Overview
overview
10Static
static
7samples3.zip
windows7-x64
1samples3.zip
windows10-2004-x64
105cf6eee9b...b3.exe
windows7-x64
105cf6eee9b...b3.exe
windows10-2004-x64
10d332c0478...a7.exe
windows7-x64
90d332c0478...a7.exe
windows10-2004-x64
90fd8500fde...1e.exe
windows7-x64
10fd8500fde...1e.exe
windows10-2004-x64
111edf9436a...ed.pdf
windows7-x64
111edf9436a...ed.pdf
windows10-2004-x64
119a640415b...5c.exe
windows7-x64
1019a640415b...5c.exe
windows10-2004-x64
1033aa57b04b...cb.exe
windows7-x64
633aa57b04b...cb.exe
windows10-2004-x64
63643464a22...19.exe
windows7-x64
33643464a22...19.exe
windows10-2004-x64
337e2f97755...26.exe
windows7-x64
137e2f97755...26.exe
windows10-2004-x64
154cd11236f...ff.exe
windows7-x64
654cd11236f...ff.exe
windows10-2004-x64
655bc661ad4...8c.exe
windows7-x64
955bc661ad4...8c.exe
windows10-2004-x64
7603d665f09...68.exe
windows7-x64
1603d665f09...68.exe
windows10-2004-x64
16ea27a0861...7e.exe
windows7-x64
16ea27a0861...7e.exe
windows10-2004-x64
373af283fcb...0c.exe
windows7-x64
873af283fcb...0c.exe
windows10-2004-x64
87e41197b74...67.exe
windows7-x64
97e41197b74...67.exe
windows10-2004-x64
9a878fed055...99.exe
windows7-x64
3a878fed055...99.exe
windows10-2004-x64
3Analysis
-
max time kernel
167s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 15:27
Behavioral task
behavioral1
Sample
samples3.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
samples3.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
05cf6eee9b0b2c049cec8ce775de0636ade55f23a51dc833170f09445719abb3.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
05cf6eee9b0b2c049cec8ce775de0636ade55f23a51dc833170f09445719abb3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
0fd8500fdef116abae01a1dcfed2db9784bbcb753488710aa1048f2aa0fd111e.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
0fd8500fdef116abae01a1dcfed2db9784bbcb753488710aa1048f2aa0fd111e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
11edf9436a9205c88c2a815cf6ebfb0a7a42eb150a2649766b3bb30350ee35ed.pdf
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
11edf9436a9205c88c2a815cf6ebfb0a7a42eb150a2649766b3bb30350ee35ed.pdf
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
37e2f977559a58cb33f7128ad7699a5c4f7c0013d8d83b1eda93a59ae35ba526.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
37e2f977559a58cb33f7128ad7699a5c4f7c0013d8d83b1eda93a59ae35ba526.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
54cd11236fdc2a40b505598541f64e8a6bd9ea84552b6d5946777badf8a2b7ff.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
54cd11236fdc2a40b505598541f64e8a6bd9ea84552b6d5946777badf8a2b7ff.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
73af283fcb06a9ea35ea6ad24b62b302459594f4b09dbba2d74001bf90ab020c.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
73af283fcb06a9ea35ea6ad24b62b302459594f4b09dbba2d74001bf90ab020c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe
Resource
win10v2004-20231222-en
General
-
Target
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe
-
Size
145KB
-
MD5
fd946ba0ca811f8f5cddba5c4634fd64
-
SHA1
02536e5089857fd7421a50adb07fe871593d5b9f
-
SHA256
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c
-
SHA512
b50b8bbd93bf00e9d89cadc99900211d5b7a3d3e0f5d450445435ea498ee58be80151f608912244f55e9ad2f907fa896f66389d987b8d3b1a470ad257d7414e8
-
SSDEEP
3072:Tv/FR9m6kfHpVC1pY8iblkCIax6CdAje+QlLC+Q/eJRhz8Jmu+X:j/f9m6g42xqQVSD
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 3064 bcdedit.exe 4692 bcdedit.exe 268 bcdedit.exe 1748 bcdedit.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe -
Drops startup file 3 IoCs
Processes:
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c = "C:\\Users\\Admin\\AppData\\Local\\19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe" 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c = "C:\\Users\\Admin\\AppData\\Local\\19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe" 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Public\Documents\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Public\Videos\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Public\Music\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Music\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1815711207-1844170477-3539718864-1000\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files (x86)\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Links\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1815711207-1844170477-3539718864-1000\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe -
Drops file in Program Files directory 64 IoCs
Processes:
