phobos | 9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1

General

Target

9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
Size

295KB
MD5

ff230f8ca501e06feedd202b40879e2b
SHA1

6ffb1e4af21e5413b07d0b4951f2dfaaba6b26b0
SHA256

9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1
SHA512

308edf14261f3763fe3bb65cef4b88473b91d02b032441d91cc87a9a49d7b20df381bae28eae7ded49cfca529bfe11da40d2f4ac2fa9c6495e6527604ca2d800
SSDEEP

6144:ugyOoVGyCNHIbER9bbDHyzJxE5zPYS5ycCE+WQnaTzQNeqR0R:ugyr3CNHIbeym3FCEnYeq

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1740 bcdedit.exe
2420 bcdedit.exe
Renames multiple (158) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

3028 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

2028 netsh.exe
3020 netsh.exe

pid	process
1740	bcdedit.exe
2420	bcdedit.exe

pid	process
3028	wbadmin.exe

pid	process
2028	netsh.exe
3020	netsh.exe

Drops startup file 1 IoCs

Processes:

9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1 = "C:\\Users\\Admin\\AppData\\Local\\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe"	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1 = "C:\\Users\\Admin\\AppData\\Local\\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe"	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

Drops desktop.ini file(s) 12 IoCs

Processes:

9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-686452656-3203474025-4140627569-1000\desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-686452656-3203474025-4140627569-1000\desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

description	pid	process	target process
PID 2392 set thread context of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 set thread context of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

Drops file in Program Files directory 64 IoCs

Processes:

9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_hov.png	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty.png	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\ExitSwitch.jpe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libscreen_plugin.dll.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\release	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Araguaina.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\Common.fxh	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_mmx_plugin.dll.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over_BIDI.png	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfr.jar	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Nipigon	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png.id[52979837-3483].[[email protected]].8base	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2852 2600 WerFault.exe 9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2812 vssadmin.exe

pid	pid_target	process	target process
2852	2600	WerFault.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

pid	process
2812	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

pid	process
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeDebugPrivilege	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
Token: SeDebugPrivilege	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
Token: SeDebugPrivilege	2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
Token: SeBackupPrivilege	300	vssvc.exe
Token: SeRestorePrivilege	300	vssvc.exe
Token: SeAuditPrivilege	300	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1772	WMIC.exe
Token: SeSecurityPrivilege	1772	WMIC.exe
Token: SeTakeOwnershipPrivilege	1772	WMIC.exe
Token: SeLoadDriverPrivilege	1772	WMIC.exe
Token: SeSystemProfilePrivilege	1772	WMIC.exe
Token: SeSystemtimePrivilege	1772	WMIC.exe
Token: SeProfSingleProcessPrivilege	1772	WMIC.exe
Token: SeIncBasePriorityPrivilege	1772	WMIC.exe
Token: SeCreatePagefilePrivilege	1772	WMIC.exe
Token: SeBackupPrivilege	1772	WMIC.exe
Token: SeRestorePrivilege	1772	WMIC.exe
Token: SeShutdownPrivilege	1772	WMIC.exe
Token: SeDebugPrivilege	1772	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1772	WMIC.exe
Token: SeRemoteShutdownPrivilege	1772	WMIC.exe
Token: SeUndockPrivilege	1772	WMIC.exe
Token: SeManageVolumePrivilege	1772	WMIC.exe
Token: 33	1772	WMIC.exe
Token: 34	1772	WMIC.exe
Token: 35	1772	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1772	WMIC.exe
Token: SeSecurityPrivilege	1772	WMIC.exe
Token: SeTakeOwnershipPrivilege	1772	WMIC.exe
Token: SeLoadDriverPrivilege	1772	WMIC.exe
Token: SeSystemProfilePrivilege	1772	WMIC.exe
Token: SeSystemtimePrivilege	1772	WMIC.exe
Token: SeProfSingleProcessPrivilege	1772	WMIC.exe
Token: SeIncBasePriorityPrivilege	1772	WMIC.exe
Token: SeCreatePagefilePrivilege	1772	WMIC.exe
Token: SeBackupPrivilege	1772	WMIC.exe
Token: SeRestorePrivilege	1772	WMIC.exe
Token: SeShutdownPrivilege	1772	WMIC.exe
Token: SeDebugPrivilege	1772	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1772	WMIC.exe
Token: SeRemoteShutdownPrivilege	1772	WMIC.exe
Token: SeUndockPrivilege	1772	WMIC.exe
Token: SeManageVolumePrivilege	1772	WMIC.exe
Token: 33	1772	WMIC.exe
Token: 34	1772	WMIC.exe
Token: 35	1772	WMIC.exe
Token: SeBackupPrivilege	1020	wbengine.exe
Token: SeRestorePrivilege	1020	wbengine.exe
Token: SeSecurityPrivilege	1020	wbengine.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.execmd.execmd.exe

description	pid	process	target process
PID 2392 wrote to memory of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2392 wrote to memory of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2392 wrote to memory of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2392 wrote to memory of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2392 wrote to memory of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2392 wrote to memory of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2392 wrote to memory of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2392 wrote to memory of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2392 wrote to memory of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2392 wrote to memory of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2392 wrote to memory of 2004	2392	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 wrote to memory of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 wrote to memory of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 wrote to memory of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 wrote to memory of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 wrote to memory of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 wrote to memory of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 wrote to memory of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 wrote to memory of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 wrote to memory of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 wrote to memory of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2692 wrote to memory of 2600	2692	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
PID 2600 wrote to memory of 2852	2600	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	WerFault.exe
PID 2600 wrote to memory of 2852	2600	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	WerFault.exe
PID 2600 wrote to memory of 2852	2600	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	WerFault.exe
PID 2600 wrote to memory of 2852	2600	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	WerFault.exe
PID 2004 wrote to memory of 2944	2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	cmd.exe
PID 2004 wrote to memory of 2944	2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	cmd.exe
PID 2004 wrote to memory of 2944	2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	cmd.exe
PID 2004 wrote to memory of 2944	2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	cmd.exe
PID 2004 wrote to memory of 2092	2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	cmd.exe
PID 2004 wrote to memory of 2092	2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	cmd.exe
PID 2004 wrote to memory of 2092	2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	cmd.exe
PID 2004 wrote to memory of 2092	2004	9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe	cmd.exe
PID 2944 wrote to memory of 2812	2944	cmd.exe	vssadmin.exe
PID 2944 wrote to memory of 2812	2944	cmd.exe	vssadmin.exe
PID 2944 wrote to memory of 2812	2944	cmd.exe	vssadmin.exe
PID 2092 wrote to memory of 2028	2092	cmd.exe	netsh.exe
PID 2092 wrote to memory of 2028	2092	cmd.exe	netsh.exe
PID 2092 wrote to memory of 2028	2092	cmd.exe	netsh.exe
PID 2092 wrote to memory of 3020	2092	cmd.exe	netsh.exe
PID 2092 wrote to memory of 3020	2092	cmd.exe	netsh.exe
PID 2092 wrote to memory of 3020	2092	cmd.exe	netsh.exe
PID 2944 wrote to memory of 1772	2944	cmd.exe	WMIC.exe
PID 2944 wrote to memory of 1772	2944	cmd.exe	WMIC.exe
PID 2944 wrote to memory of 1772	2944	cmd.exe	WMIC.exe
PID 2944 wrote to memory of 1740	2944	cmd.exe	bcdedit.exe
PID 2944 wrote to memory of 1740	2944	cmd.exe	bcdedit.exe
PID 2944 wrote to memory of 1740	2944	cmd.exe	bcdedit.exe
PID 2944 wrote to memory of 2420	2944	cmd.exe	bcdedit.exe
PID 2944 wrote to memory of 2420	2944	cmd.exe	bcdedit.exe
PID 2944 wrote to memory of 2420	2944	cmd.exe	bcdedit.exe
PID 2944 wrote to memory of 3028	2944	cmd.exe	wbadmin.exe
PID 2944 wrote to memory of 3028	2944	cmd.exe	wbadmin.exe
PID 2944 wrote to memory of 3028	2944	cmd.exe	wbadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
"C:\Users\Admin\AppData\Local\Temp\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392

C:\Users\Admin\AppData\Local\Temp\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
C:\Users\Admin\AppData\Local\Temp\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Local\Temp\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
"C:\Users\Admin\AppData\Local\Temp\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692

C:\Users\Admin\AppData\Local\Temp\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
C:\Users\Admin\AppData\Local\Temp\9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 164
5⤵
- Program crash
PID:2852

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2812

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:1740

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:2420

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:3028

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:2028

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:3020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:300

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1028

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2484

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

3

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[52979837-3483].[[email protected]].8base
Filesize
143.1MB

MD5
d2c131b85153ad785a1c414ee0698ee2

SHA1
7faaf3d8c2daf5d50f27c90226bbf89c95f5947c

SHA256
60ed3b88410515b859aa221241811d77dfa28e5125a974776ab14455b1073437

SHA512
93be946421de257c2f1034b615fd121e5ceddc0d41f63953e46da7e3584f48f5124e566995402fd3600f98eb78a89b6e7c4f2a905c17564edc66697438b1ba6e

Download Submit
memory/2004-57-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-25-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-306-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-103-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-102-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-9-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-11-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-13-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-15-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-17-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2004-21-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-79-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-23-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-75-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-71-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-56-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-58-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-54-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2004-53-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2392-24-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/2392-4-0x0000000000550000-0x0000000000596000-memory.dmp

Filesize
280KB

Download
memory/2392-1-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/2392-5-0x0000000000AF0000-0x0000000000B24000-memory.dmp

Filesize
208KB

Download
memory/2392-0-0x0000000001310000-0x0000000001360000-memory.dmp

Filesize
320KB

Download
memory/2392-3-0x0000000000990000-0x00000000009D4000-memory.dmp

Filesize
272KB

Download
memory/2392-2-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/2392-6-0x0000000000BF0000-0x0000000000C3C000-memory.dmp

Filesize
304KB

Download
memory/2600-37-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2692-29-0x00000000009B0000-0x00000000009F6000-memory.dmp

Filesize
280KB

Download
memory/2692-42-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/2692-27-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/2692-28-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download
memory/2692-26-0x0000000001310000-0x0000000001360000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads