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms Fast.ex_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png Fast.ex_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestDrive.Tests.ps1 Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-400_contrast-black.png Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-300.png Fast.ex_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\share.svg.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\VBAOWS10.CHM.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_block_plugin.dll.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png Fast.ex_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-white_scale-125.png Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-300.png Fast.ex_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\ui-strings.js.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png Fast.ex_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DatabaseCore.dll.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-80_altform-lightunplated.png Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteWideTile.scale-125.png Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-400.png Fast.ex_.exe File created C:\Program Files\Java\jre1.8.0_66\bin\fxplugins.dll.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Star.png Fast.ex_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\SmallLogoCanary.png.DATA.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white.png Fast.ex_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_audit_report_18.svg.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected][6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-32_altform-unplated_contrast-black.png Fast.ex_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\ui-strings.js Fast.ex_.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt Fast.ex_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar Fast.ex_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar Fast.ex_.exe File created C:\Program Files\Microsoft Office\root\Office16\OSFUI.DLL.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-400.png Fast.ex_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\ui-strings.js Fast.ex_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\main-selector.css Fast.ex_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms Fast.ex_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\MSADDNDR.OLB.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\inline-error-2x.png.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\ui-strings.js Fast.ex_.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml Fast.ex_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\organize.svg.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\ErrorDot.png Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-256.png Fast.ex_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\s_thumbnailview_18.svg.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\GlobalMock-A.Tests.ps1 Fast.ex_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-150.png Fast.ex_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-72_altform-lightunplated.png Fast.ex_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\ui-strings.js.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-100.png Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-60_altform-unplated_contrast-white.png Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bg-BG\View3d\3DViewerProductDescription-universal.xml Fast.ex_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\AFTRNOON.ELM.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml Fast.ex_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\OriginLetter.Dotx Fast.ex_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100.png Fast.ex_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_47.dll.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.id[6DCDD8B3-3404].[[email protected]].Elbie Fast.ex_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3868 vssadmin.exe 5132 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Local Settings Fast.ex_.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe 264 Fast.ex_.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 264 Fast.ex_.exe Token: SeBackupPrivilege 2592 vssvc.exe Token: SeRestorePrivilege 2592 vssvc.exe Token: SeAuditPrivilege 2592 vssvc.exe Token: SeIncreaseQuotaPrivilege 2168 WMIC.exe Token: SeSecurityPrivilege 2168 WMIC.exe Token: SeTakeOwnershipPrivilege 2168 WMIC.exe Token: SeLoadDriverPrivilege 2168 WMIC.exe Token: SeSystemProfilePrivilege 2168 WMIC.exe Token: SeSystemtimePrivilege 2168 WMIC.exe Token: SeProfSingleProcessPrivilege 2168 WMIC.exe Token: SeIncBasePriorityPrivilege 2168 WMIC.exe Token: SeCreatePagefilePrivilege 2168 WMIC.exe Token: SeBackupPrivilege 2168 WMIC.exe Token: SeRestorePrivilege 2168 WMIC.exe Token: SeShutdownPrivilege 2168 WMIC.exe Token: SeDebugPrivilege 2168 WMIC.exe Token: SeSystemEnvironmentPrivilege 2168 WMIC.exe Token: SeRemoteShutdownPrivilege 2168 WMIC.exe Token: SeUndockPrivilege 2168 WMIC.exe Token: SeManageVolumePrivilege 2168 WMIC.exe Token: 33 2168 WMIC.exe Token: 34 2168 WMIC.exe Token: 35 2168 WMIC.exe Token: 36 2168 WMIC.exe Token: SeIncreaseQuotaPrivilege 2168 WMIC.exe Token: SeSecurityPrivilege 2168 WMIC.exe Token: SeTakeOwnershipPrivilege 2168 WMIC.exe Token: SeLoadDriverPrivilege 2168 WMIC.exe Token: SeSystemProfilePrivilege 2168 WMIC.exe Token: SeSystemtimePrivilege 2168 WMIC.exe Token: SeProfSingleProcessPrivilege 2168 WMIC.exe Token: SeIncBasePriorityPrivilege 2168 WMIC.exe Token: SeCreatePagefilePrivilege 2168 WMIC.exe Token: SeBackupPrivilege 2168 WMIC.exe Token: SeRestorePrivilege 2168 WMIC.exe Token: SeShutdownPrivilege 2168 WMIC.exe Token: SeDebugPrivilege 2168 WMIC.exe Token: SeSystemEnvironmentPrivilege 2168 WMIC.exe Token: SeRemoteShutdownPrivilege 2168 WMIC.exe Token: SeUndockPrivilege 2168 WMIC.exe Token: SeManageVolumePrivilege 2168 WMIC.exe Token: 33 2168 WMIC.exe Token: 34 2168 WMIC.exe Token: 35 2168 WMIC.exe Token: 36 2168 WMIC.exe Token: SeBackupPrivilege 4128 wbengine.exe Token: SeRestorePrivilege 4128 wbengine.exe Token: SeSecurityPrivilege 4128 wbengine.exe Token: SeIncreaseQuotaPrivilege 5316 WMIC.exe Token: SeSecurityPrivilege 5316 WMIC.exe Token: SeTakeOwnershipPrivilege 5316 WMIC.exe Token: SeLoadDriverPrivilege 5316 WMIC.exe Token: SeSystemProfilePrivilege 5316 WMIC.exe Token: SeSystemtimePrivilege 5316 WMIC.exe Token: SeProfSingleProcessPrivilege 5316 WMIC.exe Token: SeIncBasePriorityPrivilege 5316 WMIC.exe Token: SeCreatePagefilePrivilege 5316 WMIC.exe Token: SeBackupPrivilege 5316 WMIC.exe Token: SeRestorePrivilege 5316 WMIC.exe Token: SeShutdownPrivilege 5316 WMIC.exe Token: SeDebugPrivilege 5316 WMIC.exe Token: SeSystemEnvironmentPrivilege 5316 WMIC.exe Token: SeRemoteShutdownPrivilege 5316 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 264 wrote to memory of 4008 264 Fast.ex_.exe 95 PID 264 wrote to memory of 4008 264 Fast.ex_.exe 95 PID 264 wrote to memory of 5024 264 Fast.ex_.exe 96 PID 264 wrote to memory of 5024 264 Fast.ex_.exe 96 PID 4008 wrote to memory of 3868 4008 cmd.exe 100 PID 4008 wrote to memory of 3868 4008 cmd.exe 100 PID 5024 wrote to memory of 3680 5024 cmd.exe 99 PID 5024 wrote to memory of 3680 5024 cmd.exe 99 PID 5024 wrote to memory of 1048 5024 cmd.exe 105 PID 5024 wrote to memory of 1048 5024 cmd.exe 105 PID 4008 wrote to memory of 2168 4008 cmd.exe 106 PID 4008 wrote to memory of 2168 4008 cmd.exe 106 PID 4008 wrote to memory of 3784 4008 cmd.exe 107 PID 4008 wrote to memory of 3784 4008 cmd.exe 107 PID 4008 wrote to memory of 1848 4008 cmd.exe 108 PID 4008 wrote to memory of 1848 4008 cmd.exe 108 PID 4008 wrote to memory of 4908 4008 cmd.exe 109 PID 4008 wrote to memory of 4908 4008 cmd.exe 109 PID 264 wrote to memory of 1756 264 Fast.ex_.exe 120 PID 264 wrote to memory of 1756 264 Fast.ex_.exe 120 PID 264 wrote to memory of 1756 264 Fast.ex_.exe 120 PID 264 wrote to memory of 560 264 Fast.ex_.exe 121 PID 264 wrote to memory of 560 264 Fast.ex_.exe 121 PID 264 wrote to memory of 560 264 Fast.ex_.exe 121 PID 264 wrote to memory of 5340 264 Fast.ex_.exe 122 PID 264 wrote to memory of 5340 264 Fast.ex_.exe 122 PID 264 wrote to memory of 5340 264 Fast.ex_.exe 122 PID 264 wrote to memory of 4688 264 Fast.ex_.exe 123 PID 264 wrote to memory of 4688 264 Fast.ex_.exe 123 PID 264 wrote to memory of 4688 264 Fast.ex_.exe 123 PID 264 wrote to memory of 2144 264 Fast.ex_.exe 124 PID 264 wrote to memory of 2144 264 Fast.ex_.exe 124 PID 2144 wrote to memory of 5132 2144 cmd.exe 126 PID 2144 wrote to memory of 5132 2144 cmd.exe 126 PID 2144 wrote to memory of 5316 2144 cmd.exe 127 PID 2144 wrote to memory of 5316 2144 cmd.exe 127 PID 2144 wrote to memory of 5260 2144 cmd.exe 128 PID 2144 wrote to memory of 5260 2144 cmd.exe 128 PID 2144 wrote to memory of 5232 2144 cmd.exe 129 PID 2144 wrote to memory of 5232 2144 cmd.exe 129 PID 2144 wrote to memory of 5268 2144 cmd.exe 130 PID 2144 wrote to memory of 5268 2144 cmd.exe 130 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fast.ex_.exe"C:\Users\Admin\AppData\Local\Temp\Fast.ex_.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\Fast.ex_.exe"C:\Users\Admin\AppData\Local\Temp\Fast.ex_.exe"2⤵PID:2484
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3868
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:3784
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1848
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:4908
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
PID:3680
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:1048
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:1756
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:560
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:5340
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:4688
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5132
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5316
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:5260
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:5232
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:5268
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2132
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:1072
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:5312
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵PID:4680
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[6DCDD8B3-3404].[[email protected]].Elbie
Filesize2.7MB
MD5cdfa07ec043ae845da72b38ecd8827c4
SHA19def273fa599b2a37c9d09ca8cee1d74a8faf642
SHA256064e1381d11312ac34dee39667d561b814d968b91fac73340ebfa2817d8290a0
SHA512d7ed7031a4429889120cf72835c4b0d970e033d613cb80bed72f09f99820e5d052c99f0e5ba14b41f821e92fc866c2d797cb15ed9084f9988bf230cf07da32ee
-
Filesize
5KB
MD577ae3282a336a05f0ff9bd4463400080
SHA1ec2f80e5a50f927e05180884a165cc00c9b00aef
SHA256e928188d36a5a25ae3675476f4b79f88f8a817e2ecd9b1a4c913d9e463c30c93
SHA512fc04e9cc28c91781cc99a8bef5a0805212fe667555909b9368631c499c7fea80f8dc3401f615a04ab8db2a8ac0f4ec2909597e4e103c531862463a03674efc50
-
Filesize
5KB
MD577ae3282a336a05f0ff9bd4463400080
SHA1ec2f80e5a50f927e05180884a165cc00c9b00aef
SHA256e928188d36a5a25ae3675476f4b79f88f8a817e2ecd9b1a4c913d9e463c30c93
SHA512fc04e9cc28c91781cc99a8bef5a0805212fe667555909b9368631c499c7fea80f8dc3401f615a04ab8db2a8ac0f4ec2909597e4e103c531862463a03674efc50
-
Filesize
5KB
MD577ae3282a336a05f0ff9bd4463400080
SHA1ec2f80e5a50f927e05180884a165cc00c9b00aef
SHA256e928188d36a5a25ae3675476f4b79f88f8a817e2ecd9b1a4c913d9e463c30c93
SHA512fc04e9cc28c91781cc99a8bef5a0805212fe667555909b9368631c499c7fea80f8dc3401f615a04ab8db2a8ac0f4ec2909597e4e103c531862463a03674efc50
-
Filesize
5KB
MD577ae3282a336a05f0ff9bd4463400080
SHA1ec2f80e5a50f927e05180884a165cc00c9b00aef
SHA256e928188d36a5a25ae3675476f4b79f88f8a817e2ecd9b1a4c913d9e463c30c93
SHA512fc04e9cc28c91781cc99a8bef5a0805212fe667555909b9368631c499c7fea80f8dc3401f615a04ab8db2a8ac0f4ec2909597e4e103c531862463a03674efc50
-
Filesize
5KB
MD577ae3282a336a05f0ff9bd4463400080
SHA1ec2f80e5a50f927e05180884a165cc00c9b00aef
SHA256e928188d36a5a25ae3675476f4b79f88f8a817e2ecd9b1a4c913d9e463c30c93
SHA512fc04e9cc28c91781cc99a8bef5a0805212fe667555909b9368631c499c7fea80f8dc3401f615a04ab8db2a8ac0f4ec2909597e4e103c531862463a03674efc50