phobos | 30e90f33067608e8e7f4d57fd6903adb5eccb91bf426c56569c16bf86f0d8971

General

Target

fba616f5dc56b1cd9c463c0b9da86578.exe
Size

1.1MB
MD5

fba616f5dc56b1cd9c463c0b9da86578
SHA1

ac2b9c5c34af3894210852c7199a32dcd96c048c
SHA256

30e90f33067608e8e7f4d57fd6903adb5eccb91bf426c56569c16bf86f0d8971
SHA512

7e6c8b01308310a7f13bb3891a166eced2d15057ffa1d3b296058d9420ac46cb39abc272d4883bb2168b00d04a34fe674ef6085776b618a46913854421484cd5
SSDEEP

12288:6YFxm3mFshWQKt/kzc8MDz311UVZi/MBJ+z4YTwSPFOXXBumgKGYwhm0XPie4LnM:NrPFYW/x19/MGxPGAmQn/isFhXV

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\info.hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>cartilage</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #C6B5C4; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #B5CC8E; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #e6ecf2; border-left: 10px solid #B58CB2; } .alert { background: #FFE4E4; border-left: 10px solid #FFA07A; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted due to a security problem with your PC.</div> <div class='bold'>If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Or write us to the Tox: <span class='mark'>78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>CBEC25ED-3483</span></div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>

Emails

class='mark'>[email protected]</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Extracted

Path

C:\info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Or write us to the Tox: 78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074 Write this ID in the title of your message CBEC25ED-3483 You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

540 bcdedit.exe
2352 bcdedit.exe
1172 bcdedit.exe
2304 bcdedit.exe
Renames multiple (318) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

2384 wbadmin.exe
1564 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

1408 netsh.exe
1560 netsh.exe

pid	process
540	bcdedit.exe
2352	bcdedit.exe
1172	bcdedit.exe
2304	bcdedit.exe

pid	process
2384	wbadmin.exe
1564	wbadmin.exe

pid	process
1408	netsh.exe
1560	netsh.exe

Drops startup file 3 IoCs

Processes:

fba616f5dc56b1cd9c463c0b9da86578.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fba616f5dc56b1cd9c463c0b9da86578.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fba616f5dc56b1cd9c463c0b9da86578 = "C:\\Users\\Admin\\AppData\\Local\\fba616f5dc56b1cd9c463c0b9da86578.exe"	fba616f5dc56b1cd9c463c0b9da86578.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\fba616f5dc56b1cd9c463c0b9da86578 = "C:\\Users\\Admin\\AppData\\Local\\fba616f5dc56b1cd9c463c0b9da86578.exe"	fba616f5dc56b1cd9c463c0b9da86578.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

fba616f5dc56b1cd9c463c0b9da86578.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3618187007-3650799920-3290345941-1000\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ESV7R4E\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1HY7WIQC\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\C6LU9VPK\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\P77JTQH8\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\A7ZEET3J\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	fba616f5dc56b1cd9c463c0b9da86578.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

fba616f5dc56b1cd9c463c0b9da86578.exefba616f5dc56b1cd9c463c0b9da86578.exe

description	pid	process	target process
PID 2228 set thread context of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 set thread context of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe

Drops file in Program Files directory 64 IoCs

Processes:

fba616f5dc56b1cd9c463c0b9da86578.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\DVD Maker\SecretST.TTF	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\PREVIEW.GIF	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01193_.WMF	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03451_.WMF	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14828_.GIF	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21295_.GIF	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\RTF_BOLD.GIF	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SettingsInternal.zip	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia90.dll.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01560_.WMF.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\PMAILEXT.ECF	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONTAB32.DLL	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Eucla	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.MMW	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCD11.POC	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00902_.WMF.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02282_.WMF	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GostTitle.XSL	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\TWRECS.DLL	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\12.png	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Java\jre7\bin\fontmanager.dll.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\SearchHide.vbs	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)grayStateIcon.png	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1F.GIF.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\MSOSV.DLL	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\es-ES\msdaprsr.dll.mui	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_F_COL.HXK.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLowMask.bmp	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIcon.jpg	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\HEADER.GIF.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\wmplayer.exe.mui	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0301480.WMF.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\DEFAULT.XSL	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OCRHC.DAT	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF	fba616f5dc56b1cd9c463c0b9da86578.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02009_.WMF.id[CBEC25ED-3483].[[email protected]].8base	fba616f5dc56b1cd9c463c0b9da86578.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui	fba616f5dc56b1cd9c463c0b9da86578.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2508 2736 WerFault.exe fba616f5dc56b1cd9c463c0b9da86578.exe
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1804 vssadmin.exe
1536 vssadmin.exe

pid	pid_target	process	target process
2508	2736	WerFault.exe	fba616f5dc56b1cd9c463c0b9da86578.exe

pid	process
1804	vssadmin.exe
1536	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exemshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fba616f5dc56b1cd9c463c0b9da86578.exe

pid	process
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe
2576	fba616f5dc56b1cd9c463c0b9da86578.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

fba616f5dc56b1cd9c463c0b9da86578.exefba616f5dc56b1cd9c463c0b9da86578.exefba616f5dc56b1cd9c463c0b9da86578.exevssvc.exeWMIC.exewbengine.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2228	fba616f5dc56b1cd9c463c0b9da86578.exe
Token: SeDebugPrivilege	2696	fba616f5dc56b1cd9c463c0b9da86578.exe
Token: SeDebugPrivilege	2576	fba616f5dc56b1cd9c463c0b9da86578.exe
Token: SeBackupPrivilege	1872	vssvc.exe
Token: SeRestorePrivilege	1872	vssvc.exe
Token: SeAuditPrivilege	1872	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2720	WMIC.exe
Token: SeSecurityPrivilege	2720	WMIC.exe
Token: SeTakeOwnershipPrivilege	2720	WMIC.exe
Token: SeLoadDriverPrivilege	2720	WMIC.exe
Token: SeSystemProfilePrivilege	2720	WMIC.exe
Token: SeSystemtimePrivilege	2720	WMIC.exe
Token: SeProfSingleProcessPrivilege	2720	WMIC.exe
Token: SeIncBasePriorityPrivilege	2720	WMIC.exe
Token: SeCreatePagefilePrivilege	2720	WMIC.exe
Token: SeBackupPrivilege	2720	WMIC.exe
Token: SeRestorePrivilege	2720	WMIC.exe
Token: SeShutdownPrivilege	2720	WMIC.exe
Token: SeDebugPrivilege	2720	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2720	WMIC.exe
Token: SeRemoteShutdownPrivilege	2720	WMIC.exe
Token: SeUndockPrivilege	2720	WMIC.exe
Token: SeManageVolumePrivilege	2720	WMIC.exe
Token: 33	2720	WMIC.exe
Token: 34	2720	WMIC.exe
Token: 35	2720	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2720	WMIC.exe
Token: SeSecurityPrivilege	2720	WMIC.exe
Token: SeTakeOwnershipPrivilege	2720	WMIC.exe
Token: SeLoadDriverPrivilege	2720	WMIC.exe
Token: SeSystemProfilePrivilege	2720	WMIC.exe
Token: SeSystemtimePrivilege	2720	WMIC.exe
Token: SeProfSingleProcessPrivilege	2720	WMIC.exe
Token: SeIncBasePriorityPrivilege	2720	WMIC.exe
Token: SeCreatePagefilePrivilege	2720	WMIC.exe
Token: SeBackupPrivilege	2720	WMIC.exe
Token: SeRestorePrivilege	2720	WMIC.exe
Token: SeShutdownPrivilege	2720	WMIC.exe
Token: SeDebugPrivilege	2720	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2720	WMIC.exe
Token: SeRemoteShutdownPrivilege	2720	WMIC.exe
Token: SeUndockPrivilege	2720	WMIC.exe
Token: SeManageVolumePrivilege	2720	WMIC.exe
Token: 33	2720	WMIC.exe
Token: 34	2720	WMIC.exe
Token: 35	2720	WMIC.exe
Token: SeBackupPrivilege	2436	wbengine.exe
Token: SeRestorePrivilege	2436	wbengine.exe
Token: SeSecurityPrivilege	2436	wbengine.exe
Token: SeIncreaseQuotaPrivilege	2356	WMIC.exe
Token: SeSecurityPrivilege	2356	WMIC.exe
Token: SeTakeOwnershipPrivilege	2356	WMIC.exe
Token: SeLoadDriverPrivilege	2356	WMIC.exe
Token: SeSystemProfilePrivilege	2356	WMIC.exe
Token: SeSystemtimePrivilege	2356	WMIC.exe
Token: SeProfSingleProcessPrivilege	2356	WMIC.exe
Token: SeIncBasePriorityPrivilege	2356	WMIC.exe
Token: SeCreatePagefilePrivilege	2356	WMIC.exe
Token: SeBackupPrivilege	2356	WMIC.exe
Token: SeRestorePrivilege	2356	WMIC.exe
Token: SeShutdownPrivilege	2356	WMIC.exe
Token: SeDebugPrivilege	2356	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2356	WMIC.exe
Token: SeRemoteShutdownPrivilege	2356	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

fba616f5dc56b1cd9c463c0b9da86578.exefba616f5dc56b1cd9c463c0b9da86578.exefba616f5dc56b1cd9c463c0b9da86578.exefba616f5dc56b1cd9c463c0b9da86578.execmd.execmd.exe

description	pid	process	target process
PID 2228 wrote to memory of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2228 wrote to memory of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2228 wrote to memory of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2228 wrote to memory of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2228 wrote to memory of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2228 wrote to memory of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2228 wrote to memory of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2228 wrote to memory of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2228 wrote to memory of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2228 wrote to memory of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2228 wrote to memory of 2576	2228	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 wrote to memory of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 wrote to memory of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 wrote to memory of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 wrote to memory of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 wrote to memory of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 wrote to memory of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 wrote to memory of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 wrote to memory of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 wrote to memory of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 wrote to memory of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2696 wrote to memory of 2736	2696	fba616f5dc56b1cd9c463c0b9da86578.exe	fba616f5dc56b1cd9c463c0b9da86578.exe
PID 2736 wrote to memory of 2508	2736	fba616f5dc56b1cd9c463c0b9da86578.exe	WerFault.exe
PID 2736 wrote to memory of 2508	2736	fba616f5dc56b1cd9c463c0b9da86578.exe	WerFault.exe
PID 2736 wrote to memory of 2508	2736	fba616f5dc56b1cd9c463c0b9da86578.exe	WerFault.exe
PID 2736 wrote to memory of 2508	2736	fba616f5dc56b1cd9c463c0b9da86578.exe	WerFault.exe
PID 2576 wrote to memory of 2500	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	cmd.exe
PID 2576 wrote to memory of 2500	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	cmd.exe
PID 2576 wrote to memory of 2500	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	cmd.exe
PID 2576 wrote to memory of 2500	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	cmd.exe
PID 2576 wrote to memory of 2532	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	cmd.exe
PID 2576 wrote to memory of 2532	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	cmd.exe
PID 2576 wrote to memory of 2532	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	cmd.exe
PID 2576 wrote to memory of 2532	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	cmd.exe
PID 2532 wrote to memory of 1804	2532	cmd.exe	vssadmin.exe
PID 2532 wrote to memory of 1804	2532	cmd.exe	vssadmin.exe
PID 2532 wrote to memory of 1804	2532	cmd.exe	vssadmin.exe
PID 2500 wrote to memory of 1408	2500	cmd.exe	netsh.exe
PID 2500 wrote to memory of 1408	2500	cmd.exe	netsh.exe
PID 2500 wrote to memory of 1408	2500	cmd.exe	netsh.exe
PID 2500 wrote to memory of 1560	2500	cmd.exe	netsh.exe
PID 2500 wrote to memory of 1560	2500	cmd.exe	netsh.exe
PID 2500 wrote to memory of 1560	2500	cmd.exe	netsh.exe
PID 2532 wrote to memory of 2720	2532	cmd.exe	WMIC.exe
PID 2532 wrote to memory of 2720	2532	cmd.exe	WMIC.exe
PID 2532 wrote to memory of 2720	2532	cmd.exe	WMIC.exe
PID 2532 wrote to memory of 540	2532	cmd.exe	bcdedit.exe
PID 2532 wrote to memory of 540	2532	cmd.exe	bcdedit.exe
PID 2532 wrote to memory of 540	2532	cmd.exe	bcdedit.exe
PID 2532 wrote to memory of 2352	2532	cmd.exe	bcdedit.exe
PID 2532 wrote to memory of 2352	2532	cmd.exe	bcdedit.exe
PID 2532 wrote to memory of 2352	2532	cmd.exe	bcdedit.exe
PID 2532 wrote to memory of 2384	2532	cmd.exe	wbadmin.exe
PID 2532 wrote to memory of 2384	2532	cmd.exe	wbadmin.exe
PID 2532 wrote to memory of 2384	2532	cmd.exe	wbadmin.exe
PID 2576 wrote to memory of 2388	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	mshta.exe
PID 2576 wrote to memory of 2388	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	mshta.exe
PID 2576 wrote to memory of 2388	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	mshta.exe
PID 2576 wrote to memory of 2388	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	mshta.exe
PID 2576 wrote to memory of 1744	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	mshta.exe
PID 2576 wrote to memory of 1744	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	mshta.exe
PID 2576 wrote to memory of 1744	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	mshta.exe
PID 2576 wrote to memory of 1744	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	mshta.exe
PID 2576 wrote to memory of 2932	2576	fba616f5dc56b1cd9c463c0b9da86578.exe	mshta.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\fba616f5dc56b1cd9c463c0b9da86578.exe
"C:\Users\Admin\AppData\Local\Temp\fba616f5dc56b1cd9c463c0b9da86578.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228

C:\Users\Admin\AppData\Local\Temp\fba616f5dc56b1cd9c463c0b9da86578.exe
C:\Users\Admin\AppData\Local\Temp\fba616f5dc56b1cd9c463c0b9da86578.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576

C:\Users\Admin\AppData\Local\Temp\fba616f5dc56b1cd9c463c0b9da86578.exe
"C:\Users\Admin\AppData\Local\Temp\fba616f5dc56b1cd9c463c0b9da86578.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696

C:\Users\Admin\AppData\Local\Temp\fba616f5dc56b1cd9c463c0b9da86578.exe
C:\Users\Admin\AppData\Local\Temp\fba616f5dc56b1cd9c463c0b9da86578.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 164
5⤵
- Program crash
PID:2508

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1804

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:540

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:2352

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:2384

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:1408

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:1560

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:2388

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:1744

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:2932

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:2952

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:888

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1536

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:1172

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:2304

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:1564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:308

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:960

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Indicator Removal

3

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

4

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[CBEC25ED-3483].[[email protected]].8base
Filesize
143.1MB

MD5
dd084944d579c8ff8f96ff1919fae081

SHA1
98d7c2622fd593fe08c0e567cb0df4f7b687ddc5

SHA256
35e94de5a712366925f4cfa8025b5c215ff6c9f2a336da5a7869ca590a176255

SHA512
b82e238bae0cb07f923a0c955531856082fb66555d21ed8085bbbd9631a83c37a90d344b5727cfe24549d2351789469de583f2e01380a29c1125b95c1b840487

