Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe
-
Size
58KB
-
MD5
dc1950a269859406fc05fd6be6024fdf
-
SHA1
09eb03dc78d40523fcf34bca236f1e6359b32980
-
SHA256
2276fe3cc324c9e053eea9839874963a27f312dcf01b97d298e5d326a7c12b87
-
SHA512
e4be1afa8ee252b62dba7a847fcb39847545e0086a351565f8c3790cca723e4733954155177b8778ecec87df3e8992b70032cae620a509a509aaec78f392e3e1
-
SSDEEP
1536:oNeRBl5PT/rx1mzwRMSTdLpJITsZiZAqB9DjylN5Al:oQRrmzwR5JtgjOUl
Malware Config
Extracted
C:\info.hta
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1764 bcdedit.exe 1800 bcdedit.exe 1716 bcdedit.exe 1564 bcdedit.exe -
Renames multiple (312) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2204 wbadmin.exe 2896 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2860 netsh.exe 1800 netsh.exe -
Drops startup file 3 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe" 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe" 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Public\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MRWZP5ZY\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y3HLRHFA\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5B8DS9TT\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZKWCFGN8\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3DCZZ4GN\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z9MW37VJ\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nome.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237225.WMF 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCARD.XML 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\7-Zip\Lang\ext.txt.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\TAB_ON.GIF.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Windows Mail\ja-JP\msoeres.dll.mui 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\LoginForm.zip 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0102002.WMF.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21482_.GIF 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\validation.js 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Process Library.fdt.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\Java\jre7\lib\zi\America\Chicago.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01247U.BMP 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\TAB_OFF.GIF 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47B.GIF.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\RTF_BOLD.GIF 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\slideShow.css 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Apothecary.eftx 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\ExitRename.xps.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01468_.WMF 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPM.CFG.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\INVITE11.POC.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CERT98.POC.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d11_plugin.dll.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.EPS.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_el.dll.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART14.BDR.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217302.WMF.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.id[6797CDE4-3536].[[email protected]].dzen 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341447.JPG 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2504 vssadmin.exe 2932 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe Token: SeBackupPrivilege 2444 vssvc.exe Token: SeRestorePrivilege 2444 vssvc.exe Token: SeAuditPrivilege 2444 vssvc.exe Token: SeIncreaseQuotaPrivilege 1964 WMIC.exe Token: SeSecurityPrivilege 1964 WMIC.exe Token: SeTakeOwnershipPrivilege 1964 WMIC.exe Token: SeLoadDriverPrivilege 1964 WMIC.exe Token: SeSystemProfilePrivilege 1964 WMIC.exe Token: SeSystemtimePrivilege 1964 WMIC.exe Token: SeProfSingleProcessPrivilege 1964 WMIC.exe Token: SeIncBasePriorityPrivilege 1964 WMIC.exe Token: SeCreatePagefilePrivilege 1964 WMIC.exe Token: SeBackupPrivilege 1964 WMIC.exe Token: SeRestorePrivilege 1964 WMIC.exe Token: SeShutdownPrivilege 1964 WMIC.exe Token: SeDebugPrivilege 1964 WMIC.exe Token: SeSystemEnvironmentPrivilege 1964 WMIC.exe Token: SeRemoteShutdownPrivilege 1964 WMIC.exe Token: SeUndockPrivilege 1964 WMIC.exe Token: SeManageVolumePrivilege 1964 WMIC.exe Token: 33 1964 WMIC.exe Token: 34 1964 WMIC.exe Token: 35 1964 WMIC.exe Token: SeIncreaseQuotaPrivilege 1964 WMIC.exe Token: SeSecurityPrivilege 1964 WMIC.exe Token: SeTakeOwnershipPrivilege 1964 WMIC.exe Token: SeLoadDriverPrivilege 1964 WMIC.exe Token: SeSystemProfilePrivilege 1964 WMIC.exe Token: SeSystemtimePrivilege 1964 WMIC.exe Token: SeProfSingleProcessPrivilege 1964 WMIC.exe Token: SeIncBasePriorityPrivilege 1964 WMIC.exe Token: SeCreatePagefilePrivilege 1964 WMIC.exe Token: SeBackupPrivilege 1964 WMIC.exe Token: SeRestorePrivilege 1964 WMIC.exe Token: SeShutdownPrivilege 1964 WMIC.exe Token: SeDebugPrivilege 1964 WMIC.exe Token: SeSystemEnvironmentPrivilege 1964 WMIC.exe Token: SeRemoteShutdownPrivilege 1964 WMIC.exe Token: SeUndockPrivilege 1964 WMIC.exe Token: SeManageVolumePrivilege 1964 WMIC.exe Token: 33 1964 WMIC.exe Token: 34 1964 WMIC.exe Token: 35 1964 WMIC.exe Token: SeBackupPrivilege 2868 wbengine.exe Token: SeRestorePrivilege 2868 wbengine.exe Token: SeSecurityPrivilege 2868 wbengine.exe Token: SeIncreaseQuotaPrivilege 1360 WMIC.exe Token: SeSecurityPrivilege 1360 WMIC.exe Token: SeTakeOwnershipPrivilege 1360 WMIC.exe Token: SeLoadDriverPrivilege 1360 WMIC.exe Token: SeSystemProfilePrivilege 1360 WMIC.exe Token: SeSystemtimePrivilege 1360 WMIC.exe Token: SeProfSingleProcessPrivilege 1360 WMIC.exe Token: SeIncBasePriorityPrivilege 1360 WMIC.exe Token: SeCreatePagefilePrivilege 1360 WMIC.exe Token: SeBackupPrivilege 1360 WMIC.exe Token: SeRestorePrivilege 1360 WMIC.exe Token: SeShutdownPrivilege 1360 WMIC.exe Token: SeDebugPrivilege 1360 WMIC.exe Token: SeSystemEnvironmentPrivilege 1360 WMIC.exe Token: SeRemoteShutdownPrivilege 1360 WMIC.exe Token: SeUndockPrivilege 1360 WMIC.exe Token: SeManageVolumePrivilege 1360 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2936 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 29 PID 2176 wrote to memory of 2936 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 29 PID 2176 wrote to memory of 2936 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 29 PID 2176 wrote to memory of 2936 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 29 PID 2176 wrote to memory of 1172 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 30 PID 2176 wrote to memory of 1172 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 30 PID 2176 wrote to memory of 1172 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 30 PID 2176 wrote to memory of 1172 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 30 PID 1172 wrote to memory of 2504 1172 cmd.exe 33 PID 1172 wrote to memory of 2504 1172 cmd.exe 33 PID 1172 wrote to memory of 2504 1172 cmd.exe 33 PID 2936 wrote to memory of 2860 2936 cmd.exe 34 PID 2936 wrote to memory of 2860 2936 cmd.exe 34 PID 2936 wrote to memory of 2860 2936 cmd.exe 34 PID 2936 wrote to memory of 1800 2936 cmd.exe 37 PID 2936 wrote to memory of 1800 2936 cmd.exe 37 PID 2936 wrote to memory of 1800 2936 cmd.exe 37 PID 1172 wrote to memory of 1964 1172 cmd.exe 38 PID 1172 wrote to memory of 1964 1172 cmd.exe 38 PID 1172 wrote to memory of 1964 1172 cmd.exe 38 PID 1172 wrote to memory of 1764 1172 cmd.exe 40 PID 1172 wrote to memory of 1764 1172 cmd.exe 40 PID 1172 wrote to memory of 1764 1172 cmd.exe 40 PID 1172 wrote to memory of 1800 1172 cmd.exe 41 PID 1172 wrote to memory of 1800 1172 cmd.exe 41 PID 1172 wrote to memory of 1800 1172 cmd.exe 41 PID 1172 wrote to memory of 2204 1172 cmd.exe 42 PID 1172 wrote to memory of 2204 1172 cmd.exe 42 PID 1172 wrote to memory of 2204 1172 cmd.exe 42 PID 2176 wrote to memory of 2688 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 49 PID 2176 wrote to memory of 2688 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 49 PID 2176 wrote to memory of 2688 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 49 PID 2176 wrote to memory of 2688 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 49 PID 2176 wrote to memory of 2908 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 50 PID 2176 wrote to memory of 2908 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 50 PID 2176 wrote to memory of 2908 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 50 PID 2176 wrote to memory of 2908 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 50 PID 2176 wrote to memory of 2696 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 51 PID 2176 wrote to memory of 2696 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 51 PID 2176 wrote to memory of 2696 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 51 PID 2176 wrote to memory of 2696 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 51 PID 2176 wrote to memory of 2612 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 52 PID 2176 wrote to memory of 2612 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 52 PID 2176 wrote to memory of 2612 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 52 PID 2176 wrote to memory of 2612 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 52 PID 2176 wrote to memory of 2976 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 53 PID 2176 wrote to memory of 2976 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 53 PID 2176 wrote to memory of 2976 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 53 PID 2176 wrote to memory of 2976 2176 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe 53 PID 2976 wrote to memory of 2932 2976 cmd.exe 55 PID 2976 wrote to memory of 2932 2976 cmd.exe 55 PID 2976 wrote to memory of 2932 2976 cmd.exe 55 PID 2976 wrote to memory of 1360 2976 cmd.exe 56 PID 2976 wrote to memory of 1360 2976 cmd.exe 56 PID 2976 wrote to memory of 1360 2976 cmd.exe 56 PID 2976 wrote to memory of 1716 2976 cmd.exe 57 PID 2976 wrote to memory of 1716 2976 cmd.exe 57 PID 2976 wrote to memory of 1716 2976 cmd.exe 57 PID 2976 wrote to memory of 1564 2976 cmd.exe 58 PID 2976 wrote to memory of 1564 2976 cmd.exe 58 PID 2976 wrote to memory of 1564 2976 cmd.exe 58 PID 2976 wrote to memory of 2896 2976 cmd.exe 59 PID 2976 wrote to memory of 2896 2976 cmd.exe 59 PID 2976 wrote to memory of 2896 2976 cmd.exe 59 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe"2⤵PID:2340
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
PID:2860
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:1800
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2504
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1764
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1800
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2204
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2688
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2908
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2696
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2612
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2932
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1716
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1564
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2896
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2440
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:212
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[6797CDE4-3536].[[email protected]].dzen
Filesize5.1MB
MD5a998baef6c985b16dc14ef42984b4de9
SHA13c45239135c3989060cbe08436c0f8d6aebf751b
SHA25659d9229a784ad68ca960085154c0c983f4d9b0c061feca2ae94b3e1ecb3af29d
SHA512ba57b703e796c2771aea8a8feb318cf75cdd1ec1cbf1d56a45cde05bf5191815cb50ae8d23647e9e59d4bc2eaf11efa1fae57310629c227e72ddb22f6d38f708
-
Filesize
5KB
MD559ec9e1b688df00365b96018d6d6945a
SHA114bff3a9271ac8a315e01ab092d90fa43810b18e
SHA2560ee259d9eaa1a542355bcc59509a0a58dee8ce38a060927c5247b893c820f298
SHA5127dce39b9a4ec453315832a784bbaef1647d8770deda025b09f38f7daea71049aed2ea50b94a793fd0725083469804fd95cc0602f9a458a4867ea32cd90b2a3e4