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\CardViewIcon.png.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\ui-strings.js.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageSmallTile.scale-400.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-400.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsLargeTile.scale-100.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tr.gif.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_unselected_18.svg.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_fr_135x40.svg 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner_mini.gif 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-default_32.svg.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nl-nl\ui-strings.js 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\31.jpg 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-32_altform-lightunplated.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.scale-125.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-400.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\people\rachelVaughan.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\styles\wefgallerywinrt.css 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-100_contrast-black.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-150.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\desktop.js 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\ui-strings.js.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-150_contrast-white.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-256_altform-unplated.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-100_contrast-white.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96_altform-fullcolor.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LargeTile.scale-125_contrast-white.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\7.jpg 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchWideTile.contrast-black_scale-100.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-150.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-100.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ja_135x40.svg 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\PREVIEW.GIF 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-125.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_hover.png.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files\7-Zip\Lang\tg.txt.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-72.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\eu-es\ui-strings.js.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchSmallTile.contrast-white_scale-100.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\PREVIEW.GIF.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_contrast-black.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailSmallTile.scale-125.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLargeTile.scale-200.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\deployment.config 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-150.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessLetter.dotx 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookMedTile.scale-400.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailLargeTile.scale-200.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\desktop.js.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Notification_AppLogo_PowerStatus.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.tree.dat 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-256_altform-unplated.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-16.png 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\ui-strings.js.id[8FA0A89C-1130].[[email protected]].mamba 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4624 4176 WerFault.exe 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1472 vssadmin.exe 832 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exepid process 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 3552 vssvc.exe Token: SeRestorePrivilege 3552 vssvc.exe Token: SeAuditPrivilege 3552 vssvc.exe Token: SeIncreaseQuotaPrivilege 4420 WMIC.exe Token: SeSecurityPrivilege 4420 WMIC.exe Token: SeTakeOwnershipPrivilege 4420 WMIC.exe Token: SeLoadDriverPrivilege 4420 WMIC.exe Token: SeSystemProfilePrivilege 4420 WMIC.exe Token: SeSystemtimePrivilege 4420 WMIC.exe Token: SeProfSingleProcessPrivilege 4420 WMIC.exe Token: SeIncBasePriorityPrivilege 4420 WMIC.exe Token: SeCreatePagefilePrivilege 4420 WMIC.exe Token: SeBackupPrivilege 4420 WMIC.exe Token: SeRestorePrivilege 4420 WMIC.exe Token: SeShutdownPrivilege 4420 WMIC.exe Token: SeDebugPrivilege 4420 WMIC.exe Token: SeSystemEnvironmentPrivilege 4420 WMIC.exe Token: SeRemoteShutdownPrivilege 4420 WMIC.exe Token: SeUndockPrivilege 4420 WMIC.exe Token: SeManageVolumePrivilege 4420 WMIC.exe Token: 33 4420 WMIC.exe Token: 34 4420 WMIC.exe Token: 35 4420 WMIC.exe Token: 36 4420 WMIC.exe Token: SeIncreaseQuotaPrivilege 4420 WMIC.exe Token: SeSecurityPrivilege 4420 WMIC.exe Token: SeTakeOwnershipPrivilege 4420 WMIC.exe Token: SeLoadDriverPrivilege 4420 WMIC.exe Token: SeSystemProfilePrivilege 4420 WMIC.exe Token: SeSystemtimePrivilege 4420 WMIC.exe Token: SeProfSingleProcessPrivilege 4420 WMIC.exe Token: SeIncBasePriorityPrivilege 4420 WMIC.exe Token: SeCreatePagefilePrivilege 4420 WMIC.exe Token: SeBackupPrivilege 4420 WMIC.exe Token: SeRestorePrivilege 4420 WMIC.exe Token: SeShutdownPrivilege 4420 WMIC.exe Token: SeDebugPrivilege 4420 WMIC.exe Token: SeSystemEnvironmentPrivilege 4420 WMIC.exe Token: SeRemoteShutdownPrivilege 4420 WMIC.exe Token: SeUndockPrivilege 4420 WMIC.exe Token: SeManageVolumePrivilege 4420 WMIC.exe Token: 33 4420 WMIC.exe Token: 34 4420 WMIC.exe Token: 35 4420 WMIC.exe Token: 36 4420 WMIC.exe Token: SeIncreaseQuotaPrivilege 3356 WMIC.exe Token: SeSecurityPrivilege 3356 WMIC.exe Token: SeTakeOwnershipPrivilege 3356 WMIC.exe Token: SeLoadDriverPrivilege 3356 WMIC.exe Token: SeSystemProfilePrivilege 3356 WMIC.exe Token: SeSystemtimePrivilege 3356 WMIC.exe Token: SeProfSingleProcessPrivilege 3356 WMIC.exe Token: SeIncBasePriorityPrivilege 3356 WMIC.exe Token: SeCreatePagefilePrivilege 3356 WMIC.exe Token: SeBackupPrivilege 3356 WMIC.exe Token: SeRestorePrivilege 3356 WMIC.exe Token: SeShutdownPrivilege 3356 WMIC.exe Token: SeDebugPrivilege 3356 WMIC.exe Token: SeSystemEnvironmentPrivilege 3356 WMIC.exe Token: SeRemoteShutdownPrivilege 3356 WMIC.exe Token: SeUndockPrivilege 3356 WMIC.exe Token: SeManageVolumePrivilege 3356 WMIC.exe Token: 33 3356 WMIC.exe Token: 34 3356 WMIC.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.execmd.execmd.execmd.exedescription pid process target process PID 4568 wrote to memory of 3888 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe cmd.exe PID 4568 wrote to memory of 3888 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe cmd.exe PID 4568 wrote to memory of 4236 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe cmd.exe PID 4568 wrote to memory of 4236 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe cmd.exe PID 4236 wrote to memory of 4984 4236 cmd.exe netsh.exe PID 4236 wrote to memory of 4984 4236 cmd.exe netsh.exe PID 3888 wrote to memory of 1472 3888 cmd.exe vssadmin.exe PID 3888 wrote to memory of 1472 3888 cmd.exe vssadmin.exe PID 3888 wrote to memory of 4420 3888 cmd.exe WMIC.exe PID 3888 wrote to memory of 4420 3888 cmd.exe WMIC.exe PID 3888 wrote to memory of 3064 3888 cmd.exe bcdedit.exe PID 3888 wrote to memory of 3064 3888 cmd.exe bcdedit.exe PID 3888 wrote to memory of 4692 3888 cmd.exe bcdedit.exe PID 3888 wrote to memory of 4692 3888 cmd.exe bcdedit.exe PID 4236 wrote to memory of 3384 4236 cmd.exe netsh.exe PID 4236 wrote to memory of 3384 4236 cmd.exe netsh.exe PID 4568 wrote to memory of 3360 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 3360 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 3360 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 3304 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 3304 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 3304 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 4084 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 4084 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 4084 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 3392 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 3392 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 3392 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe mshta.exe PID 4568 wrote to memory of 3452 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe cmd.exe PID 4568 wrote to memory of 3452 4568 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe cmd.exe PID 3452 wrote to memory of 832 3452 cmd.exe vssadmin.exe PID 3452 wrote to memory of 832 3452 cmd.exe vssadmin.exe PID 3452 wrote to memory of 3356 3452 cmd.exe WMIC.exe PID 3452 wrote to memory of 3356 3452 cmd.exe WMIC.exe PID 3452 wrote to memory of 268 3452 cmd.exe bcdedit.exe PID 3452 wrote to memory of 268 3452 cmd.exe bcdedit.exe PID 3452 wrote to memory of 1748 3452 cmd.exe bcdedit.exe PID 3452 wrote to memory of 1748 3452 cmd.exe bcdedit.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe"C:\Users\Admin\AppData\Local\Temp\19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe"C:\Users\Admin\AppData\Local\Temp\19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe"2⤵PID:4176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 3963⤵
- Program crash
PID:4624 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
PID:4984 -
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:3384 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4420 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:3064 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:4692 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:3360
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:3304
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:4084
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:832 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3356 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:268 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1748 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:3392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4176 -ip 41761⤵PID:3940
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet1⤵
- Interacts with shadow copies
PID:1472
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3552
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4176-5-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4176-4-0x00000000007B0000-0x00000000008B0000-memory.dmpFilesize
1024KB
-
memory/4568-1-0x0000000000590000-0x0000000000690000-memory.dmpFilesize
1024KB
-
memory/4568-2-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4568-554-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4568-2220-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4568-4724-0x0000000000590000-0x0000000000690000-memory.dmpFilesize
1024KB
-
memory/4568-5095-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB