phobos | e67b8937b56c354ff06e857361f8860860f913a63f79427cf37db741ffcb02a1

Resubmissions

26-02-2024 17:00

240226-vh9ekabb89 10

26-02-2024 14:38

240226-rz6s8age24 10

26-02-2024 14:15

240226-rkxa8sga28 10

26-02-2024 13:00

240226-p82vhseb99 10

Analysis

max time kernel
158s
max time network
170s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
26-02-2024 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ST.exe
Size

56KB
MD5

1829b29bd700013b213b66ae95592845
SHA1

07c1535e947419ece58a3f27dfef52c8e4da01ff
SHA256

e67b8937b56c354ff06e857361f8860860f913a63f79427cf37db741ffcb02a1
SHA512

a9d4eba671ba80f6c5ebc002dd26b3ad482f73540303fa3feb0f46575c4de63bc532026ddae27e94bb610581c174d9d1b728e05d38fb193b6c800c238c2329a5
SSDEEP

1536:QNeRBl5PT/rx1mzwRMSTdLpJcOS9XtH1r4h:QQRrmzwR5JNSvH4

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1784 bcdedit.exe
2068 bcdedit.exe
Renames multiple (213) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

3456 wbadmin.exe
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

3600 netsh.exe
4744 netsh.exe
Drops startup file 1 IoCs

Processes:

ST.exe

description ioc process

File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\ST.exe ST.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1784	bcdedit.exe
2068	bcdedit.exe

pid	process
3456	wbadmin.exe

pid	process
3600	netsh.exe
4744	netsh.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\ST.exe	ST.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ST.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ST = "C:\\Users\\Admin\\AppData\\Local\\ST.exe"	ST.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160263616-143223877-1356318919-1000\Software\Microsoft\Windows\CurrentVersion\Run\ST = "C:\\Users\\Admin\\AppData\\Local\\ST.exe"	ST.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

ST.exe

description	ioc	process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-160263616-143223877-1356318919-1000\desktop.ini	ST.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-160263616-143223877-1356318919-1000\desktop.ini	ST.exe
File opened for modification	C:\Program Files\desktop.ini	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	ST.exe

Drops file in Program Files directory 64 IoCs

Processes:

ST.exe

description	ioc	process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Extensions.dll	ST.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\Microsoft.VisualBasic.Forms.resources.dll.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Microsoft.VisualBasic.Forms.resources.dll	ST.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationFramework.resources.dll.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms	ST.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\PresentationCore.resources.dll.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll	ST.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxbgt.dll	ST.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Extensions.dll	ST.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png	ST.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Xml.Linq.dll	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms	ST.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected][85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationTypes.resources.dll	ST.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	ST.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts	ST.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms	ST.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak	ST.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf	ST.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar	ST.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Royale.dll	ST.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr	ST.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationCore.resources.dll	ST.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Concurrent.dll	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML	ST.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe	ST.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceProcess.dll	ST.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT	ST.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Controls.Ribbon.dll	ST.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms	ST.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\WindowsBase.resources.dll.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md	ST.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\WindowsFormsIntegration.resources.dll	ST.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.id[85B5A3E2-2451].[[email protected]].calix	ST.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms	ST.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll	ST.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2628 vssadmin.exe

pid	process
2628	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ST.exe

pid	process
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe
2444	ST.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

ST.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeDebugPrivilege	2444	ST.exe
Token: SeBackupPrivilege	1388	vssvc.exe
Token: SeRestorePrivilege	1388	vssvc.exe
Token: SeAuditPrivilege	1388	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2492	WMIC.exe
Token: SeSecurityPrivilege	2492	WMIC.exe
Token: SeTakeOwnershipPrivilege	2492	WMIC.exe
Token: SeLoadDriverPrivilege	2492	WMIC.exe
Token: SeSystemProfilePrivilege	2492	WMIC.exe
Token: SeSystemtimePrivilege	2492	WMIC.exe
Token: SeProfSingleProcessPrivilege	2492	WMIC.exe
Token: SeIncBasePriorityPrivilege	2492	WMIC.exe
Token: SeCreatePagefilePrivilege	2492	WMIC.exe
Token: SeBackupPrivilege	2492	WMIC.exe
Token: SeRestorePrivilege	2492	WMIC.exe
Token: SeShutdownPrivilege	2492	WMIC.exe
Token: SeDebugPrivilege	2492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2492	WMIC.exe
Token: SeRemoteShutdownPrivilege	2492	WMIC.exe
Token: SeUndockPrivilege	2492	WMIC.exe
Token: SeManageVolumePrivilege	2492	WMIC.exe
Token: 33	2492	WMIC.exe
Token: 34	2492	WMIC.exe
Token: 35	2492	WMIC.exe
Token: 36	2492	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2492	WMIC.exe
Token: SeSecurityPrivilege	2492	WMIC.exe
Token: SeTakeOwnershipPrivilege	2492	WMIC.exe
Token: SeLoadDriverPrivilege	2492	WMIC.exe
Token: SeSystemProfilePrivilege	2492	WMIC.exe
Token: SeSystemtimePrivilege	2492	WMIC.exe
Token: SeProfSingleProcessPrivilege	2492	WMIC.exe
Token: SeIncBasePriorityPrivilege	2492	WMIC.exe
Token: SeCreatePagefilePrivilege	2492	WMIC.exe
Token: SeBackupPrivilege	2492	WMIC.exe
Token: SeRestorePrivilege	2492	WMIC.exe
Token: SeShutdownPrivilege	2492	WMIC.exe
Token: SeDebugPrivilege	2492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2492	WMIC.exe
Token: SeRemoteShutdownPrivilege	2492	WMIC.exe
Token: SeUndockPrivilege	2492	WMIC.exe
Token: SeManageVolumePrivilege	2492	WMIC.exe
Token: 33	2492	WMIC.exe
Token: 34	2492	WMIC.exe
Token: 35	2492	WMIC.exe
Token: 36	2492	WMIC.exe
Token: SeBackupPrivilege	1404	wbengine.exe
Token: SeRestorePrivilege	1404	wbengine.exe
Token: SeSecurityPrivilege	1404	wbengine.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

ST.execmd.execmd.exe

description	pid	process	target process
PID 2444 wrote to memory of 2736	2444	ST.exe	cmd.exe
PID 2444 wrote to memory of 2736	2444	ST.exe	cmd.exe
PID 2444 wrote to memory of 1256	2444	ST.exe	cmd.exe
PID 2444 wrote to memory of 1256	2444	ST.exe	cmd.exe
PID 2736 wrote to memory of 3600	2736	cmd.exe	netsh.exe
PID 2736 wrote to memory of 3600	2736	cmd.exe	netsh.exe
PID 1256 wrote to memory of 2628	1256	cmd.exe	vssadmin.exe
PID 1256 wrote to memory of 2628	1256	cmd.exe	vssadmin.exe
PID 2736 wrote to memory of 4744	2736	cmd.exe	netsh.exe
PID 2736 wrote to memory of 4744	2736	cmd.exe	netsh.exe
PID 1256 wrote to memory of 2492	1256	cmd.exe	WMIC.exe
PID 1256 wrote to memory of 2492	1256	cmd.exe	WMIC.exe
PID 1256 wrote to memory of 1784	1256	cmd.exe	bcdedit.exe
PID 1256 wrote to memory of 1784	1256	cmd.exe	bcdedit.exe
PID 1256 wrote to memory of 2068	1256	cmd.exe	bcdedit.exe
PID 1256 wrote to memory of 2068	1256	cmd.exe	bcdedit.exe
PID 1256 wrote to memory of 3456	1256	cmd.exe	wbadmin.exe
PID 1256 wrote to memory of 3456	1256	cmd.exe	wbadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ST.exe
"C:\Users\Admin\AppData\Local\Temp\ST.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444

C:\Users\Admin\AppData\Local\Temp\ST.exe
"C:\Users\Admin\AppData\Local\Temp\ST.exe"
2⤵
PID:972

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
3⤵
- Modifies Windows Firewall
PID:3600

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
3⤵
- Modifies Windows Firewall
PID:4744

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:2628

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:1784

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:2068

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:3456

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2148

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4788

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll
Filesize
65KB

MD5
e5f729728ef63949ee08cdb344e199a0

SHA1
39869fb44914a7aa172a48342d39dbdfbda4d65c

SHA256
ce89fdff60df750b5f78ae42df37b822cd79add907d2c2e604fd906bb5f85bd2

SHA512
5fe6ac63731b9ad38f2b23c3e9ec7a89f8624a24056cb251ce7e08d18687cdd23f17818892b4e1234121001689da2864a61fb239b1e40d0252554c3048f0d9a7

Download Submit
C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md
Filesize
2KB

MD5
ddc4cb14453391bcb5f4d645b2916a6c

SHA1
c4738d174c90c285e17bf51a9218256f45f96ea7

SHA256
0c19ba9eeecab3cbbdf38da08c3fa0266f10ce8166e056715931efc543335eeb

SHA512
34a32b92ffb2945608439653b5ecacba49fd3312ba5487ba14796c75b07655f0d8f735453dac117d46d204d3f810126f8a189f82c015fa8bb6ea37d9b8e0e30f

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Filesize
190B

MD5
c5b7a97bda04c48435a145f2d1f9bb42

SHA1
bd94219a79987af3e4d4ce45b07edc2230aaf655

SHA256
07ec9bf950252d0254d4d778698c2e4173f36dbc3f57f51f34d1b85a07c2eab0

SHA512
7eb1a26cf8ef725ba6d1934ca4802f70cc22539017334c1d7a6873afeea6236bcd643b52630f7fa9d8a9e692f718ba42cc704ed5f8df17757028be63c3efad80

Download Submit
C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif
Filesize
153B

MD5
d13b5ffdeb538f15ee1d30f2788601d5

SHA1
8dc4da8e4efca07472b08b618bc059dcbfd03efa

SHA256
f1663cceeb67ba35c5a5cbf58b56050ddbe5ec5680ea9e55837b57524f29b876

SHA512
58e6b66d1e6a9858e3b2ff1c90333d804d80a98dad358bb666b0332013c0c0c7444d9cb7297eff3aeee7de66d01b3b180629f1b5258af19165abd5e013574b46

Download Submit
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml
Filesize
744B

MD5
809457c05fe696f5d34ac5ac8768cdd4

SHA1
a2c3e4966415100c7d24f7f3dc7e27d2a60d20c9

SHA256
1b66520d471367f736d50c070a2e2bba8ad88ac58743394a764b888e9cb6f6be

SHA512
cf38e01d3e174ff4b8070fb88ead7e787143ce7cf60b91365fafd01cacc1420337654083a14dfb2caa900141a578717f5d24fa3cadd17c1a992d09280fd8dc44

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK
Filesize
114B

MD5
301657e2669b4c76979a15f801cc2adf

SHA1
f7430efc590e79b847ab97b6e429cd07ef886726

SHA256
802bbf1167e97e336bc7e1d1574466db744c7021efe0f0ff01ff7e352c44f56b

SHA512
e94480d20b6665599c4ed1bc3fc6949c9be332fd91a14cef14b3e263ab1000666e706b51869bc93b4f479bb6389351674e707e79562020510c1b6dfe4b90cc51

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK
Filesize
113B

MD5
b9205d5c0a413e022f6c36d4bdfa0750

SHA1
f16acd929b52b77b7dad02dbceff25992f4ba95e

SHA256
951b1c95584b91fd8776e1d26b25d745ad5d508f6337686b9f7131d7c2f7096a

SHA512
0e67910bcf0f9ccde5464c63b9c850a12a759227d16b040d98986d54253f9f34322318e56b8feb86c5fb2270ed87f31252f7f68493ee759743909bd75e4bb544

Download Submit
C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Filesize
1KB

MD5
3be680b6a8edfdeed37bf5068a37dccd

SHA1
75bc261fc558634731e683e431e4a31c5b463107

SHA256
1777e4f7955cb5900c97d92081efc4b11704ee3b265717a7d7152972b49a36c4

SHA512
a3c8a91689105a14c49b020826944d32540353c56fb9e9a011639ff5107d25e1d3466f0fc487ef953c6bbf0c006abc5204e3a8f0093e1c633013a547f8ecab21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db
Filesize
24B

MD5
1681ffc6e046c7af98c9e6c232a3fe0a

SHA1
d3399b7262fb56cb9ed053d68db9291c410839c4

SHA256
9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

SHA512
11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

Download Submit