Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 00:34
Static task
static1
Behavioral task
behavioral1
Sample
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe
Resource
win10v2004-20230915-en
General
-
Target
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe
-
Size
1.7MB
-
MD5
a6ab201ae407fbe4a5da5f20dc38412b
-
SHA1
b3f8caf67f36730ad87031d206db91c861980615
-
SHA256
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
-
SHA512
eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b
-
SSDEEP
24576:fp1vJ+VbHGsD+KBrdrDeZYeGMqrK5Nt9Z64JrQTwkMZddfy6Tsqp+RjfMst:x3KpyJrQTwo6Tszgs
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 1820 bcdedit.exe 2904 bcdedit.exe -
Renames multiple (171) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exepid process 2072 wbadmin.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 1 IoCs
Processes:
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf = "C:\\Users\\Admin\\AppData\\Local\\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe" 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf = "C:\\Users\\Admin\\AppData\\Local\\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe" 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe -
Drops desktop.ini file(s) 13 IoCs
Processes:
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exedescription ioc process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2180306848-1874213455-4093218721-1000\desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2180306848-1874213455-4093218721-1000\desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exedescription pid process target process PID 1824 set thread context of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 set thread context of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe -
Drops file in Program Files directory 64 IoCs
Processes:
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00543_.WMF 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00234_.WMF.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105600.WMF 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198020.WMF.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216540.WMF.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00512_.WMF.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01041_.WMF 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\0.png 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01478U.BMP.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00199_.WMF.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Java\jre7\bin\jaas_nt.dll 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.JPG 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OSETUPUI.DLL 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107266.WMF.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libscte18_plugin.dll.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_over.png 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00361_.WMF.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187921.WMF 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jre7\lib\zi\America\Asuncion.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.png 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\gadget.xml 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\EXPEDITN.ELM 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105348.WMF.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187817.WMF.id[CFAA815D-3483].[[email protected]].8base 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Sydney 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2708 2816 WerFault.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1832 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exepid process 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeDebugPrivilege 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe Token: SeDebugPrivilege 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe Token: SeDebugPrivilege 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe Token: SeBackupPrivilege 348 vssvc.exe Token: SeRestorePrivilege 348 vssvc.exe Token: SeAuditPrivilege 348 vssvc.exe Token: SeIncreaseQuotaPrivilege 1760 WMIC.exe Token: SeSecurityPrivilege 1760 WMIC.exe Token: SeTakeOwnershipPrivilege 1760 WMIC.exe Token: SeLoadDriverPrivilege 1760 WMIC.exe Token: SeSystemProfilePrivilege 1760 WMIC.exe Token: SeSystemtimePrivilege 1760 WMIC.exe Token: SeProfSingleProcessPrivilege 1760 WMIC.exe Token: SeIncBasePriorityPrivilege 1760 WMIC.exe Token: SeCreatePagefilePrivilege 1760 WMIC.exe Token: SeBackupPrivilege 1760 WMIC.exe Token: SeRestorePrivilege 1760 WMIC.exe Token: SeShutdownPrivilege 1760 WMIC.exe Token: SeDebugPrivilege 1760 WMIC.exe Token: SeSystemEnvironmentPrivilege 1760 WMIC.exe Token: SeRemoteShutdownPrivilege 1760 WMIC.exe Token: SeUndockPrivilege 1760 WMIC.exe Token: SeManageVolumePrivilege 1760 WMIC.exe Token: 33 1760 WMIC.exe Token: 34 1760 WMIC.exe Token: 35 1760 WMIC.exe Token: SeIncreaseQuotaPrivilege 1760 WMIC.exe Token: SeSecurityPrivilege 1760 WMIC.exe Token: SeTakeOwnershipPrivilege 1760 WMIC.exe Token: SeLoadDriverPrivilege 1760 WMIC.exe Token: SeSystemProfilePrivilege 1760 WMIC.exe Token: SeSystemtimePrivilege 1760 WMIC.exe Token: SeProfSingleProcessPrivilege 1760 WMIC.exe Token: SeIncBasePriorityPrivilege 1760 WMIC.exe Token: SeCreatePagefilePrivilege 1760 WMIC.exe Token: SeBackupPrivilege 1760 WMIC.exe Token: SeRestorePrivilege 1760 WMIC.exe Token: SeShutdownPrivilege 1760 WMIC.exe Token: SeDebugPrivilege 1760 WMIC.exe Token: SeSystemEnvironmentPrivilege 1760 WMIC.exe Token: SeRemoteShutdownPrivilege 1760 WMIC.exe Token: SeUndockPrivilege 1760 WMIC.exe Token: SeManageVolumePrivilege 1760 WMIC.exe Token: 33 1760 WMIC.exe Token: 34 1760 WMIC.exe Token: 35 1760 WMIC.exe Token: SeBackupPrivilege 556 wbengine.exe Token: SeRestorePrivilege 556 wbengine.exe Token: SeSecurityPrivilege 556 wbengine.exe -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.execmd.execmd.exedescription pid process target process PID 1824 wrote to memory of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 1824 wrote to memory of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 1824 wrote to memory of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 1824 wrote to memory of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 1824 wrote to memory of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 1824 wrote to memory of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 1824 wrote to memory of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 1824 wrote to memory of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 1824 wrote to memory of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 1824 wrote to memory of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 1824 wrote to memory of 2188 1824 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2200 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2200 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2200 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2200 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2704 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2704 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2704 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2704 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2696 wrote to memory of 2816 2696 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe PID 2816 wrote to memory of 2708 2816 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe WerFault.exe PID 2816 wrote to memory of 2708 2816 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe WerFault.exe PID 2816 wrote to memory of 2708 2816 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe WerFault.exe PID 2816 wrote to memory of 2708 2816 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe WerFault.exe PID 2188 wrote to memory of 2540 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe cmd.exe PID 2188 wrote to memory of 2540 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe cmd.exe PID 2188 wrote to memory of 2540 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe cmd.exe PID 2188 wrote to memory of 2540 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe cmd.exe PID 2188 wrote to memory of 2560 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe cmd.exe PID 2188 wrote to memory of 2560 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe cmd.exe PID 2188 wrote to memory of 2560 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe cmd.exe PID 2188 wrote to memory of 2560 2188 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe cmd.exe PID 2560 wrote to memory of 1832 2560 cmd.exe vssadmin.exe PID 2560 wrote to memory of 1832 2560 cmd.exe vssadmin.exe PID 2560 wrote to memory of 1832 2560 cmd.exe vssadmin.exe PID 2540 wrote to memory of 2880 2540 cmd.exe netsh.exe PID 2540 wrote to memory of 2880 2540 cmd.exe netsh.exe PID 2540 wrote to memory of 2880 2540 cmd.exe netsh.exe PID 2540 wrote to memory of 2080 2540 cmd.exe netsh.exe PID 2540 wrote to memory of 2080 2540 cmd.exe netsh.exe PID 2540 wrote to memory of 2080 2540 cmd.exe netsh.exe PID 2560 wrote to memory of 1760 2560 cmd.exe WMIC.exe PID 2560 wrote to memory of 1760 2560 cmd.exe WMIC.exe PID 2560 wrote to memory of 1760 2560 cmd.exe WMIC.exe PID 2560 wrote to memory of 1820 2560 cmd.exe bcdedit.exe PID 2560 wrote to memory of 1820 2560 cmd.exe bcdedit.exe PID 2560 wrote to memory of 1820 2560 cmd.exe bcdedit.exe PID 2560 wrote to memory of 2904 2560 cmd.exe bcdedit.exe PID 2560 wrote to memory of 2904 2560 cmd.exe bcdedit.exe PID 2560 wrote to memory of 2904 2560 cmd.exe bcdedit.exe PID 2560 wrote to memory of 2072 2560 cmd.exe wbadmin.exe PID 2560 wrote to memory of 2072 2560 cmd.exe wbadmin.exe PID 2560 wrote to memory of 2072 2560 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe"C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exeC:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe"C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exeC:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe4⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exeC:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe4⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exeC:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 1645⤵
- Program crash
PID:2708 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
- Modifies Windows Firewall
PID:2880 -
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
- Modifies Windows Firewall
PID:2080 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:1832 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1820 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2904 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:2072
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:348
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:556
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1152
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1280
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[CFAA815D-3483].[[email protected]].8base
Filesize143.1MB
MD580c0a243c05a167ae1248aae4b501a89
SHA10126f3ee11151afe3eeeb98f84f8674e2e8a3686
SHA2564d9e5a695e3bca48876c5fe033c8381b0e000319a9af13de4ba64163e2f786a3
SHA51240ca3392188dae518929a33bc822cca8366d1e75b49a2d3884bb8f394a517b32a31d6244ff27ef5594e5c48282b1500d45b2608f017687fc54928e314dbe97c6