phobos | d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7

General

Target

9824d07cea51069c0042eff0e46d1ad2.exe
Size

312KB
MD5

9824d07cea51069c0042eff0e46d1ad2
SHA1

70ef130a8f88076dc671ab9873b2a3a3c45818fc
SHA256

d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7
SHA512

6d38269e1c93c7e8bd6668cd26947cb821043c9bcbcb19d586795e0fb3d52b8a492e3817eef912bae165973c001c205fd879bbca9810339e6b45bda1651e3bb9
SSDEEP

6144:XAo4v3KmeRDWs0cSsm42PWB1vEtf8h81dZgjvxbtIGnWSPgYYshfnmU3H1l5Fy4:XGimeAs0cuvuB14I9JWfWnNl

Score

10^/10

phobos evasion persistence ransomware

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

3980 bcdedit.exe
1720 bcdedit.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1968 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

1692 netsh.exe
2604 netsh.exe

pid	process
3980	bcdedit.exe
1720	bcdedit.exe

pid	process
1968	wbadmin.exe

pid	process
1692	netsh.exe
2604	netsh.exe

Drops startup file 1 IoCs

Processes:

9824d07cea51069c0042eff0e46d1ad2.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9824d07cea51069c0042eff0e46d1ad2.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9824d07cea51069c0042eff0e46d1ad2 = "C:\\Users\\Admin\\AppData\\Local\\9824d07cea51069c0042eff0e46d1ad2.exe"	9824d07cea51069c0042eff0e46d1ad2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9824d07cea51069c0042eff0e46d1ad2 = "C:\\Users\\Admin\\AppData\\Local\\9824d07cea51069c0042eff0e46d1ad2.exe"	9824d07cea51069c0042eff0e46d1ad2.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

9824d07cea51069c0042eff0e46d1ad2.exe

description	ioc	process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1045988481-1457812719-2617974652-1000\desktop.ini	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\desktop.ini	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1045988481-1457812719-2617974652-1000\desktop.ini	9824d07cea51069c0042eff0e46d1ad2.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

9824d07cea51069c0042eff0e46d1ad2.exe9824d07cea51069c0042eff0e46d1ad2.exe

description	pid	process	target process
PID 4776 set thread context of 1020	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 set thread context of 672	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe

Drops file in Program Files directory 64 IoCs

Processes:

9824d07cea51069c0042eff0e46d1ad2.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\ba.txt.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado15.dll	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdaprst.dll	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\System\ado\adovbs.inc	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadds.dll	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\ExportResume.M2TS	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Internet Explorer\SIGNUP\install.ins	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\7-Zip\7zFM.exe.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.id[B334086F-3483].[[email protected]].8base	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak	9824d07cea51069c0042eff0e46d1ad2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui	9824d07cea51069c0042eff0e46d1ad2.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

3728 vssadmin.exe

pid	process
3728	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9824d07cea51069c0042eff0e46d1ad2.exe9824d07cea51069c0042eff0e46d1ad2.exe9824d07cea51069c0042eff0e46d1ad2.exe

pid	process
4776	9824d07cea51069c0042eff0e46d1ad2.exe
4776	9824d07cea51069c0042eff0e46d1ad2.exe
4776	9824d07cea51069c0042eff0e46d1ad2.exe
4776	9824d07cea51069c0042eff0e46d1ad2.exe
1608	9824d07cea51069c0042eff0e46d1ad2.exe
1608	9824d07cea51069c0042eff0e46d1ad2.exe
1608	9824d07cea51069c0042eff0e46d1ad2.exe
1608	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe
1020	9824d07cea51069c0042eff0e46d1ad2.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

9824d07cea51069c0042eff0e46d1ad2.exe9824d07cea51069c0042eff0e46d1ad2.exe9824d07cea51069c0042eff0e46d1ad2.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4776	9824d07cea51069c0042eff0e46d1ad2.exe
Token: SeDebugPrivilege	1608	9824d07cea51069c0042eff0e46d1ad2.exe
Token: SeDebugPrivilege	1020	9824d07cea51069c0042eff0e46d1ad2.exe
Token: SeBackupPrivilege	2888	vssvc.exe
Token: SeRestorePrivilege	2888	vssvc.exe
Token: SeAuditPrivilege	2888	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4444	WMIC.exe
Token: SeSecurityPrivilege	4444	WMIC.exe
Token: SeTakeOwnershipPrivilege	4444	WMIC.exe
Token: SeLoadDriverPrivilege	4444	WMIC.exe
Token: SeSystemProfilePrivilege	4444	WMIC.exe
Token: SeSystemtimePrivilege	4444	WMIC.exe
Token: SeProfSingleProcessPrivilege	4444	WMIC.exe
Token: SeIncBasePriorityPrivilege	4444	WMIC.exe
Token: SeCreatePagefilePrivilege	4444	WMIC.exe
Token: SeBackupPrivilege	4444	WMIC.exe
Token: SeRestorePrivilege	4444	WMIC.exe
Token: SeShutdownPrivilege	4444	WMIC.exe
Token: SeDebugPrivilege	4444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4444	WMIC.exe
Token: SeRemoteShutdownPrivilege	4444	WMIC.exe
Token: SeUndockPrivilege	4444	WMIC.exe
Token: SeManageVolumePrivilege	4444	WMIC.exe
Token: 33	4444	WMIC.exe
Token: 34	4444	WMIC.exe
Token: 35	4444	WMIC.exe
Token: 36	4444	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4444	WMIC.exe
Token: SeSecurityPrivilege	4444	WMIC.exe
Token: SeTakeOwnershipPrivilege	4444	WMIC.exe
Token: SeLoadDriverPrivilege	4444	WMIC.exe
Token: SeSystemProfilePrivilege	4444	WMIC.exe
Token: SeSystemtimePrivilege	4444	WMIC.exe
Token: SeProfSingleProcessPrivilege	4444	WMIC.exe
Token: SeIncBasePriorityPrivilege	4444	WMIC.exe
Token: SeCreatePagefilePrivilege	4444	WMIC.exe
Token: SeBackupPrivilege	4444	WMIC.exe
Token: SeRestorePrivilege	4444	WMIC.exe
Token: SeShutdownPrivilege	4444	WMIC.exe
Token: SeDebugPrivilege	4444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4444	WMIC.exe
Token: SeRemoteShutdownPrivilege	4444	WMIC.exe
Token: SeUndockPrivilege	4444	WMIC.exe
Token: SeManageVolumePrivilege	4444	WMIC.exe
Token: 33	4444	WMIC.exe
Token: 34	4444	WMIC.exe
Token: 35	4444	WMIC.exe
Token: 36	4444	WMIC.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

9824d07cea51069c0042eff0e46d1ad2.exe9824d07cea51069c0042eff0e46d1ad2.exe9824d07cea51069c0042eff0e46d1ad2.execmd.execmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
"C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776

C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
2⤵
PID:4556

C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
2⤵
PID:2284

C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020

C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
"C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608

C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
4⤵
PID:4352

C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
4⤵
PID:4012

C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
C:\Users\Admin\AppData\Local\Temp\9824d07cea51069c0042eff0e46d1ad2.exe
4⤵
PID:672

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3332

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:3728

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:3980

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:1720

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:1968

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:4204

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:1692

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:2604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:3076

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

3

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[B334086F-3483].[[email protected]].8base
Filesize
3.2MB

MD5
aac6a1188815666d619a2f97d94ae48d

SHA1
ce55e32c47f6b5931803edf9239c3993e8c34b8f

SHA256
a4659a8171ff2ceb08b18a47e2660904385d609522cd80f1d821c10516a77024

SHA512
3d6b301028d2308c70186d8d39ebd4b86b77569eb560e3bda21dfd17245f44ad1d94e49f98052ab6b979df292fbe0457a82c3ca09e667e2cf120dce249b33f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9824d07cea51069c0042eff0e46d1ad2.exe.log
Filesize
927B

MD5
ff27e87d4bf1330435001e57e8244d60

SHA1
b22264ed3cd4d35f8236278edd2512c3b7ecb355

SHA256
7e9adf70ba438f8a38feac34e1b25bb4261fa506d00361ea7e5cde784651474e

SHA512
d678aa2b42032ea0d811f9783abff7c94a6d674bd3dee74df706b7f95da7e51d84207320ea36226da4f8651e6ec618ea12d99d2d6d371bd1e98395518b8956e0

Download Submit
memory/672-22-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-32-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-202-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-280-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-37-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-34-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-35-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-11-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-161-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-201-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-58-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-59-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-81-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-136-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-46-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-196-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-91-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-110-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-41-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-40-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1020-42-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1608-21-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/1608-17-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/1608-16-0x00000000052C0000-0x0000000005306000-memory.dmp

Filesize
280KB

Download
memory/1608-15-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/4776-3-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4776-6-0x0000000004CD0000-0x0000000004D04000-memory.dmp

Filesize
208KB

Download
memory/4776-0-0x0000000000240000-0x0000000000294000-memory.dmp

Filesize
336KB

Download
memory/4776-1-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4776-2-0x00000000051F0000-0x0000000005794000-memory.dmp

Filesize
5.6MB

Download
memory/4776-4-0x0000000004BF0000-0x0000000004C36000-memory.dmp

Filesize
280KB

Download
memory/4776-13-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4776-7-0x0000000004E70000-0x0000000004EBC000-memory.dmp

Filesize
304KB

Download
memory/4776-5-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download

description	pid	process	target process
PID 4776 wrote to memory of 4556	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 4556	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 4556	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 2284	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 2284	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 2284	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 1020	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 1020	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 1020	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 1020	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 1020	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 1020	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 1020	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 1020	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 1020	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 4776 wrote to memory of 1020	4776	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 4352	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 4352	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 4352	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 4012	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 4012	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 4012	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 672	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 672	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 672	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 672	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 672	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 672	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 672	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 672	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 672	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1608 wrote to memory of 672	1608	9824d07cea51069c0042eff0e46d1ad2.exe	9824d07cea51069c0042eff0e46d1ad2.exe
PID 1020 wrote to memory of 3332	1020	9824d07cea51069c0042eff0e46d1ad2.exe	cmd.exe
PID 1020 wrote to memory of 3332	1020	9824d07cea51069c0042eff0e46d1ad2.exe	cmd.exe
PID 1020 wrote to memory of 4204	1020	9824d07cea51069c0042eff0e46d1ad2.exe	cmd.exe
PID 1020 wrote to memory of 4204	1020	9824d07cea51069c0042eff0e46d1ad2.exe	cmd.exe
PID 3332 wrote to memory of 3728	3332	cmd.exe	vssadmin.exe
PID 3332 wrote to memory of 3728	3332	cmd.exe	vssadmin.exe
PID 4204 wrote to memory of 1692	4204	cmd.exe	netsh.exe
PID 4204 wrote to memory of 1692	4204	cmd.exe	netsh.exe
PID 4204 wrote to memory of 2604	4204	cmd.exe	netsh.exe
PID 4204 wrote to memory of 2604	4204	cmd.exe	netsh.exe
PID 3332 wrote to memory of 4444	3332	cmd.exe	WMIC.exe
PID 3332 wrote to memory of 4444	3332	cmd.exe	WMIC.exe
PID 3332 wrote to memory of 3980	3332	cmd.exe	bcdedit.exe
PID 3332 wrote to memory of 3980	3332	cmd.exe	bcdedit.exe
PID 3332 wrote to memory of 1720	3332	cmd.exe	bcdedit.exe
PID 3332 wrote to memory of 1720	3332	cmd.exe	bcdedit.exe
PID 3332 wrote to memory of 1968	3332	cmd.exe	wbadmin.exe
PID 3332 wrote to memory of 1968	3332	cmd.exe	wbadmin.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads