Malware Analysis Report

2024-09-11 01:10

Sample ID 240328-l19zdaaa4y
Target 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos
SHA256 2276fe3cc324c9e053eea9839874963a27f312dcf01b97d298e5d326a7c12b87
Tags
phobos evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2276fe3cc324c9e053eea9839874963a27f312dcf01b97d298e5d326a7c12b87

Threat Level: Known bad

The file 2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos was found to be: Known bad.

Malicious Activity Summary

phobos evasion persistence ransomware spyware stealer

Phobos

Renames multiple (502) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes shadow copies

Renames multiple (312) files with added filename extension

Deletes backup catalog

Modifies Windows Firewall

Reads user/profile data of web browsers

Drops startup file

Checks computer location settings

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Uses Task Scheduler COM API

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Impair Defenses
T1562
Disable or Modify System Firewall
T1562.004
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-03-28 10:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-28 10:01

Reported

2024-03-28 10:03

Platform

win7-20240221-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (312) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe" C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe" C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MRWZP5ZY\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y3HLRHFA\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5B8DS9TT\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZKWCFGN8\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3DCZZ4GN\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z9MW37VJ\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Nome.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237225.WMF C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCARD.XML C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\TAB_ON.GIF.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\ja-JP\msoeres.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\LoginForm.zip C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0102002.WMF.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21482_.GIF C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\validation.js C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Process Library.fdt.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Chicago.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01247U.BMP C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47B.GIF.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\RTF_BOLD.GIF C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\slideShow.css C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Apothecary.eftx C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\ExitRename.xps.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01468_.WMF C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPM.CFG.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\INVITE11.POC.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CERT98.POC.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d11_plugin.dll.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.EPS.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_el.dll.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART14.BDR.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217302.WMF.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.id[6797CDE4-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341447.JPG C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2176 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 2176 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 2176 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 2176 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 2176 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 2176 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 2176 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 2176 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 1172 wrote to memory of 2504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1172 wrote to memory of 2504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1172 wrote to memory of 2504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2936 wrote to memory of 2860 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2936 wrote to memory of 2860 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2936 wrote to memory of 2860 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2936 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2936 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2936 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1172 wrote to memory of 1964 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1172 wrote to memory of 1964 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1172 wrote to memory of 1964 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1172 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1172 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1172 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1172 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1172 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1172 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1172 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1172 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1172 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2176 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2176 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 2176 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 2176 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 2176 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 2976 wrote to memory of 2932 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2976 wrote to memory of 2932 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2976 wrote to memory of 2932 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2976 wrote to memory of 1360 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2976 wrote to memory of 1360 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2976 wrote to memory of 1360 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2976 wrote to memory of 1716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2976 wrote to memory of 1716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2976 wrote to memory of 1716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2976 wrote to memory of 1564 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2976 wrote to memory of 1564 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2976 wrote to memory of 1564 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2976 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2976 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2976 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe"

C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[6797CDE4-3536].[[email protected]].dzen

MD5 a998baef6c985b16dc14ef42984b4de9
SHA1 3c45239135c3989060cbe08436c0f8d6aebf751b
SHA256 59d9229a784ad68ca960085154c0c983f4d9b0c061feca2ae94b3e1ecb3af29d
SHA512 ba57b703e796c2771aea8a8feb318cf75cdd1ec1cbf1d56a45cde05bf5191815cb50ae8d23647e9e59d4bc2eaf11efa1fae57310629c227e72ddb22f6d38f708

C:\info.hta

MD5 59ec9e1b688df00365b96018d6d6945a
SHA1 14bff3a9271ac8a315e01ab092d90fa43810b18e
SHA256 0ee259d9eaa1a542355bcc59509a0a58dee8ce38a060927c5247b893c820f298
SHA512 7dce39b9a4ec453315832a784bbaef1647d8770deda025b09f38f7daea71049aed2ea50b94a793fd0725083469804fd95cc0602f9a458a4867ea32cd90b2a3e4

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-28 10:01

Reported

2024-03-28 10:03

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (502) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe" C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe" C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-566096764-1992588923-1249862864-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-566096764-1992588923-1249862864-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-white_scale-125.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\dd_arrow_small2x.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\SPRING.INF.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\Microsoft.VisualBasic.Forms.resources.dll.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006 C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SplashWideTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Error.m4a C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\PaySplashScreen.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-30_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7dd.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ui-strings.js.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OSFPROXY.DLL C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\MSFT_PackageManagementSource.schema.mfl.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\WideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Hedge.jpg C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\AppStore_icon.svg.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo_2x.png.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\selector.js.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-150.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\resources.pri.DATA.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockWideTile.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARA.TTF.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_am.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Presentation.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_af.dll.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_de.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected][9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-40.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\ui-strings.js.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ca-Es-VALENCIA.pak.DATA C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\82.jpg C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_01.jpg C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\Mozilla Firefox\qipcap64.dll.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Cloud.png C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_de_135x40.svg C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-tw_get.svg C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ro.pak.DATA C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Debug.dll.id[9A76413A-3536].[[email protected]].dzen C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4668 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 4668 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 4668 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 4668 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 1192 wrote to memory of 4460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1192 wrote to memory of 4460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2516 wrote to memory of 2924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2516 wrote to memory of 2924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1192 wrote to memory of 1748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1192 wrote to memory of 1748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2516 wrote to memory of 804 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2516 wrote to memory of 804 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2516 wrote to memory of 4524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2516 wrote to memory of 4524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2516 wrote to memory of 3148 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2516 wrote to memory of 3148 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2516 wrote to memory of 4240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2516 wrote to memory of 4240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4668 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 4668 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 4668 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe C:\Windows\system32\cmd.exe
PID 1192 wrote to memory of 4720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1192 wrote to memory of 4720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1192 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1192 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1192 wrote to memory of 4752 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1192 wrote to memory of 4752 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1192 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1192 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1192 wrote to memory of 3272 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1192 wrote to memory of 3272 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe"

C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-28_dc1950a269859406fc05fd6be6024fdf_phobos.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 18.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 139.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[9A76413A-3536].[[email protected]].dzen

MD5 2d1369d5a3cce9cfc79f1c5acdff52de
SHA1 9d4aa8256886a246efeb65886191f756bde2e506
SHA256 86fcb4db55eb84076930ffa1c52e9c00e5683a0793118feb847a050ff5e582eb
SHA512 e95d17b093d9f77807958112ef094da22a05a2b0046071144d9d4113bc67b79e93f85f71bf2189881558b123ea8e938b17d820f74320d18cff1adca854e8cbe2

C:\info.hta

MD5 7c9f616a622e9f2173f267a84708232b
SHA1 7d7d3dcabf1a859cef2ab929811473c2389b77f1
SHA256 fb9b0cd8d61870ccedc0e5ec335cf82d34425dd246e23ad3d8d1a02d656ed9f0
SHA512 7a1ed550214a0fbd45ee1968c2cf79b67e23218c714f2feace6bfe7faffe5b96895c782a643751b54213ff950e942ae4c0b0e758a4234edb2881416400e0e546