phobos | 91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4

General

Target

2519f369f426e4d2cdd88290d1c25d3c.exe
Size

1.7MB
MD5

2519f369f426e4d2cdd88290d1c25d3c
SHA1

e464001902893ab6aea89b8ccfc66f9eb1d45988
SHA256

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4
SHA512

bedda8d51127c186946cdb3755f9bcc049a0efc308ed645de52d58cdffa8fad85778e4a77338f1c3d68bd2b725ff68e5829a4bba8879983f7380df350754d443
SSDEEP

24576:4E6seIAzWNS0LSaN9EBrx+dbsOCK/91/oc1EDnbLmVrkfvDUdhu3z7L/40NM+Sf2:tKpCSrEdbsOn/4sEDnB3z7E0CzzK

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

3180 bcdedit.exe
1916 bcdedit.exe
Renames multiple (221) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

2264 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

2852 netsh.exe
4860 netsh.exe

pid	process
3180	bcdedit.exe
1916	bcdedit.exe

pid	process
2264	wbadmin.exe

pid	process
2852	netsh.exe
4860	netsh.exe

Drops startup file 1 IoCs

Processes:

2519f369f426e4d2cdd88290d1c25d3c.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2519f369f426e4d2cdd88290d1c25d3c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2519f369f426e4d2cdd88290d1c25d3c = "C:\\Users\\Admin\\AppData\\Local\\2519f369f426e4d2cdd88290d1c25d3c.exe"	2519f369f426e4d2cdd88290d1c25d3c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2519f369f426e4d2cdd88290d1c25d3c = "C:\\Users\\Admin\\AppData\\Local\\2519f369f426e4d2cdd88290d1c25d3c.exe"	2519f369f426e4d2cdd88290d1c25d3c.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

2519f369f426e4d2cdd88290d1c25d3c.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1114462139-3090196418-29517368-1000\desktop.ini	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1114462139-3090196418-29517368-1000\desktop.ini	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\desktop.ini	2519f369f426e4d2cdd88290d1c25d3c.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

2519f369f426e4d2cdd88290d1c25d3c.exe2519f369f426e4d2cdd88290d1c25d3c.exe

description	pid	process	target process
PID 2468 set thread context of 1524	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 4504 set thread context of 2108	4504	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe

Drops file in Program Files directory 64 IoCs

Processes:

2519f369f426e4d2cdd88290d1c25d3c.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected][22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.DATABASECOMPARE.16.1033.hxn	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\Maple.gif	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ADO210.CHM.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ACEINTL.DLL	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.tree.dat	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll	2519f369f426e4d2cdd88290d1c25d3c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.id[22ACCEFB-3483].[[email protected]].8base	2519f369f426e4d2cdd88290d1c25d3c.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1600 vssadmin.exe

pid	process
1600	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2519f369f426e4d2cdd88290d1c25d3c.exe2519f369f426e4d2cdd88290d1c25d3c.exe

pid	process
2468	2519f369f426e4d2cdd88290d1c25d3c.exe
2468	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe
1524	2519f369f426e4d2cdd88290d1c25d3c.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

Processes:

2519f369f426e4d2cdd88290d1c25d3c.exe2519f369f426e4d2cdd88290d1c25d3c.exe2519f369f426e4d2cdd88290d1c25d3c.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeDebugPrivilege	2468	2519f369f426e4d2cdd88290d1c25d3c.exe
Token: SeDebugPrivilege	4504	2519f369f426e4d2cdd88290d1c25d3c.exe
Token: SeDebugPrivilege	1524	2519f369f426e4d2cdd88290d1c25d3c.exe
Token: SeBackupPrivilege	1552	vssvc.exe
Token: SeRestorePrivilege	1552	vssvc.exe
Token: SeAuditPrivilege	1552	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4916	WMIC.exe
Token: SeSecurityPrivilege	4916	WMIC.exe
Token: SeTakeOwnershipPrivilege	4916	WMIC.exe
Token: SeLoadDriverPrivilege	4916	WMIC.exe
Token: SeSystemProfilePrivilege	4916	WMIC.exe
Token: SeSystemtimePrivilege	4916	WMIC.exe
Token: SeProfSingleProcessPrivilege	4916	WMIC.exe
Token: SeIncBasePriorityPrivilege	4916	WMIC.exe
Token: SeCreatePagefilePrivilege	4916	WMIC.exe
Token: SeBackupPrivilege	4916	WMIC.exe
Token: SeRestorePrivilege	4916	WMIC.exe
Token: SeShutdownPrivilege	4916	WMIC.exe
Token: SeDebugPrivilege	4916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4916	WMIC.exe
Token: SeRemoteShutdownPrivilege	4916	WMIC.exe
Token: SeUndockPrivilege	4916	WMIC.exe
Token: SeManageVolumePrivilege	4916	WMIC.exe
Token: 33	4916	WMIC.exe
Token: 34	4916	WMIC.exe
Token: 35	4916	WMIC.exe
Token: 36	4916	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4916	WMIC.exe
Token: SeSecurityPrivilege	4916	WMIC.exe
Token: SeTakeOwnershipPrivilege	4916	WMIC.exe
Token: SeLoadDriverPrivilege	4916	WMIC.exe
Token: SeSystemProfilePrivilege	4916	WMIC.exe
Token: SeSystemtimePrivilege	4916	WMIC.exe
Token: SeProfSingleProcessPrivilege	4916	WMIC.exe
Token: SeIncBasePriorityPrivilege	4916	WMIC.exe
Token: SeCreatePagefilePrivilege	4916	WMIC.exe
Token: SeBackupPrivilege	4916	WMIC.exe
Token: SeRestorePrivilege	4916	WMIC.exe
Token: SeShutdownPrivilege	4916	WMIC.exe
Token: SeDebugPrivilege	4916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4916	WMIC.exe
Token: SeRemoteShutdownPrivilege	4916	WMIC.exe
Token: SeUndockPrivilege	4916	WMIC.exe
Token: SeManageVolumePrivilege	4916	WMIC.exe
Token: 33	4916	WMIC.exe
Token: 34	4916	WMIC.exe
Token: 35	4916	WMIC.exe
Token: 36	4916	WMIC.exe
Token: SeBackupPrivilege	4984	wbengine.exe
Token: SeRestorePrivilege	4984	wbengine.exe
Token: SeSecurityPrivilege	4984	wbengine.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

2519f369f426e4d2cdd88290d1c25d3c.exe2519f369f426e4d2cdd88290d1c25d3c.exe2519f369f426e4d2cdd88290d1c25d3c.execmd.execmd.exe

description	pid	process	target process
PID 2468 wrote to memory of 4228	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 4228	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 4228	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 1524	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 1524	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 1524	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 1524	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 1524	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 1524	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 1524	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 1524	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 1524	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 2468 wrote to memory of 1524	2468	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 4504 wrote to memory of 2108	4504	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 4504 wrote to memory of 2108	4504	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 4504 wrote to memory of 2108	4504	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 4504 wrote to memory of 2108	4504	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 4504 wrote to memory of 2108	4504	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 4504 wrote to memory of 2108	4504	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 4504 wrote to memory of 2108	4504	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 4504 wrote to memory of 2108	4504	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 4504 wrote to memory of 2108	4504	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 4504 wrote to memory of 2108	4504	2519f369f426e4d2cdd88290d1c25d3c.exe	2519f369f426e4d2cdd88290d1c25d3c.exe
PID 1524 wrote to memory of 1048	1524	2519f369f426e4d2cdd88290d1c25d3c.exe	cmd.exe
PID 1524 wrote to memory of 1048	1524	2519f369f426e4d2cdd88290d1c25d3c.exe	cmd.exe
PID 1524 wrote to memory of 3560	1524	2519f369f426e4d2cdd88290d1c25d3c.exe	cmd.exe
PID 1524 wrote to memory of 3560	1524	2519f369f426e4d2cdd88290d1c25d3c.exe	cmd.exe
PID 3560 wrote to memory of 2852	3560	cmd.exe	netsh.exe
PID 3560 wrote to memory of 2852	3560	cmd.exe	netsh.exe
PID 1048 wrote to memory of 1600	1048	cmd.exe	vssadmin.exe
PID 1048 wrote to memory of 1600	1048	cmd.exe	vssadmin.exe
PID 1048 wrote to memory of 4916	1048	cmd.exe	WMIC.exe
PID 1048 wrote to memory of 4916	1048	cmd.exe	WMIC.exe
PID 3560 wrote to memory of 4860	3560	cmd.exe	netsh.exe
PID 3560 wrote to memory of 4860	3560	cmd.exe	netsh.exe
PID 1048 wrote to memory of 3180	1048	cmd.exe	bcdedit.exe
PID 1048 wrote to memory of 3180	1048	cmd.exe	bcdedit.exe
PID 1048 wrote to memory of 1916	1048	cmd.exe	bcdedit.exe
PID 1048 wrote to memory of 1916	1048	cmd.exe	bcdedit.exe
PID 1048 wrote to memory of 2264	1048	cmd.exe	wbadmin.exe
PID 1048 wrote to memory of 2264	1048	cmd.exe	wbadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2519f369f426e4d2cdd88290d1c25d3c.exe
"C:\Users\Admin\AppData\Local\Temp\2519f369f426e4d2cdd88290d1c25d3c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468

C:\Users\Admin\AppData\Local\Temp\2519f369f426e4d2cdd88290d1c25d3c.exe
C:\Users\Admin\AppData\Local\Temp\2519f369f426e4d2cdd88290d1c25d3c.exe
2⤵
PID:4228

C:\Users\Admin\AppData\Local\Temp\2519f369f426e4d2cdd88290d1c25d3c.exe
C:\Users\Admin\AppData\Local\Temp\2519f369f426e4d2cdd88290d1c25d3c.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524

C:\Users\Admin\AppData\Local\Temp\2519f369f426e4d2cdd88290d1c25d3c.exe
"C:\Users\Admin\AppData\Local\Temp\2519f369f426e4d2cdd88290d1c25d3c.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504

C:\Users\Admin\AppData\Local\Temp\2519f369f426e4d2cdd88290d1c25d3c.exe
C:\Users\Admin\AppData\Local\Temp\2519f369f426e4d2cdd88290d1c25d3c.exe
4⤵
PID:2108

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1600

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:3180

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:1916

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:2264

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3560

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:2852

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:4860

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:940

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3236

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

3

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[22ACCEFB-3483].[[email protected]].8base
Filesize
2.7MB

MD5
3c7b3a8bc5dfb0513c97b46691b4930b

SHA1
e17a6f2e0576dcebd6987c41caa84eb09ff0ffe0

SHA256
bcf656c91b955cb7fdb38e31e38afaef8454926b1959699777ff5a04550e9e74

SHA512
5d274acd2d2162fb80fd083f151a1848b9d78de2eac31fcddc706e92d0c14eb83a4b015346d3234fbb7bab29bfd0a5c81170beae37b123d5e2f8490e46ca7d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2519f369f426e4d2cdd88290d1c25d3c.exe.log
Filesize
1016B

MD5
4353288293ab8929e492327245a7ccb2

SHA1
89b365f2f5e14faaf17715e5764b60d344250d67

SHA256
61954fc5184dd88a959f803ee98ca9af53eb0c942dbb00b98ba4f8a46081b587

SHA512
48c07ca1b769cf02af6ec938aad8b5a03133e82a451bdff5a03bf4ba47cfd7add0ab28ee6622c22fb54e127472a7cf68dd7d05da15ec439cc18aed2ca76cd08a

Download Submit
memory/1524-44-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-42-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-1372-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-1085-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-833-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-630-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-263-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-238-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-13-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-14-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-252-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-193-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-191-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-176-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-152-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-33-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-34-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-35-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-40-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-1366-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-178-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-58-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-38-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-69-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-80-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-175-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1524-146-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2108-22-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2468-2-0x0000000005720000-0x00000000057B2000-memory.dmp

Filesize
584KB

Download
memory/2468-6-0x0000000005B50000-0x0000000005B86000-memory.dmp

Filesize
216KB

Download
memory/2468-4-0x00000000057C0000-0x00000000058EC000-memory.dmp

Filesize
1.2MB

Download
memory/2468-1-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/2468-0-0x0000000000BA0000-0x0000000000D62000-memory.dmp

Filesize
1.8MB

Download
memory/2468-43-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/2468-3-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/2468-9-0x0000000006410000-0x00000000069B4000-memory.dmp

Filesize
5.6MB

Download
memory/2468-8-0x0000000005E10000-0x0000000005E5C000-memory.dmp

Filesize
304KB

Download
memory/2468-7-0x0000000005DC0000-0x0000000005DF4000-memory.dmp

Filesize
208KB

Download
memory/2468-5-0x00000000059D0000-0x0000000005A1E000-memory.dmp

Filesize
312KB

Download
memory/4504-16-0x0000000075330000-0x0000000075AE0000-memory.dmp

Filesize
7.7MB

Download
memory/4504-17-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/4504-21-0x0000000075330000-0x0000000075AE0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads