Analysis
-
max time kernel
204s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2023 07:26
Static task
static1
Behavioral task
behavioral1
Sample
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe
Resource
win10v2004-20230915-en
General
-
Target
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe
-
Size
285KB
-
MD5
4db1b428d0e115a810836f937d786f38
-
SHA1
35e8722f5bf1997d6022fa512f60458470a8999e
-
SHA256
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d
-
SHA512
091491e4cb375eceadcff843cef080815b1f802e0182d260d750f7afc8197eb09461ed9b119b04eff0839c627d2630bfb1e9409de0da12086e2d15bb12565109
-
SSDEEP
6144:mlVD0j3qci00ei4m4d3hJkuRi7g9BOu6xb4YnDy:X2cibT4d3hJLUWwu6F4YW
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 3264 bcdedit.exe 5064 bcdedit.exe -
Renames multiple (54) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exepid process 1948 wbadmin.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 1 IoCs
Processes:
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d = "C:\\Users\\Admin\\AppData\\Local\\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe" fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d = "C:\\Users\\Admin\\AppData\\Local\\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe" fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-1045988481-1457812719-2617974652-1000\desktop.ini fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1045988481-1457812719-2617974652-1000\desktop.ini fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\desktop.ini fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exefd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exedescription pid process target process PID 4048 set thread context of 2116 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4792 set thread context of 3756 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe -
Drops file in Program Files directory 64 IoCs
Processes:
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcjavas.inc fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\management.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\jawt.lib fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2ssv.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\3RDPARTY fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\fontconfig.properties.src.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jsse.jar fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\7-Zip\Lang\sv.txt.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\msvcp120.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\cursors.properties fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\j2pcsc.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaprst.dll fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_zh_HK.properties fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\7-Zip\Lang\ta.txt.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdfmap.dll fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jfr.dll fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr.jar.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\7-Zip\7zG.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox.dll fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\glib-lite.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\fontmanager.dll.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\GRAY.pf.id[DC7D6C8A-3483].[[email protected]].8base fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\j2pkcs11.dll fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe -
Drops file in Windows directory 3 IoCs
Processes:
wbadmin.exedescription ioc process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 5008 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exepid process 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exefd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exefd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exevssvc.exeWMIC.exedescription pid process Token: SeDebugPrivilege 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe Token: SeDebugPrivilege 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe Token: SeDebugPrivilege 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe Token: SeBackupPrivilege 4812 vssvc.exe Token: SeRestorePrivilege 4812 vssvc.exe Token: SeAuditPrivilege 4812 vssvc.exe Token: SeIncreaseQuotaPrivilege 2888 WMIC.exe Token: SeSecurityPrivilege 2888 WMIC.exe Token: SeTakeOwnershipPrivilege 2888 WMIC.exe Token: SeLoadDriverPrivilege 2888 WMIC.exe Token: SeSystemProfilePrivilege 2888 WMIC.exe Token: SeSystemtimePrivilege 2888 WMIC.exe Token: SeProfSingleProcessPrivilege 2888 WMIC.exe Token: SeIncBasePriorityPrivilege 2888 WMIC.exe Token: SeCreatePagefilePrivilege 2888 WMIC.exe Token: SeBackupPrivilege 2888 WMIC.exe Token: SeRestorePrivilege 2888 WMIC.exe Token: SeShutdownPrivilege 2888 WMIC.exe Token: SeDebugPrivilege 2888 WMIC.exe Token: SeSystemEnvironmentPrivilege 2888 WMIC.exe Token: SeRemoteShutdownPrivilege 2888 WMIC.exe Token: SeUndockPrivilege 2888 WMIC.exe Token: SeManageVolumePrivilege 2888 WMIC.exe Token: 33 2888 WMIC.exe Token: 34 2888 WMIC.exe Token: 35 2888 WMIC.exe Token: 36 2888 WMIC.exe Token: SeIncreaseQuotaPrivilege 2888 WMIC.exe Token: SeSecurityPrivilege 2888 WMIC.exe Token: SeTakeOwnershipPrivilege 2888 WMIC.exe Token: SeLoadDriverPrivilege 2888 WMIC.exe Token: SeSystemProfilePrivilege 2888 WMIC.exe Token: SeSystemtimePrivilege 2888 WMIC.exe Token: SeProfSingleProcessPrivilege 2888 WMIC.exe Token: SeIncBasePriorityPrivilege 2888 WMIC.exe Token: SeCreatePagefilePrivilege 2888 WMIC.exe Token: SeBackupPrivilege 2888 WMIC.exe Token: SeRestorePrivilege 2888 WMIC.exe Token: SeShutdownPrivilege 2888 WMIC.exe Token: SeDebugPrivilege 2888 WMIC.exe Token: SeSystemEnvironmentPrivilege 2888 WMIC.exe Token: SeRemoteShutdownPrivilege 2888 WMIC.exe Token: SeUndockPrivilege 2888 WMIC.exe Token: SeManageVolumePrivilege 2888 WMIC.exe Token: 33 2888 WMIC.exe Token: 34 2888 WMIC.exe Token: 35 2888 WMIC.exe Token: 36 2888 WMIC.