phobos | 41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
Size

56KB
MD5

dc2d809e46c60ee990844ee7fbdc17cd
SHA1

839ce9c0e3cab37d4de0b25460d9b0dc047bb2ae
SHA256

41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf
SHA512

0c3ddc1e5071a45b5c95165b655d1b0a1ba9538fd4066ec62a7904c60974671250b27634e29d35c08658936e3674683b990e3bbc81307ee5fbfce52a2df675c7
SSDEEP

1536:UNeRBl5PT/rx1mzwRMSTdLpJPQG9TY28U:UQRrmzwR5Jop28U

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

3648 bcdedit.exe
2572 bcdedit.exe
Renames multiple (350) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

268 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

1124 netsh.exe
1448 netsh.exe

pid	process
3648	bcdedit.exe
2572	bcdedit.exe

pid	process
268	wbadmin.exe

pid	process
1124	netsh.exe
1448	netsh.exe

Drops startup file 1 IoCs

Processes:

41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf = "C:\\Users\\Admin\\AppData\\Local\\41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe"	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf = "C:\\Users\\Admin\\AppData\\Local\\41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe"	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe

description	ioc	process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\desktop.ini	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe

Drops file in Program Files directory 64 IoCs

Processes:

41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationCore.resources.dll.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-math-l1-1-0.dll	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\VVIEWRES.DLL.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\THMBNAIL.PNG.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-processthreads-l1-1-1.dll	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\Microsoft.VisualBasic.Forms.resources.dll	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_EN.LEX	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Java\jre-1.8\lib\currency.data.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\SATIN.INF.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.MsoInterop.dll	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\Interceptor.tlb	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.UnmanagedMemoryStream.dll	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\WindowsFormsIntegration.dll.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcr120.dll	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Sockets.dll.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-string-l1-1-0.dll.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.resources.dll	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONFILTER.DLL	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\EXP_PDF.DLL.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Specialized.dll.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.Unsafe.dll	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationCore.resources.dll.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.id[6BADD495-3316].[[email protected]].mango	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

4708 vssadmin.exe

pid	process
4708	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe

pid	process
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeDebugPrivilege	2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
Token: SeBackupPrivilege	2628	vssvc.exe
Token: SeRestorePrivilege	2628	vssvc.exe
Token: SeAuditPrivilege	2628	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2476	WMIC.exe
Token: SeSecurityPrivilege	2476	WMIC.exe
Token: SeTakeOwnershipPrivilege	2476	WMIC.exe
Token: SeLoadDriverPrivilege	2476	WMIC.exe
Token: SeSystemProfilePrivilege	2476	WMIC.exe
Token: SeSystemtimePrivilege	2476	WMIC.exe
Token: SeProfSingleProcessPrivilege	2476	WMIC.exe
Token: SeIncBasePriorityPrivilege	2476	WMIC.exe
Token: SeCreatePagefilePrivilege	2476	WMIC.exe
Token: SeBackupPrivilege	2476	WMIC.exe
Token: SeRestorePrivilege	2476	WMIC.exe
Token: SeShutdownPrivilege	2476	WMIC.exe
Token: SeDebugPrivilege	2476	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2476	WMIC.exe
Token: SeRemoteShutdownPrivilege	2476	WMIC.exe
Token: SeUndockPrivilege	2476	WMIC.exe
Token: SeManageVolumePrivilege	2476	WMIC.exe
Token: 33	2476	WMIC.exe
Token: 34	2476	WMIC.exe
Token: 35	2476	WMIC.exe
Token: 36	2476	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2476	WMIC.exe
Token: SeSecurityPrivilege	2476	WMIC.exe
Token: SeTakeOwnershipPrivilege	2476	WMIC.exe
Token: SeLoadDriverPrivilege	2476	WMIC.exe
Token: SeSystemProfilePrivilege	2476	WMIC.exe
Token: SeSystemtimePrivilege	2476	WMIC.exe
Token: SeProfSingleProcessPrivilege	2476	WMIC.exe
Token: SeIncBasePriorityPrivilege	2476	WMIC.exe
Token: SeCreatePagefilePrivilege	2476	WMIC.exe
Token: SeBackupPrivilege	2476	WMIC.exe
Token: SeRestorePrivilege	2476	WMIC.exe
Token: SeShutdownPrivilege	2476	WMIC.exe
Token: SeDebugPrivilege	2476	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2476	WMIC.exe
Token: SeRemoteShutdownPrivilege	2476	WMIC.exe
Token: SeUndockPrivilege	2476	WMIC.exe
Token: SeManageVolumePrivilege	2476	WMIC.exe
Token: 33	2476	WMIC.exe
Token: 34	2476	WMIC.exe
Token: 35	2476	WMIC.exe
Token: 36	2476	WMIC.exe
Token: SeBackupPrivilege	4604	wbengine.exe
Token: SeRestorePrivilege	4604	wbengine.exe
Token: SeSecurityPrivilege	4604	wbengine.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.execmd.execmd.exe

description	pid	process	target process
PID 2084 wrote to memory of 5024	2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe	cmd.exe
PID 2084 wrote to memory of 3080	2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe	cmd.exe
PID 2084 wrote to memory of 5024	2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe	cmd.exe
PID 2084 wrote to memory of 3080	2084	41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe	cmd.exe
PID 3080 wrote to memory of 1124	3080	cmd.exe	netsh.exe
PID 3080 wrote to memory of 1124	3080	cmd.exe	netsh.exe
PID 5024 wrote to memory of 4708	5024	cmd.exe	vssadmin.exe
PID 5024 wrote to memory of 4708	5024	cmd.exe	vssadmin.exe
PID 3080 wrote to memory of 1448	3080	cmd.exe	netsh.exe
PID 3080 wrote to memory of 1448	3080	cmd.exe	netsh.exe
PID 5024 wrote to memory of 2476	5024	cmd.exe	WMIC.exe
PID 5024 wrote to memory of 2476	5024	cmd.exe	WMIC.exe
PID 5024 wrote to memory of 3648	5024	cmd.exe	bcdedit.exe
PID 5024 wrote to memory of 3648	5024	cmd.exe	bcdedit.exe
PID 5024 wrote to memory of 2572	5024	cmd.exe	bcdedit.exe
PID 5024 wrote to memory of 2572	5024	cmd.exe	bcdedit.exe
PID 5024 wrote to memory of 268	5024	cmd.exe	wbadmin.exe
PID 5024 wrote to memory of 268	5024	cmd.exe	wbadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
"C:\Users\Admin\AppData\Local\Temp\41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084

C:\Users\Admin\AppData\Local\Temp\41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe
"C:\Users\Admin\AppData\Local\Temp\41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf.exe"
2⤵
PID:2620

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3080

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
3⤵
- Modifies Windows Firewall
PID:1124

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
3⤵
- Modifies Windows Firewall
PID:1448

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:4708

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:3648

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:2572

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:700

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:648

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll
Filesize
65KB

MD5
e5f729728ef63949ee08cdb344e199a0

SHA1
39869fb44914a7aa172a48342d39dbdfbda4d65c

SHA256
ce89fdff60df750b5f78ae42df37b822cd79add907d2c2e604fd906bb5f85bd2

SHA512
5fe6ac63731b9ad38f2b23c3e9ec7a89f8624a24056cb251ce7e08d18687cdd23f17818892b4e1234121001689da2864a61fb239b1e40d0252554c3048f0d9a7

Download Submit
C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md
Filesize
2KB

MD5
ddc4cb14453391bcb5f4d645b2916a6c

SHA1
c4738d174c90c285e17bf51a9218256f45f96ea7

SHA256
0c19ba9eeecab3cbbdf38da08c3fa0266f10ce8166e056715931efc543335eeb

SHA512
34a32b92ffb2945608439653b5ecacba49fd3312ba5487ba14796c75b07655f0d8f735453dac117d46d204d3f810126f8a189f82c015fa8bb6ea37d9b8e0e30f

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Filesize
190B

MD5
c5b7a97bda04c48435a145f2d1f9bb42

SHA1
bd94219a79987af3e4d4ce45b07edc2230aaf655

SHA256
07ec9bf950252d0254d4d778698c2e4173f36dbc3f57f51f34d1b85a07c2eab0

SHA512
7eb1a26cf8ef725ba6d1934ca4802f70cc22539017334c1d7a6873afeea6236bcd643b52630f7fa9d8a9e692f718ba42cc704ed5f8df17757028be63c3efad80

Download Submit
C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif
Filesize
153B

MD5
d13b5ffdeb538f15ee1d30f2788601d5

SHA1
8dc4da8e4efca07472b08b618bc059dcbfd03efa

SHA256
f1663cceeb67ba35c5a5cbf58b56050ddbe5ec5680ea9e55837b57524f29b876

SHA512
58e6b66d1e6a9858e3b2ff1c90333d804d80a98dad358bb666b0332013c0c0c7444d9cb7297eff3aeee7de66d01b3b180629f1b5258af19165abd5e013574b46

Download Submit
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml
Filesize
744B

MD5
809457c05fe696f5d34ac5ac8768cdd4

SHA1
a2c3e4966415100c7d24f7f3dc7e27d2a60d20c9

SHA256
1b66520d471367f736d50c070a2e2bba8ad88ac58743394a764b888e9cb6f6be

SHA512
cf38e01d3e174ff4b8070fb88ead7e787143ce7cf60b91365fafd01cacc1420337654083a14dfb2caa900141a578717f5d24fa3cadd17c1a992d09280fd8dc44

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK
Filesize
114B

MD5
301657e2669b4c76979a15f801cc2adf

SHA1
f7430efc590e79b847ab97b6e429cd07ef886726

SHA256
802bbf1167e97e336bc7e1d1574466db744c7021efe0f0ff01ff7e352c44f56b

SHA512
e94480d20b6665599c4ed1bc3fc6949c9be332fd91a14cef14b3e263ab1000666e706b51869bc93b4f479bb6389351674e707e79562020510c1b6dfe4b90cc51

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK
Filesize
113B

MD5
b9205d5c0a413e022f6c36d4bdfa0750

SHA1
f16acd929b52b77b7dad02dbceff25992f4ba95e

SHA256
951b1c95584b91fd8776e1d26b25d745ad5d508f6337686b9f7131d7c2f7096a

SHA512
0e67910bcf0f9ccde5464c63b9c850a12a759227d16b040d98986d54253f9f34322318e56b8feb86c5fb2270ed87f31252f7f68493ee759743909bd75e4bb544

Download Submit
C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Filesize
1KB

MD5
3be680b6a8edfdeed37bf5068a37dccd

SHA1
75bc261fc558634731e683e431e4a31c5b463107

SHA256
1777e4f7955cb5900c97d92081efc4b11704ee3b265717a7d7152972b49a36c4

SHA512
a3c8a91689105a14c49b020826944d32540353c56fb9e9a011639ff5107d25e1d3466f0fc487ef953c6bbf0c006abc5204e3a8f0093e1c633013a547f8ecab21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db
Filesize
24B

MD5
1681ffc6e046c7af98c9e6c232a3fe0a

SHA1
d3399b7262fb56cb9ed053d68db9291c410839c4

SHA256
9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

SHA512
11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

Download Submit