Download Submit
C:\Users\Admin\Desktop\info.hta
Filesize
5KB

MD5
b4bf73ea713f6b0bcef5b86877a2c886

SHA1
ebef45fbf95ea32cee5f4bd7e48f6f260d8d160f

SHA256
c40518712cfd76918493f75aa181c5c99d1835ff38298271f58c29333cb6ec27

SHA512
cf7e7bfb83ea1d155ff2f81956bde514c43cb0572a346e3d42889695b5bc2b6034d152544f8a71212fab219cdd503699e586c85c6d4190479e8205c3b920ef98

Download Submit
C:\info.hta
Filesize
5KB

MD5
b4bf73ea713f6b0bcef5b86877a2c886

SHA1
ebef45fbf95ea32cee5f4bd7e48f6f260d8d160f

SHA256
c40518712cfd76918493f75aa181c5c99d1835ff38298271f58c29333cb6ec27

SHA512
cf7e7bfb83ea1d155ff2f81956bde514c43cb0572a346e3d42889695b5bc2b6034d152544f8a71212fab219cdd503699e586c85c6d4190479e8205c3b920ef98

Download Submit
C:\info.hta
Filesize
5KB

MD5
b4bf73ea713f6b0bcef5b86877a2c886

SHA1
ebef45fbf95ea32cee5f4bd7e48f6f260d8d160f

SHA256
c40518712cfd76918493f75aa181c5c99d1835ff38298271f58c29333cb6ec27

SHA512
cf7e7bfb83ea1d155ff2f81956bde514c43cb0572a346e3d42889695b5bc2b6034d152544f8a71212fab219cdd503699e586c85c6d4190479e8205c3b920ef98

Download Submit
C:\users\public\desktop\info.hta
Filesize
5KB

MD5
b4bf73ea713f6b0bcef5b86877a2c886

SHA1
ebef45fbf95ea32cee5f4bd7e48f6f260d8d160f

SHA256
c40518712cfd76918493f75aa181c5c99d1835ff38298271f58c29333cb6ec27

SHA512
cf7e7bfb83ea1d155ff2f81956bde514c43cb0572a346e3d42889695b5bc2b6034d152544f8a71212fab219cdd503699e586c85c6d4190479e8205c3b920ef98

Download Submit
F:\info.hta
Filesize
5KB

MD5
b4bf73ea713f6b0bcef5b86877a2c886

SHA1
ebef45fbf95ea32cee5f4bd7e48f6f260d8d160f

SHA256
c40518712cfd76918493f75aa181c5c99d1835ff38298271f58c29333cb6ec27

SHA512
cf7e7bfb83ea1d155ff2f81956bde514c43cb0572a346e3d42889695b5bc2b6034d152544f8a71212fab219cdd503699e586c85c6d4190479e8205c3b920ef98

Download Submit
memory/2228-3-0x00000000006C0000-0x000000000070E000-memory.dmp

Filesize
312KB

Download
memory/2228-6-0x00000000049B0000-0x00000000049FC000-memory.dmp

Filesize
304KB

Download
memory/2228-5-0x0000000000710000-0x0000000000744000-memory.dmp

Filesize
208KB

Download
memory/2228-4-0x00000000004B0000-0x00000000004E6000-memory.dmp

Filesize
216KB

Download
memory/2228-17-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download
memory/2228-2-0x0000000004970000-0x00000000049B0000-memory.dmp

Filesize
256KB

Download
memory/2228-1-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download
memory/2228-0-0x0000000000DB0000-0x0000000000EDA000-memory.dmp

Filesize
1.2MB

Download
memory/2576-49-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-61-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-18-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-19-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-9-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-11-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-45-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2576-47-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-48-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-50-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-51-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-56-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-15-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-80-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-81-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-105-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-99-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-94-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-131-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-272-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-296-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-3704-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2576-4160-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2696-34-0x00000000735D0000-0x0000000073CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2696-22-0x00000000049A0000-0x00000000049E0000-memory.dmp

Filesize
256KB

Download
memory/2696-21-0x00000000735D0000-0x0000000073CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2696-20-0x0000000000DB0000-0x0000000000EDA000-memory.dmp

Filesize
1.2MB

Download
memory/2736-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads