phobos | d4cb20dba15d88c38c35be69fe04538b4f9bb0a12edb51ff23c0171b584edf08

General

Target

42553b52c33d2b5f8a747819d0bf97d5.exe
Size

602KB
MD5

42553b52c33d2b5f8a747819d0bf97d5
SHA1

ae1bc8822e41c65caedc07dd98b0d9156e2a28cd
SHA256

d4cb20dba15d88c38c35be69fe04538b4f9bb0a12edb51ff23c0171b584edf08
SHA512

5ed02973a1a88dc4835a933e84d422ecad64dd33645d4621ecd396a8786269c7616b5e68a6744912c5f3bc831a1b897b89306b773577c90dfbf766e1186ffe4c
SSDEEP

12288:k1gLpE124JdB+jegjTfWU3qU8FyFTdeQUSonYLVqY2Vi:HaM4JaSMoF4deLgVKQ

Score

10^/10

phobos evasion persistence ransomware

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

2164 netsh.exe
1056 netsh.exe

pid	process
2164	netsh.exe
1056	netsh.exe

Drops startup file 1 IoCs

Processes:

42553b52c33d2b5f8a747819d0bf97d5.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

42553b52c33d2b5f8a747819d0bf97d5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\42553b52c33d2b5f8a747819d0bf97d5 = "C:\\Users\\Admin\\AppData\\Local\\42553b52c33d2b5f8a747819d0bf97d5.exe"	42553b52c33d2b5f8a747819d0bf97d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\42553b52c33d2b5f8a747819d0bf97d5 = "C:\\Users\\Admin\\AppData\\Local\\42553b52c33d2b5f8a747819d0bf97d5.exe"	42553b52c33d2b5f8a747819d0bf97d5.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

42553b52c33d2b5f8a747819d0bf97d5.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3750544865-3773649541-1858556521-1000\desktop.ini	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3750544865-3773649541-1858556521-1000\desktop.ini	42553b52c33d2b5f8a747819d0bf97d5.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

42553b52c33d2b5f8a747819d0bf97d5.exe42553b52c33d2b5f8a747819d0bf97d5.exe

description	pid	process	target process
PID 2748 set thread context of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 set thread context of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe

Drops file in Program Files directory 64 IoCs

Processes:

42553b52c33d2b5f8a747819d0bf97d5.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\7z.exe.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\ApproveSubmit.ps1	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\BlockMount.vdx.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\History.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\ClearUnregister.hta.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.id[687BD70F-3483].[[email protected]].8base	42553b52c33d2b5f8a747819d0bf97d5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	42553b52c33d2b5f8a747819d0bf97d5.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1080 2568 WerFault.exe 42553b52c33d2b5f8a747819d0bf97d5.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1648 vssadmin.exe

pid	pid_target	process	target process
1080	2568	WerFault.exe	42553b52c33d2b5f8a747819d0bf97d5.exe

pid	process
1648	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

Processes:

42553b52c33d2b5f8a747819d0bf97d5.exe

pid	process
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe
2696	42553b52c33d2b5f8a747819d0bf97d5.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

42553b52c33d2b5f8a747819d0bf97d5.exe42553b52c33d2b5f8a747819d0bf97d5.exe42553b52c33d2b5f8a747819d0bf97d5.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2748	42553b52c33d2b5f8a747819d0bf97d5.exe
Token: SeDebugPrivilege	2508	42553b52c33d2b5f8a747819d0bf97d5.exe
Token: SeDebugPrivilege	2696	42553b52c33d2b5f8a747819d0bf97d5.exe
Token: SeBackupPrivilege	2192	vssvc.exe
Token: SeRestorePrivilege	2192	vssvc.exe
Token: SeAuditPrivilege	2192	vssvc.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

42553b52c33d2b5f8a747819d0bf97d5.exe42553b52c33d2b5f8a747819d0bf97d5.exe42553b52c33d2b5f8a747819d0bf97d5.exe42553b52c33d2b5f8a747819d0bf97d5.execmd.execmd.exe

description	pid	process	target process
PID 2748 wrote to memory of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2748 wrote to memory of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2748 wrote to memory of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2748 wrote to memory of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2748 wrote to memory of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2748 wrote to memory of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2748 wrote to memory of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2748 wrote to memory of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2748 wrote to memory of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2748 wrote to memory of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2748 wrote to memory of 2696	2748	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 wrote to memory of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 wrote to memory of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 wrote to memory of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 wrote to memory of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 wrote to memory of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 wrote to memory of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 wrote to memory of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 wrote to memory of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 wrote to memory of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 wrote to memory of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2508 wrote to memory of 2568	2508	42553b52c33d2b5f8a747819d0bf97d5.exe	42553b52c33d2b5f8a747819d0bf97d5.exe
PID 2568 wrote to memory of 1080	2568	42553b52c33d2b5f8a747819d0bf97d5.exe	WerFault.exe
PID 2568 wrote to memory of 1080	2568	42553b52c33d2b5f8a747819d0bf97d5.exe	WerFault.exe
PID 2568 wrote to memory of 1080	2568	42553b52c33d2b5f8a747819d0bf97d5.exe	WerFault.exe
PID 2568 wrote to memory of 1080	2568	42553b52c33d2b5f8a747819d0bf97d5.exe	WerFault.exe
PID 2696 wrote to memory of 2864	2696	42553b52c33d2b5f8a747819d0bf97d5.exe	cmd.exe
PID 2696 wrote to memory of 2864	2696	42553b52c33d2b5f8a747819d0bf97d5.exe	cmd.exe
PID 2696 wrote to memory of 2864	2696	42553b52c33d2b5f8a747819d0bf97d5.exe	cmd.exe
PID 2696 wrote to memory of 2864	2696	42553b52c33d2b5f8a747819d0bf97d5.exe	cmd.exe
PID 2696 wrote to memory of 2872	2696	42553b52c33d2b5f8a747819d0bf97d5.exe	cmd.exe
PID 2696 wrote to memory of 2872	2696	42553b52c33d2b5f8a747819d0bf97d5.exe	cmd.exe
PID 2696 wrote to memory of 2872	2696	42553b52c33d2b5f8a747819d0bf97d5.exe	cmd.exe
PID 2696 wrote to memory of 2872	2696	42553b52c33d2b5f8a747819d0bf97d5.exe	cmd.exe
PID 2864 wrote to memory of 2164	2864	cmd.exe	netsh.exe
PID 2864 wrote to memory of 2164	2864	cmd.exe	netsh.exe
PID 2864 wrote to memory of 2164	2864	cmd.exe	netsh.exe
PID 2872 wrote to memory of 1648	2872	cmd.exe	vssadmin.exe
PID 2872 wrote to memory of 1648	2872	cmd.exe	vssadmin.exe
PID 2872 wrote to memory of 1648	2872	cmd.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\42553b52c33d2b5f8a747819d0bf97d5.exe
"C:\Users\Admin\AppData\Local\Temp\42553b52c33d2b5f8a747819d0bf97d5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748

C:\Users\Admin\AppData\Local\Temp\42553b52c33d2b5f8a747819d0bf97d5.exe
C:\Users\Admin\AppData\Local\Temp\42553b52c33d2b5f8a747819d0bf97d5.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696

C:\Users\Admin\AppData\Local\Temp\42553b52c33d2b5f8a747819d0bf97d5.exe
"C:\Users\Admin\AppData\Local\Temp\42553b52c33d2b5f8a747819d0bf97d5.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508

C:\Users\Admin\AppData\Local\Temp\42553b52c33d2b5f8a747819d0bf97d5.exe
C:\Users\Admin\AppData\Local\Temp\42553b52c33d2b5f8a747819d0bf97d5.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 164
5⤵
- Program crash
PID:1080

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:2164

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:1056

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2192

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[687BD70F-3483].[[email protected]].8base
Filesize
85.9MB

MD5
8a50b9f87b7f663a5da0980830640557

SHA1
7e22ce9cd8363712696f3bc958ad0da691d23270

SHA256
677c0491eae6b2ba32181dcf40b89625970a1db9840e3fa4077649e9ce44212c

SHA512
f3a7c8ba971a5c2cb58ca7f86e04847509b6c18c412a66348363881566fd05a16865672993c716e223fcb94045262744ba45d06acaf20b931fb2dfa4feb6c011

Download Submit
memory/2508-22-0x00000000740D0000-0x00000000747BE000-memory.dmp

Filesize
6.9MB

Download
memory/2508-37-0x00000000740D0000-0x00000000747BE000-memory.dmp

Filesize
6.9MB

Download
memory/2508-24-0x0000000000480000-0x00000000004C6000-memory.dmp

Filesize
280KB

Download
memory/2508-23-0x0000000000240000-0x0000000000280000-memory.dmp

Filesize
256KB

Download
memory/2508-21-0x0000000001050000-0x00000000010EC000-memory.dmp

Filesize
624KB

Download
memory/2568-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2696-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-49-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-9-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-11-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-13-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2696-16-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-325-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-19-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-20-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-70-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-57-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-54-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-52-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-51-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-47-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2748-0-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download
memory/2748-2-0x0000000001050000-0x00000000010EC000-memory.dmp

Filesize
624KB

Download
memory/2748-3-0x00000000048A0000-0x00000000048E0000-memory.dmp

Filesize
256KB

Download
memory/2748-4-0x0000000000360000-0x00000000003AC000-memory.dmp

Filesize
304KB

Download
memory/2748-5-0x0000000000650000-0x0000000000696000-memory.dmp

Filesize
280KB

Download
memory/2748-6-0x0000000000AF0000-0x0000000000B24000-memory.dmp

Filesize
208KB

Download
memory/2748-7-0x0000000000B70000-0x0000000000BBC000-memory.dmp

Filesize
304KB

Download
memory/2748-1-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download
memory/2748-18-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads