Analysis
-
max time kernel
147s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
18-10-2023 09:30
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe
Resource
win10v2004-20230915-en
General
-
Target
SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe
-
Size
285KB
-
MD5
4db1b428d0e115a810836f937d786f38
-
SHA1
35e8722f5bf1997d6022fa512f60458470a8999e
-
SHA256
fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d
-
SHA512
091491e4cb375eceadcff843cef080815b1f802e0182d260d750f7afc8197eb09461ed9b119b04eff0839c627d2630bfb1e9409de0da12086e2d15bb12565109
-
SSDEEP
6144:mlVD0j3qci00ei4m4d3hJkuRi7g9BOu6xb4YnDy:X2cibT4d3hJLUWwu6F4YW
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2316 bcdedit.exe 1972 bcdedit.exe -
Renames multiple (273) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exepid process 2344 wbadmin.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634 = "C:\\Users\\Admin\\AppData\\Local\\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe" SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634 = "C:\\Users\\Admin\\AppData\\Local\\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe" SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe -
Drops desktop.ini file(s) 13 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exedescription ioc process File opened for modification C:\Program Files\desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3185155662-718608226-894467740-1000\desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exeSecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exedescription pid process target process PID 2520 set thread context of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 set thread context of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe -
Drops file in Program Files directory 64 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exedescription ioc process File opened for modification C:\Program Files\Java\jre7\lib\management\jmxremote.password.template SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\QP.XML.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ONGuide.onepkg.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDEBARBB.POC.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01777_.WMF SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\cpu.css SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WWLIB.DLL.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\profile.jfc SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR14F.GIF SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEIRM.XML SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BS2BARB.POC.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_no.dll SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\StatusOnline.ico SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\Java\jre7\lib\flavormap.properties.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_m.png SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL095.XML SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\OUTLVBA.DLL SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14581_.GIF.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\DELETE.GIF.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Niue SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Adjacency.xml SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_right.png SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Waveform.thmx.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_mid.gif.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\MSB1ARFR.ITS.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387895.JPG SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageBlank.gif.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14871_.GIF SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEMANAGED.DLL.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Class.zip SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libsapi_plugin.dll SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\SONORA.INF.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.id[EC8A3494-3483].[[email protected]].8base SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 432 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exeSecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exepid process 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exeSecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exeSecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeDebugPrivilege 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe Token: SeDebugPrivilege 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe Token: SeDebugPrivilege 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe Token: SeBackupPrivilege 1964 vssvc.exe Token: SeRestorePrivilege 1964 vssvc.exe Token: SeAuditPrivilege 1964 vssvc.exe Token: SeIncreaseQuotaPrivilege 2560 WMIC.exe Token: SeSecurityPrivilege 2560 WMIC.exe Token: SeTakeOwnershipPrivilege 2560 WMIC.exe Token: SeLoadDriverPrivilege 2560 WMIC.exe Token: SeSystemProfilePrivilege 2560 WMIC.exe Token: SeSystemtimePrivilege 2560 WMIC.exe Token: SeProfSingleProcessPrivilege 2560 WMIC.exe Token: SeIncBasePriorityPrivilege 2560 WMIC.exe Token: SeCreatePagefilePrivilege 2560 WMIC.exe Token: SeBackupPrivilege 2560 WMIC.exe Token: SeRestorePrivilege 2560 WMIC.exe Token: SeShutdownPrivilege 2560 WMIC.exe Token: SeDebugPrivilege 2560 WMIC.exe Token: SeSystemEnvironmentPrivilege 2560 WMIC.exe Token: SeRemoteShutdownPrivilege 2560 WMIC.exe Token: SeUndockPrivilege 2560 WMIC.exe Token: SeManageVolumePrivilege 2560 WMIC.exe Token: 33 2560 WMIC.exe Token: 34 2560 WMIC.exe Token: 35 2560 WMIC.exe Token: SeIncreaseQuotaPrivilege 2560 WMIC.exe Token: SeSecurityPrivilege 2560 WMIC.exe Token: SeTakeOwnershipPrivilege 2560 WMIC.exe Token: SeLoadDriverPrivilege 2560 WMIC.exe Token: SeSystemProfilePrivilege 2560 WMIC.exe Token: SeSystemtimePrivilege 2560 WMIC.exe Token: SeProfSingleProcessPrivilege 2560 WMIC.exe Token: SeIncBasePriorityPrivilege 2560 WMIC.exe Token: SeCreatePagefilePrivilege 2560 WMIC.exe Token: SeBackupPrivilege 2560 WMIC.exe Token: SeRestorePrivilege 2560 WMIC.exe Token: SeShutdownPrivilege 2560 WMIC.exe Token: SeDebugPrivilege 2560 WMIC.exe Token: SeSystemEnvironmentPrivilege 2560 WMIC.exe Token: SeRemoteShutdownPrivilege 2560 WMIC.exe Token: SeUndockPrivilege 2560 WMIC.exe Token: SeManageVolumePrivilege 2560 WMIC.exe Token: 33 2560 WMIC.exe Token: 34 2560 WMIC.exe Token: 35 2560 WMIC.exe Token: SeBackupPrivilege 3036 wbengine.exe Token: SeRestorePrivilege 3036 wbengine.exe Token: SeSecurityPrivilege 3036 wbengine.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exeSecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exeSecuriteInfo.com.Trojan.Packed2.45812.22266.8634.execmd.execmd.exedescription pid process target process PID 2520 wrote to memory of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2520 wrote to memory of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2520 wrote to memory of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2520 wrote to memory of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2520 wrote to memory of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2520 wrote to memory of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2520 wrote to memory of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2520 wrote to memory of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2520 wrote to memory of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2520 wrote to memory of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2520 wrote to memory of 3004 2520 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 2444 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 2444 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 2444 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 2444 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 2704 wrote to memory of 1696 2704 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe PID 3004 wrote to memory of 2600 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe cmd.exe PID 3004 wrote to memory of 2600 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe cmd.exe PID 3004 wrote to memory of 2600 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe cmd.exe PID 3004 wrote to memory of 2600 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe cmd.exe PID 3004 wrote to memory of 2440 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe cmd.exe PID 3004 wrote to memory of 2440 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe cmd.exe PID 3004 wrote to memory of 2440 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe cmd.exe PID 3004 wrote to memory of 2440 3004 SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe cmd.exe PID 2600 wrote to memory of 2416 2600 cmd.exe netsh.exe PID 2600 wrote to memory of 2416 2600 cmd.exe netsh.exe PID 2600 wrote to memory of 2416 2600 cmd.exe netsh.exe PID 2440 wrote to memory of 432 2440 cmd.exe vssadmin.exe PID 2440 wrote to memory of 432 2440 cmd.exe vssadmin.exe PID 2440 wrote to memory of 432 2440 cmd.exe vssadmin.exe PID 2600 wrote to memory of 624 2600 cmd.exe netsh.exe PID 2600 wrote to memory of 624 2600 cmd.exe netsh.exe PID 2600 wrote to memory of 624 2600 cmd.exe netsh.exe PID 2440 wrote to memory of 2560 2440 cmd.exe WMIC.exe PID 2440 wrote to memory of 2560 2440 cmd.exe WMIC.exe PID 2440 wrote to memory of 2560 2440 cmd.exe WMIC.exe PID 2440 wrote to memory of 2316 2440 cmd.exe bcdedit.exe PID 2440 wrote to memory of 2316 2440 cmd.exe bcdedit.exe PID 2440 wrote to memory of 2316 2440 cmd.exe bcdedit.exe PID 2440 wrote to memory of 1972 2440 cmd.exe bcdedit.exe PID 2440 wrote to memory of 1972 2440 cmd.exe bcdedit.exe PID 2440 wrote to memory of 1972 2440 cmd.exe bcdedit.exe PID 2440 wrote to memory of 2344 2440 cmd.exe wbadmin.exe PID 2440 wrote to memory of 2344 2440 cmd.exe wbadmin.exe PID 2440 wrote to memory of 2344 2440 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe4⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45812.22266.8634.exe4⤵PID:1696
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
- Modifies Windows Firewall
PID:2416 -
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
- Modifies Windows Firewall
PID:624 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:432 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2316 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1972 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:2344
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2632
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1916
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[EC8A3494-3483].[[email protected]].8base
Filesize143.1MB
MD5ce3008c7ef340c8a0680f47f1100f6f7
SHA15b79092496e21ebc26a5088f959fbc8045c18914
SHA25636ec8c55e39472fb86f5b361bea12009af80ebe2a7ab7797dbf98b9473aa67a0
SHA5120a84c9d9c697c95a41683799d1c4e0d4496c07edda7ff504bf5b0a4d5d66c7d310fa7520d7dda8d66e3dc8184a8c7c85d2520407df7898254f0b7bf3d99e54a4