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exefd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exefd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.execmd.execmd.exedescription pid process target process PID 4048 wrote to memory of 2116 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4048 wrote to memory of 2116 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4048 wrote to memory of 2116 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4048 wrote to memory of 2116 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4048 wrote to memory of 2116 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4048 wrote to memory of 2116 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4048 wrote to memory of 2116 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4048 wrote to memory of 2116 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4048 wrote to memory of 2116 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4048 wrote to memory of 2116 4048 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4792 wrote to memory of 3756 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4792 wrote to memory of 3756 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4792 wrote to memory of 3756 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4792 wrote to memory of 3756 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4792 wrote to memory of 3756 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4792 wrote to memory of 3756 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4792 wrote to memory of 3756 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4792 wrote to memory of 3756 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4792 wrote to memory of 3756 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 4792 wrote to memory of 3756 4792 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe PID 2116 wrote to memory of 2592 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe cmd.exe PID 2116 wrote to memory of 2592 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe cmd.exe PID 2116 wrote to memory of 2192 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe cmd.exe PID 2116 wrote to memory of 2192 2116 fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe cmd.exe PID 2592 wrote to memory of 5008 2592 cmd.exe vssadmin.exe PID 2592 wrote to memory of 5008 2592 cmd.exe vssadmin.exe PID 2192 wrote to memory of 4036 2192 cmd.exe netsh.exe PID 2192 wrote to memory of 4036 2192 cmd.exe netsh.exe PID 2192 wrote to memory of 1264 2192 cmd.exe netsh.exe PID 2192 wrote to memory of 1264 2192 cmd.exe netsh.exe PID 2592 wrote to memory of 2888 2592 cmd.exe WMIC.exe PID 2592 wrote to memory of 2888 2592 cmd.exe WMIC.exe PID 2592 wrote to memory of 3264 2592 cmd.exe bcdedit.exe PID 2592 wrote to memory of 3264 2592 cmd.exe bcdedit.exe PID 2592 wrote to memory of 5064 2592 cmd.exe bcdedit.exe PID 2592 wrote to memory of 5064 2592 cmd.exe bcdedit.exe PID 2592 wrote to memory of 1948 2592 cmd.exe wbadmin.exe PID 2592 wrote to memory of 1948 2592 cmd.exe wbadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe"C:\Users\Admin\AppData\Local\Temp\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exeC:\Users\Admin\AppData\Local\Temp\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe"C:\Users\Admin\AppData\Local\Temp\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exeC:\Users\Admin\AppData\Local\Temp\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
- Drops file in Windows directory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[DC7D6C8A-3483].[[email protected]].8baseFilesize
2.7MB
MD5f298191793faf2813e81e4503de3fda6
SHA1b29f22507010edd3afba3615b93ff437cb5ec651
SHA25649b38a18102eeb7badf40c7586d3d41414ae74131594ad7ba03831d0ebc0659d
SHA5128fee98305625299344a57d9b97f67b7a66209ec5c839ab281f4fbc085fa334fc6e0d24b312b30e453d975069114200fe13a52653638dbacc961a3b6309642e40
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d.exe.logFilesize
927B
MD54a911455784f74e368a4c2c7876d76f4
SHA1a1700a0849ffb4f26671eb76da2489946b821c34
SHA256264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA5124617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d
-
memory/2116-40-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-9-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-85-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-48-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-80-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-49-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-32-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-330-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-12-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-13-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-44-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-611-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-37-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-34-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2116-35-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3756-22-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4048-7-0x0000000005630000-0x0000000005640000-memory.dmpFilesize
64KB
-
memory/4048-14-0x00000000749B0000-0x0000000075160000-memory.dmpFilesize
7.7MB
-
memory/4048-8-0x0000000005BF0000-0x0000000006194000-memory.dmpFilesize
5.6MB
-
memory/4048-0-0x0000000000B10000-0x0000000000B5E000-memory.dmpFilesize
312KB
-
memory/4048-6-0x00000000749B0000-0x0000000075160000-memory.dmpFilesize
7.7MB
-
memory/4048-5-0x0000000005570000-0x00000000055BC000-memory.dmpFilesize
304KB
-
memory/4048-4-0x0000000005530000-0x0000000005564000-memory.dmpFilesize
208KB
-
memory/4048-3-0x0000000005630000-0x0000000005640000-memory.dmpFilesize
64KB
-
memory/4048-2-0x00000000054D0000-0x0000000005516000-memory.dmpFilesize
280KB
-
memory/4048-1-0x00000000749B0000-0x0000000075160000-memory.dmpFilesize
7.7MB
-
memory/4792-21-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/4792-17-0x00000000054B0000-0x00000000054C0000-memory.dmpFilesize
64KB
-
memory/4792-16-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB