phobos | fe025cd046edabab5a07d058bfcbb884c144511581d5206681064355fb2834bc

General

Target

d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
Size

312KB
MD5

9824d07cea51069c0042eff0e46d1ad2
SHA1

70ef130a8f88076dc671ab9873b2a3a3c45818fc
SHA256

d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7
SHA512

6d38269e1c93c7e8bd6668cd26947cb821043c9bcbcb19d586795e0fb3d52b8a492e3817eef912bae165973c001c205fd879bbca9810339e6b45bda1651e3bb9
SSDEEP

6144:XAo4v3KmeRDWs0cSsm42PWB1vEtf8h81dZgjvxbtIGnWSPgYYshfnmU3H1l5Fy4:XGimeAs0cuvuB14I9JWfWnNl

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1600 bcdedit.exe
468 bcdedit.exe
Renames multiple (169) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

2124 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

524 netsh.exe
1784 netsh.exe

pid	process
1600	bcdedit.exe
468	bcdedit.exe

pid	process
2124	wbadmin.exe

pid	process
524	netsh.exe
1784	netsh.exe

Drops startup file 1 IoCs

Processes:

d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7 = "C:\\Users\\Admin\\AppData\\Local\\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe"	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7 = "C:\\Users\\Admin\\AppData\\Local\\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe"	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

Drops desktop.ini file(s) 13 IoCs

Processes:

d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-686452656-3203474025-4140627569-1000\desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-686452656-3203474025-4140627569-1000\desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exed7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

description	pid	process	target process
PID 1744 set thread context of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 set thread context of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

Drops file in Program Files directory 64 IoCs

Processes:

d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Windows Mail\es-ES\WinMail.exe.mui	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\THMBNAIL.PNG	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_iw.dll	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00414_.WMF.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02093_.WMF	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Internet Explorer\perf_nt.dll	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185842.WMF	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02053J.JPG.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\skin.catalog	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152594.WMF.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\eqnedt32.exe.manifest	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_iw.dll.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099176.WMF	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_es.dll	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\settings.css	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_zh-CN.dll.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\en-US\msadcer.dll.mui	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\wab32.dll	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198016.WMF	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\THMBNAIL.PNG.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Recife	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287642.JPG.id[F02E3419-3483].[[email protected]].8base	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292286.WMF	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2768 vssadmin.exe

pid	process
2768	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exed7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

pid	process
1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exed7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exed7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeDebugPrivilege	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
Token: SeDebugPrivilege	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
Token: SeDebugPrivilege	1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
Token: SeBackupPrivilege	2844	vssvc.exe
Token: SeRestorePrivilege	2844	vssvc.exe
Token: SeAuditPrivilege	2844	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1304	WMIC.exe
Token: SeSecurityPrivilege	1304	WMIC.exe
Token: SeTakeOwnershipPrivilege	1304	WMIC.exe
Token: SeLoadDriverPrivilege	1304	WMIC.exe
Token: SeSystemProfilePrivilege	1304	WMIC.exe
Token: SeSystemtimePrivilege	1304	WMIC.exe
Token: SeProfSingleProcessPrivilege	1304	WMIC.exe
Token: SeIncBasePriorityPrivilege	1304	WMIC.exe
Token: SeCreatePagefilePrivilege	1304	WMIC.exe
Token: SeBackupPrivilege	1304	WMIC.exe
Token: SeRestorePrivilege	1304	WMIC.exe
Token: SeShutdownPrivilege	1304	WMIC.exe
Token: SeDebugPrivilege	1304	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1304	WMIC.exe
Token: SeRemoteShutdownPrivilege	1304	WMIC.exe
Token: SeUndockPrivilege	1304	WMIC.exe
Token: SeManageVolumePrivilege	1304	WMIC.exe
Token: 33	1304	WMIC.exe
Token: 34	1304	WMIC.exe
Token: 35	1304	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1304	WMIC.exe
Token: SeSecurityPrivilege	1304	WMIC.exe
Token: SeTakeOwnershipPrivilege	1304	WMIC.exe
Token: SeLoadDriverPrivilege	1304	WMIC.exe
Token: SeSystemProfilePrivilege	1304	WMIC.exe
Token: SeSystemtimePrivilege	1304	WMIC.exe
Token: SeProfSingleProcessPrivilege	1304	WMIC.exe
Token: SeIncBasePriorityPrivilege	1304	WMIC.exe
Token: SeCreatePagefilePrivilege	1304	WMIC.exe
Token: SeBackupPrivilege	1304	WMIC.exe
Token: SeRestorePrivilege	1304	WMIC.exe
Token: SeShutdownPrivilege	1304	WMIC.exe
Token: SeDebugPrivilege	1304	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1304	WMIC.exe
Token: SeRemoteShutdownPrivilege	1304	WMIC.exe
Token: SeUndockPrivilege	1304	WMIC.exe
Token: SeManageVolumePrivilege	1304	WMIC.exe
Token: 33	1304	WMIC.exe
Token: 34	1304	WMIC.exe
Token: 35	1304	WMIC.exe
Token: SeBackupPrivilege	2872	wbengine.exe
Token: SeRestorePrivilege	2872	wbengine.exe
Token: SeSecurityPrivilege	2872	wbengine.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exed7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exed7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.execmd.execmd.exe

description	pid	process	target process
PID 1744 wrote to memory of 1308	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1308	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1308	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1308	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1744 wrote to memory of 1260	1744	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 wrote to memory of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 wrote to memory of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 wrote to memory of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 wrote to memory of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 wrote to memory of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 wrote to memory of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 wrote to memory of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 wrote to memory of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 wrote to memory of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 wrote to memory of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 2752 wrote to memory of 2656	2752	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
PID 1260 wrote to memory of 2512	1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	cmd.exe
PID 1260 wrote to memory of 2512	1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	cmd.exe
PID 1260 wrote to memory of 2512	1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	cmd.exe
PID 1260 wrote to memory of 2512	1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	cmd.exe
PID 1260 wrote to memory of 2504	1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	cmd.exe
PID 1260 wrote to memory of 2504	1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	cmd.exe
PID 1260 wrote to memory of 2504	1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	cmd.exe
PID 1260 wrote to memory of 2504	1260	d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe	cmd.exe
PID 2512 wrote to memory of 524	2512	cmd.exe	netsh.exe
PID 2512 wrote to memory of 524	2512	cmd.exe	netsh.exe
PID 2512 wrote to memory of 524	2512	cmd.exe	netsh.exe
PID 2504 wrote to memory of 2768	2504	cmd.exe	vssadmin.exe
PID 2504 wrote to memory of 2768	2504	cmd.exe	vssadmin.exe
PID 2504 wrote to memory of 2768	2504	cmd.exe	vssadmin.exe
PID 2512 wrote to memory of 1784	2512	cmd.exe	netsh.exe
PID 2512 wrote to memory of 1784	2512	cmd.exe	netsh.exe
PID 2512 wrote to memory of 1784	2512	cmd.exe	netsh.exe
PID 2504 wrote to memory of 1304	2504	cmd.exe	WMIC.exe
PID 2504 wrote to memory of 1304	2504	cmd.exe	WMIC.exe
PID 2504 wrote to memory of 1304	2504	cmd.exe	WMIC.exe
PID 2504 wrote to memory of 1600	2504	cmd.exe	bcdedit.exe
PID 2504 wrote to memory of 1600	2504	cmd.exe	bcdedit.exe
PID 2504 wrote to memory of 1600	2504	cmd.exe	bcdedit.exe
PID 2504 wrote to memory of 468	2504	cmd.exe	bcdedit.exe
PID 2504 wrote to memory of 468	2504	cmd.exe	bcdedit.exe
PID 2504 wrote to memory of 468	2504	cmd.exe	bcdedit.exe
PID 2504 wrote to memory of 2124	2504	cmd.exe	wbadmin.exe
PID 2504 wrote to memory of 2124	2504	cmd.exe	wbadmin.exe
PID 2504 wrote to memory of 2124	2504	cmd.exe	wbadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
"C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
2⤵
PID:1308

C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260

C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
"C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752

C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
4⤵
PID:2656

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:524

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:1784

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2768

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:1600

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:468

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:2124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2096

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1068

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

3

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[F02E3419-3483].[[email protected]].8base
Filesize
143.1MB

MD5
527fef41597dd700dd50b93bd61d1aac

SHA1
6ec1a60334fe0f2bfadea314ff56dc2ed449d661

SHA256
f8098e6d8c9e028e6deb4d2734ab3bb026d82600558bb667f87e423da099925f

SHA512
61c64c27aa685465d02d0c56f381a247427963272d32d1a0b33b04fd39a7c68ec7c607126affecf67df29de1b4ee8362e57cbfd21fc995fee0be3677a1142548

Download Submit
memory/1260-54-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-131-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-211-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-90-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-92-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-6-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-80-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1260-11-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-14-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-82-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-16-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-63-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-59-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-9-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-57-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-56-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-40-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-52-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-49-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1260-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1744-17-0x00000000743F0000-0x0000000074ADE000-memory.dmp

Filesize
6.9MB

Download
memory/1744-0-0x0000000001010000-0x0000000001064000-memory.dmp

Filesize
336KB

Download
memory/1744-2-0x0000000000240000-0x0000000000286000-memory.dmp

Filesize
280KB

Download
memory/1744-1-0x00000000743F0000-0x0000000074ADE000-memory.dmp

Filesize
6.9MB

Download
memory/1744-3-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/1744-4-0x0000000000540000-0x0000000000574000-memory.dmp

Filesize
208KB

Download
memory/1744-5-0x0000000000B20000-0x0000000000B6C000-memory.dmp

Filesize
304KB

Download
memory/2656-38-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/2656-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-20-0x0000000004A90000-0x0000000004AD0000-memory.dmp

Filesize
256KB

Download
memory/2752-18-0x0000000001010000-0x0000000001064000-memory.dmp

Filesize
336KB

Download
memory/2752-39-0x0000000073200000-0x00000000738EE000-memory.dmp

Filesize
6.9MB

Download
memory/2752-19-0x0000000073200000-0x00000000738EE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads