Analysis
-
max time kernel
163s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 21:18
Static task
static1
Behavioral task
behavioral1
Sample
a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a.exe
Resource
win10v2004-20240226-en
General
-
Target
a.exe
-
Size
56KB
-
MD5
62885d0f106569fac3985f72f0ca10cb
-
SHA1
cb37b10b209ab38477d2e17f21cae12a1cb2adf0
-
SHA256
58626a9bfb48cd30acd0d95debcaefd188ae794e1e0072c5bde8adae9bccafa6
-
SHA512
1fdd982323e314b97dc4b6878f92e965aeefee9f89203c4ca944e8e540d5a990dcb5cbfb5455794e1ef3ad3e7d990e20b12af70f3310b1ff92c8402c43275c2a
-
SSDEEP
1536:sNeRBl5PT/rx1mzwRMSTdLpJNr+eiukbsSw:sQRrmzwR5JViums
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 296 bcdedit.exe 3416 bcdedit.exe -
Renames multiple (498) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exepid process 2140 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2204 netsh.exe 3384 netsh.exe -
Drops startup file 3 IoCs
Processes:
a.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\a.exe a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a = "C:\\Users\\Admin\\AppData\\Local\\a.exe" a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a = "C:\\Users\\Admin\\AppData\\Local\\a.exe" a.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
a.exedescription ioc process File opened for modification C:\Users\Admin\Contacts\desktop.ini a.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini a.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini a.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini a.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini a.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini a.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini a.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3045580317-3728985860-206385570-1000\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini a.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini a.exe File opened for modification C:\Users\Public\Pictures\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini a.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini a.exe File opened for modification C:\Users\Admin\Music\desktop.ini a.exe File opened for modification C:\Users\Admin\Searches\desktop.ini a.exe File opened for modification C:\Users\Public\Libraries\desktop.ini a.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini a.exe File opened for modification C:\Users\Admin\Videos\desktop.ini a.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini a.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini a.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini a.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini a.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini a.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini a.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini a.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini a.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini a.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini a.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini a.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini a.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini a.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini a.exe File opened for modification C:\Users\Public\Documents\desktop.ini a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI a.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini a.exe File opened for modification C:\Users\Admin\Links\desktop.ini a.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini a.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3045580317-3728985860-206385570-1000\desktop.ini a.exe File opened for modification C:\Users\Admin\Documents\desktop.ini a.exe File opened for modification C:\Program Files\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini a.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini a.exe File opened for modification C:\Users\Public\Videos\desktop.ini a.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini a.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini a.exe File opened for modification C:\Users\Public\Downloads\desktop.ini a.exe File opened for modification C:\Users\Public\Music\desktop.ini a.exe File opened for modification C:\Program Files (x86)\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini a.exe -
Drops file in Program Files directory 64 IoCs
Processes:
a.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-3045580317-3728985860-206385570-1000-MergedResources-0.pri a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\MedTile.scale-125.png a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-32_altform-unplated.png a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\vcruntime140_cor3.dll.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\ui-strings.js a.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.FileUtils.dll.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File created C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.tree.dat.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SmallTile.scale-125_contrast-white.png a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-100_contrast-high.png a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\logo_retina.png a.exe File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\mpvis.dll.mui a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-150_contrast-black.png a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_scale-100.png a.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\PackageManagementDscUtilities.strings.psd1.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jscripts\winrthost.js a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-200_contrast-black.png a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\de-DE.mail.config a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-16_altform-lightunplated.png a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-200.png a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\EmptyStoryCover.png a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-40_altform-unplated.png a.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\WindowsFormsIntegration.resources.dll a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-30.png a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lt_get.svg a.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalSplashScreen.scale-200.png a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-unplated.png a.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-32_altform-unplated.png a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-200.png a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\ui-strings.js a.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll a.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll a.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_kn.dll a.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-125_contrast-white.png a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\hxoutlookintl.dll a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-lightunplated_devicefamily-colorfulunplated.png a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24_altform-fullcolor.png a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-64.png a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Private.DataContractSerialization.dll a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\GlassVertexShader.cso a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\s_thumbnailview_18.svg a.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\lcms.dll a.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSYH.TTC.id[6EDB2AA7-3398].[[email protected]].Elbie a.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vds.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2836 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a.exepid process 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe 2644 a.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
a.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeDebugPrivilege 2644 a.exe Token: SeBackupPrivilege 3508 vssvc.exe Token: SeRestorePrivilege 3508 vssvc.exe Token: SeAuditPrivilege 3508 vssvc.exe Token: SeIncreaseQuotaPrivilege 1140 WMIC.exe Token: SeSecurityPrivilege 1140 WMIC.exe Token: SeTakeOwnershipPrivilege 1140 WMIC.exe Token: SeLoadDriverPrivilege 1140 WMIC.exe Token: SeSystemProfilePrivilege 1140 WMIC.exe Token: SeSystemtimePrivilege 1140 WMIC.exe Token: SeProfSingleProcessPrivilege 1140 WMIC.exe Token: SeIncBasePriorityPrivilege 1140 WMIC.exe Token: SeCreatePagefilePrivilege 1140 WMIC.exe Token: SeBackupPrivilege 1140 WMIC.exe Token: SeRestorePrivilege 1140 WMIC.exe Token: SeShutdownPrivilege 1140 WMIC.exe Token: SeDebugPrivilege 1140 WMIC.exe Token: SeSystemEnvironmentPrivilege 1140 WMIC.exe Token: SeRemoteShutdownPrivilege 1140 WMIC.exe Token: SeUndockPrivilege 1140 WMIC.exe Token: SeManageVolumePrivilege 1140 WMIC.exe Token: 33 1140 WMIC.exe Token: 34 1140 WMIC.exe Token: 35 1140 WMIC.exe Token: 36 1140 WMIC.exe Token: SeIncreaseQuotaPrivilege 1140 WMIC.exe Token: SeSecurityPrivilege 1140 WMIC.exe Token: SeTakeOwnershipPrivilege 1140 WMIC.exe Token: SeLoadDriverPrivilege 1140 WMIC.exe Token: SeSystemProfilePrivilege 1140 WMIC.exe Token: SeSystemtimePrivilege 1140 WMIC.exe Token: SeProfSingleProcessPrivilege 1140 WMIC.exe Token: SeIncBasePriorityPrivilege 1140 WMIC.exe Token: SeCreatePagefilePrivilege 1140 WMIC.exe Token: SeBackupPrivilege 1140 WMIC.exe Token: SeRestorePrivilege 1140 WMIC.exe Token: SeShutdownPrivilege 1140 WMIC.exe Token: SeDebugPrivilege 1140 WMIC.exe Token: SeSystemEnvironmentPrivilege 1140 WMIC.exe Token: SeRemoteShutdownPrivilege 1140 WMIC.exe Token: SeUndockPrivilege 1140 WMIC.exe Token: SeManageVolumePrivilege 1140 WMIC.exe Token: 33 1140 WMIC.exe Token: 34 1140 WMIC.exe Token: 35 1140 WMIC.exe Token: 36 1140 WMIC.exe Token: SeBackupPrivilege 3712 wbengine.exe Token: SeRestorePrivilege 3712 wbengine.exe Token: SeSecurityPrivilege 3712 wbengine.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
a.execmd.execmd.exedescription pid process target process PID 2644 wrote to memory of 3244 2644 a.exe cmd.exe PID 2644 wrote to memory of 3244 2644 a.exe cmd.exe PID 2644 wrote to memory of 1580 2644 a.exe cmd.exe PID 2644 wrote to memory of 1580 2644 a.exe cmd.exe PID 3244 wrote to memory of 2836 3244 cmd.exe vssadmin.exe PID 3244 wrote to memory of 2836 3244 cmd.exe vssadmin.exe PID 1580 wrote to memory of 2204 1580 cmd.exe netsh.exe PID 1580 wrote to memory of 2204 1580 cmd.exe netsh.exe PID 1580 wrote to memory of 3384 1580 cmd.exe netsh.exe PID 1580 wrote to memory of 3384 1580 cmd.exe netsh.exe PID 3244 wrote to memory of 1140 3244 cmd.exe WMIC.exe PID 3244 wrote to memory of 1140 3244 cmd.exe WMIC.exe PID 3244 wrote to memory of 296 3244 cmd.exe bcdedit.exe PID 3244 wrote to memory of 296 3244 cmd.exe bcdedit.exe PID 3244 wrote to memory of 3416 3244 cmd.exe bcdedit.exe PID 3244 wrote to memory of 3416 3244 cmd.exe bcdedit.exe PID 3244 wrote to memory of 2140 3244 cmd.exe wbadmin.exe PID 3244 wrote to memory of 2140 3244 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a.exe"C:\Users\Admin\AppData\Local\Temp\a.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a.exe"C:\Users\Admin\AppData\Local\Temp\a.exe"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
3File Deletion
3Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[6EDB2AA7-3398].[[email protected]].ElbieFilesize
1.1MB
MD532efb74dd0fa5acc04d4ac2a472aee98
SHA1fcc721487a83dbe2d6c2264cf2d00f412b10a9b9
SHA256b89dae417ddbd36871bc496407239567e4e0bd4acc67510d6df163f06143cf9b
SHA512a17d3686269b8c287f2fabb8276e765fd63f816c9d97c9845c97f237ea3bd876ddfdc8fc148955922a972993d4e0281b6dc404bc91efb0baec6d7949bd6b8776