Malware Analysis Report

2024-09-11 01:08

Sample ID 240228-mwkz5ahg7y
Target sYsB.bin
SHA256 c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e
Tags
phobos evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c6960bb3329175489959ec95de0a83a3bd5f206f8cd7f46633e34a0227973d0e

Threat Level: Known bad

The file sYsB.bin was found to be: Known bad.

Malicious Activity Summary

phobos evasion persistence ransomware spyware stealer

Phobos

Deletes shadow copies

Renames multiple (497) files with added filename extension

Renames multiple (317) files with added filename extension

Modifies boot configuration data using bcdedit

Modifies Windows Firewall

Deletes backup catalog

Reads user/profile data of web browsers

Checks computer location settings

Drops startup file

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Modifies registry class

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Interacts with shadow copies

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Impair Defenses
T1562
Disable or Modify System Firewall
T1562.004
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-02-28 10:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-28 10:48

Reported

2024-02-28 10:51

Platform

win7-20240221-en

Max time kernel

150s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sYsB.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (317) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\sYsB.exe C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\sYsB = "C:\\Users\\Admin\\AppData\\Local\\sYsB.exe" C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sYsB = "C:\\Users\\Admin\\AppData\\Local\\sYsB.exe" C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\GE3X1LT6\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LEIE6HVY\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\7GHXBWM1\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J66V1Z9V\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\J171AZTC\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CA.XML.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Java\jre7\lib\jsse.jar.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Microsoft Games\Hearts\Hearts.exe.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\INDUST.INF.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02567J.JPG C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01241_.GIF C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACT.CFG C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\mscss7es.dll.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis.css.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105386.WMF C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA000C.DLL.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\ROGERS.COM.XML C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Mozilla Firefox\update-settings.ini.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.151\psuser_64.dll.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GreenTea.css C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\Synchronization.dll.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\SPACER.GIF C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Detroit.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nl.txt C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107480.WMF.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE_COL.HXT.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\ENGIDX.DAT.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTOC.DPV.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MUAUTH.CAB C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01176_.WMF C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105502.WMF C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSClientManifest.man C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boise C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\DELETE.GIF.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\omni.ja.id[54589C54-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196364.WMF C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1528 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 1528 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 1528 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 1528 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 1528 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 1528 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 1528 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 1528 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 2704 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2704 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2704 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2580 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2580 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2580 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2580 wrote to memory of 1328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2580 wrote to memory of 1328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2580 wrote to memory of 1328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2704 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2704 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2704 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2704 wrote to memory of 1108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2704 wrote to memory of 1108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2704 wrote to memory of 1108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2704 wrote to memory of 2556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2704 wrote to memory of 2556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2704 wrote to memory of 2556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2704 wrote to memory of 2600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2704 wrote to memory of 2600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2704 wrote to memory of 2600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1528 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 1528 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 1528 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 1528 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 1528 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 2580 wrote to memory of 1820 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2580 wrote to memory of 1820 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2580 wrote to memory of 1820 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2580 wrote to memory of 2528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2580 wrote to memory of 2528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2580 wrote to memory of 2528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2580 wrote to memory of 1080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2580 wrote to memory of 1080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2580 wrote to memory of 1080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2580 wrote to memory of 2220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2580 wrote to memory of 2220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2580 wrote to memory of 2220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2580 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2580 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2580 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\sYsB.exe

"C:\Users\Admin\AppData\Local\Temp\sYsB.exe"

C:\Users\Admin\AppData\Local\Temp\sYsB.exe

"C:\Users\Admin\AppData\Local\Temp\sYsB.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[54589C54-3390].[[email protected]].fopra

MD5 fb537d5b755feb359af458b49932c2d6
SHA1 dd40ba3764ea83b523137c045e5ba7aa801cf31a
SHA256 a7b9b4774665d0742c5dd7683ac80ef8f2dd3fef0f94013a18709b3e4def34a3
SHA512 0fe38daa0fc152ddf4c832a92506790149ac5b78455bc242b07e09b0529121770614b3c84d4b69b9ec8f8f80f33db98435df23c7cc7684ef670381e4a7370cd0

C:\info.hta

MD5 8f44d6d8fca8276a903fdce381cc0270
SHA1 7ac886a77e788387c0981fd5dd4543fabc890497
SHA256 6b86389b176135e981a163018652a38373832cf7487e1d76dfa6e7ccfde2493e
SHA512 13586afbdf37a8846f85f44271b751491e18e5e842aed3683fcdb2c55fee0b4260dd6eca156274fdc6a0d4f7d70753a2c136f5373a37c8866d137e50e453f0cb

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-28 10:48

Reported

2024-02-28 10:51

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sYsB.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (497) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\sYsB.exe C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sYsB = "C:\\Users\\Admin\\AppData\\Local\\sYsB.exe" C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sYsB = "C:\\Users\\Admin\\AppData\\Local\\sYsB.exe" C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-983155329-280873152-1838004294-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-983155329-280873152-1838004294-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Windows Media Player\Skins\Revert.wmz C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLike.Tests.ps1 C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebSockets.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.boot.tree.dat.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\uk-ua\ui-strings.js.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ro.pak.DATA C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\LargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\163.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-150.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\zh-TW.pak.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\nexturl.ort.DATA C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected][D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailWideTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-errorhandling-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-30.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_eu.dll.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-colorize.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACECORE.DLL.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare150x150Logo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_NinjaCat.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_contrast-white.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\SensorFusionLib.winmd C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationUI.resources.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SegXbox2.ttf C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\ui-strings.js.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libcrypto-1_1-x64.dll.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-32_contrast-black.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\WindowsBase.dll.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\framework-dev.js C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\es-es\ui-strings.js.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_nl.dll.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses-hover.svg.id[D1EAC564-3390].[[email protected]].fopra C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2888 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 2888 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 2888 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 2888 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 832 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 832 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 932 wrote to memory of 5112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 932 wrote to memory of 5112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 832 wrote to memory of 2824 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 832 wrote to memory of 2824 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 932 wrote to memory of 4996 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 932 wrote to memory of 4996 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 932 wrote to memory of 3532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 932 wrote to memory of 3532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 932 wrote to memory of 1840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 932 wrote to memory of 1840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 932 wrote to memory of 4864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 932 wrote to memory of 4864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2888 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\SysWOW64\mshta.exe
PID 2888 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 2888 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\sYsB.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4236 wrote to memory of 3956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4236 wrote to memory of 3704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4236 wrote to memory of 3704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4236 wrote to memory of 1768 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4236 wrote to memory of 1768 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4236 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4236 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4236 wrote to memory of 2872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4236 wrote to memory of 2872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\sYsB.exe

"C:\Users\Admin\AppData\Local\Temp\sYsB.exe"

C:\Users\Admin\AppData\Local\Temp\sYsB.exe

"C:\Users\Admin\AppData\Local\Temp\sYsB.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 189.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 21.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp

Files

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[D1EAC564-3390].[[email protected]].fopra

MD5 7e609959785c1031d67dedcde3dbff3c
SHA1 ebef09cb7afdbc5074f743cf6e379648f5165bdb
SHA256 a9a04c0b16339e05fad6714ff5e41d345ea03ec39c11f40fbd59b16880f1cb45
SHA512 244a28317731a2f89d395d4eb4d32bcc0bc281f926ef6a02c01e4352efa715ea18345f92a72cfd61520754e371143943da53185d7cec908da8cef1d61abae03d

C:\info.hta

MD5 9922a7e54476b91fc06708f1cc4cf5eb
SHA1 0fa3554c254e09fc651fce18f3d73b7d753479a5
SHA256 3b30929ba7a2ffa21c7f74671ad276011500001b3b493d566acb884a92c3faa4
SHA512 f7eb8331ea3da5cc06b88aec2dfd9916da36b3ba778f627124bdedd728b2b74af2b8c9e968e67e178d28c21b0bd63d1083f42eb29469d85a553a1d01ab7fd592