phobos | f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd

General

Target

f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
Size

55KB
MD5

88389a265bd9b1e9c59fb7053cf45b07
SHA1

900b980b7ef5bbbc6a255cffd66900fb68802c25
SHA256

f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd
SHA512

da2ebf446db76590834e3b8e828e3895e0febdfa0ee34627b5c6c18cc10ccb85b83dd0410789845c980984eb1021a6c7050ebf1cbfd04e1ce904e0e40113e932
SSDEEP

1536:ENeRBl5PT/rx1mzwRMSTdLpJMGl5dPZjlkWBFj:EQRrmzwR5J1VPZiW

Score

10^/10

phobos evasion persistence ransomware

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

1036 bcdedit.exe
672 bcdedit.exe
2712 bcdedit.exe
324 bcdedit.exe
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

1904 wbadmin.exe
1112 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

2820 netsh.exe
2152 netsh.exe

pid	process
1036	bcdedit.exe
672	bcdedit.exe
2712	bcdedit.exe
324	bcdedit.exe

pid	process
1904	wbadmin.exe
1112	wbadmin.exe

pid	process
2820	netsh.exe
2152	netsh.exe

Drops startup file 1 IoCs

Processes:

f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd = "C:\\Users\\Admin\\AppData\\Local\\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe"	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd = "C:\\Users\\Admin\\AppData\\Local\\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe"	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3470981204-343661084-3367201002-1000\desktop.ini	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3470981204-343661084-3367201002-1000\desktop.ini	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

Drops file in Program Files directory 64 IoCs

Processes:

f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\7z.exe.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\7-zip.chm.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.id[F644D092-3232].[[email protected]].eking	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

2584 vssadmin.exe
1052 vssadmin.exe

pid	process
2584	vssadmin.exe
1052	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

pid	process
2724	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
2724	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

description pid process

Token: SeDebugPrivilege 2724 f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

description	pid	process
Token: SeDebugPrivilege	2724	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.execmd.execmd.exe

description	pid	process	target process
PID 2724 wrote to memory of 2356	2724	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe	cmd.exe
PID 2724 wrote to memory of 2356	2724	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe	cmd.exe
PID 2724 wrote to memory of 2356	2724	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe	cmd.exe
PID 2724 wrote to memory of 2356	2724	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe	cmd.exe
PID 2724 wrote to memory of 2920	2724	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe	cmd.exe
PID 2724 wrote to memory of 2920	2724	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe	cmd.exe
PID 2724 wrote to memory of 2920	2724	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe	cmd.exe
PID 2724 wrote to memory of 2920	2724	f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe	cmd.exe
PID 2356 wrote to memory of 2820	2356	cmd.exe	netsh.exe
PID 2356 wrote to memory of 2820	2356	cmd.exe	netsh.exe
PID 2356 wrote to memory of 2820	2356	cmd.exe	netsh.exe
PID 2920 wrote to memory of 2584	2920	cmd.exe	vssadmin.exe
PID 2920 wrote to memory of 2584	2920	cmd.exe	vssadmin.exe
PID 2920 wrote to memory of 2584	2920	cmd.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
"C:\Users\Admin\AppData\Local\Temp\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724

C:\Users\Admin\AppData\Local\Temp\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe
"C:\Users\Admin\AppData\Local\Temp\f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd.exe"
2⤵
PID:2300

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2920

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
PID:2260

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:1904

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:1036

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:672

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2356

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
3⤵
- Modifies Windows Firewall
PID:2152

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"
2⤵
PID:1360

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"
2⤵
PID:2884

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
PID:2228

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"
2⤵
PID:1172

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"
2⤵
PID:2260

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
1⤵
- Interacts with shadow copies
PID:2584

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
1⤵
- Modifies Windows Firewall
PID:2820

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1472

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1696

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2632

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
1⤵
- Interacts with shadow copies
PID:1052

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
1⤵
PID:392

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
1⤵
- Deletes backup catalog
PID:1112

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
1⤵
- Modifies boot configuration data using bcdedit
PID:2712

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Modifies boot configuration data using bcdedit
PID:324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Indicator Removal

3

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

4

T1490

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads