phobos | 91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4

General

Target

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
Size

1.7MB
MD5

2519f369f426e4d2cdd88290d1c25d3c
SHA1

e464001902893ab6aea89b8ccfc66f9eb1d45988
SHA256

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4
SHA512

bedda8d51127c186946cdb3755f9bcc049a0efc308ed645de52d58cdffa8fad85778e4a77338f1c3d68bd2b725ff68e5829a4bba8879983f7380df350754d443
SSDEEP

24576:4E6seIAzWNS0LSaN9EBrx+dbsOCK/91/oc1EDnbLmVrkfvDUdhu3z7L/40NM+Sf2:tKpCSrEdbsOn/4sEDnB3z7E0CzzK

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

4604 bcdedit.exe
1808 bcdedit.exe
Renames multiple (141) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

288 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

2268 netsh.exe
3836 netsh.exe

pid	process
4604	bcdedit.exe
1808	bcdedit.exe

pid	process
288	wbadmin.exe

pid	process
2268	netsh.exe
3836	netsh.exe

Drops startup file 1 IoCs

Processes:

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4 = "C:\\Users\\Admin\\AppData\\Local\\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe"	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4 = "C:\\Users\\Admin\\AppData\\Local\\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe"	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1114462139-3090196418-29517368-1000\desktop.ini	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1114462139-3090196418-29517368-1000\desktop.ini	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\desktop.ini	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

description	pid	process	target process
PID 2560 set thread context of 1772	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 set thread context of 4640	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

Drops file in Program Files directory 64 IoCs

Processes:

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\logging.properties	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Java\jdk-1.8\LICENSE.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Java\jre-1.8\bin\verify.dll.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\FileSystemMetadata.xml	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2native.dll	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.id[6C1B872D-3483].[[email protected]].8base	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1716 vssadmin.exe

pid	process
1716	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

pid	process
2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

Processes:

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeDebugPrivilege	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
Token: SeDebugPrivilege	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
Token: SeDebugPrivilege	1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
Token: SeBackupPrivilege	3480	vssvc.exe
Token: SeRestorePrivilege	3480	vssvc.exe
Token: SeAuditPrivilege	3480	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1176	WMIC.exe
Token: SeSecurityPrivilege	1176	WMIC.exe
Token: SeTakeOwnershipPrivilege	1176	WMIC.exe
Token: SeLoadDriverPrivilege	1176	WMIC.exe
Token: SeSystemProfilePrivilege	1176	WMIC.exe
Token: SeSystemtimePrivilege	1176	WMIC.exe
Token: SeProfSingleProcessPrivilege	1176	WMIC.exe
Token: SeIncBasePriorityPrivilege	1176	WMIC.exe
Token: SeCreatePagefilePrivilege	1176	WMIC.exe
Token: SeBackupPrivilege	1176	WMIC.exe
Token: SeRestorePrivilege	1176	WMIC.exe
Token: SeShutdownPrivilege	1176	WMIC.exe
Token: SeDebugPrivilege	1176	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1176	WMIC.exe
Token: SeRemoteShutdownPrivilege	1176	WMIC.exe
Token: SeUndockPrivilege	1176	WMIC.exe
Token: SeManageVolumePrivilege	1176	WMIC.exe
Token: 33	1176	WMIC.exe
Token: 34	1176	WMIC.exe
Token: 35	1176	WMIC.exe
Token: 36	1176	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1176	WMIC.exe
Token: SeSecurityPrivilege	1176	WMIC.exe
Token: SeTakeOwnershipPrivilege	1176	WMIC.exe
Token: SeLoadDriverPrivilege	1176	WMIC.exe
Token: SeSystemProfilePrivilege	1176	WMIC.exe
Token: SeSystemtimePrivilege	1176	WMIC.exe
Token: SeProfSingleProcessPrivilege	1176	WMIC.exe
Token: SeIncBasePriorityPrivilege	1176	WMIC.exe
Token: SeCreatePagefilePrivilege	1176	WMIC.exe
Token: SeBackupPrivilege	1176	WMIC.exe
Token: SeRestorePrivilege	1176	WMIC.exe
Token: SeShutdownPrivilege	1176	WMIC.exe
Token: SeDebugPrivilege	1176	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1176	WMIC.exe
Token: SeRemoteShutdownPrivilege	1176	WMIC.exe
Token: SeUndockPrivilege	1176	WMIC.exe
Token: SeManageVolumePrivilege	1176	WMIC.exe
Token: 33	1176	WMIC.exe
Token: 34	1176	WMIC.exe
Token: 35	1176	WMIC.exe
Token: 36	1176	WMIC.exe
Token: SeBackupPrivilege	1920	wbengine.exe
Token: SeRestorePrivilege	1920	wbengine.exe
Token: SeSecurityPrivilege	1920	wbengine.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.execmd.execmd.exe

description	pid	process	target process
PID 2560 wrote to memory of 1772	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2560 wrote to memory of 1772	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2560 wrote to memory of 1772	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2560 wrote to memory of 1772	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2560 wrote to memory of 1772	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2560 wrote to memory of 1772	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2560 wrote to memory of 1772	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2560 wrote to memory of 1772	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2560 wrote to memory of 1772	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2560 wrote to memory of 1772	2560	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 3952	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 3952	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 3952	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 1772 wrote to memory of 1868	1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	cmd.exe
PID 1772 wrote to memory of 1868	1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	cmd.exe
PID 2728 wrote to memory of 1048	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 1048	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 1048	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 1772 wrote to memory of 3828	1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	cmd.exe
PID 1772 wrote to memory of 3828	1772	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	cmd.exe
PID 2728 wrote to memory of 4640	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 4640	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 4640	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 4640	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 4640	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 4640	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 4640	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 4640	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 4640	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 2728 wrote to memory of 4640	2728	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe	91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
PID 3828 wrote to memory of 2268	3828	cmd.exe	netsh.exe
PID 3828 wrote to memory of 2268	3828	cmd.exe	netsh.exe
PID 1868 wrote to memory of 1716	1868	cmd.exe	vssadmin.exe
PID 1868 wrote to memory of 1716	1868	cmd.exe	vssadmin.exe
PID 3828 wrote to memory of 3836	3828	cmd.exe	netsh.exe
PID 3828 wrote to memory of 3836	3828	cmd.exe	netsh.exe
PID 1868 wrote to memory of 1176	1868	cmd.exe	WMIC.exe
PID 1868 wrote to memory of 1176	1868	cmd.exe	WMIC.exe
PID 1868 wrote to memory of 4604	1868	cmd.exe	bcdedit.exe
PID 1868 wrote to memory of 4604	1868	cmd.exe	bcdedit.exe
PID 1868 wrote to memory of 1808	1868	cmd.exe	bcdedit.exe
PID 1868 wrote to memory of 1808	1868	cmd.exe	bcdedit.exe
PID 1868 wrote to memory of 288	1868	cmd.exe	wbadmin.exe
PID 1868 wrote to memory of 288	1868	cmd.exe	wbadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
"C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560

C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
"C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728

C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
4⤵
PID:3952

C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
4⤵
PID:4640

C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
4⤵
PID:1048

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1716

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:4604

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:1808

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:288

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3828

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:2268

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:3836

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3804

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Indicator Removal

3

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

4

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[6C1B872D-3483].[[email protected]].8base
Filesize
3.2MB

MD5
c56f0064890524e10bb89116129ed30f

SHA1
85f82b446fdd0ebd00872c301d562821e5d9f32d

SHA256
3277923e5e25917ba8810cfc23668de028508439cd5fe8180636e951b742beca

SHA512
08e87599ad93581556145d1449f8494435d586c68a148a2b7378c88a2fb7702559d6c91879f0475fb9827af8ab6e81186d79a7f15059f4b7edd87ccd0fe1feeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe.log
Filesize
1016B

MD5
4353288293ab8929e492327245a7ccb2

SHA1
89b365f2f5e14faaf17715e5764b60d344250d67

SHA256
61954fc5184dd88a959f803ee98ca9af53eb0c942dbb00b98ba4f8a46081b587

SHA512
48c07ca1b769cf02af6ec938aad8b5a03133e82a451bdff5a03bf4ba47cfd7add0ab28ee6622c22fb54e127472a7cf68dd7d05da15ec439cc18aed2ca76cd08a

Download Submit
memory/1772-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-83-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-168-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-606-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-193-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-169-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-38-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-36-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-558-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-13-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-44-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-1374-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-77-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-45-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-43-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-40-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-33-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1772-35-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2560-9-0x0000000005FE0000-0x0000000006584000-memory.dmp

Filesize
5.6MB

Download
memory/2560-5-0x0000000005900000-0x000000000594E000-memory.dmp

Filesize
312KB

Download
memory/2560-1-0x0000000074400000-0x0000000074BB0000-memory.dmp

Filesize
7.7MB

Download
memory/2560-2-0x00000000052D0000-0x0000000005362000-memory.dmp

Filesize
584KB

Download
memory/2560-3-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/2560-15-0x0000000074400000-0x0000000074BB0000-memory.dmp

Filesize
7.7MB

Download
memory/2560-0-0x0000000000770000-0x0000000000932000-memory.dmp

Filesize
1.8MB

Download
memory/2560-8-0x00000000059E0000-0x0000000005A2C000-memory.dmp

Filesize
304KB

Download
memory/2560-7-0x0000000005990000-0x00000000059C4000-memory.dmp

Filesize
208KB

Download
memory/2560-6-0x0000000005950000-0x0000000005986000-memory.dmp

Filesize
216KB

Download
memory/2560-4-0x0000000005370000-0x000000000549C000-memory.dmp

Filesize
1.2MB

Download
memory/2728-17-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/2728-18-0x00000000057C0000-0x00000000057D0000-memory.dmp

Filesize
64KB

Download
memory/2728-24-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/4640-25-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads