Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/04/2024, 07:52
Static task
static1
Behavioral task
behavioral1
Sample
6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe
Resource
win10v2004-20240226-en
General
-
Target
6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe
-
Size
66KB
-
MD5
2c78f28a0f3dbd0f45f96f4aee72e8ee
-
SHA1
f10803cf1d160020e3f611e9f2dd8be93cb7d7ef
-
SHA256
6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f
-
SHA512
8dbfe5d58448bb4f4ae236b2ccd1da0a737650ba650e5e96dfdc95f2b9a53508c9814d72bd6204507b76ae71351ba65e50a6db2dc4cc952dab681a9b2b1c2161
-
SSDEEP
1536:TNeRBl5PT/rx1mzwRMSTdLpJn8qEQBoimA0Q0GTE6VfE:TQRrmzwR5J1oiBH0CE+s
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></li>
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 324 bcdedit.exe 2952 bcdedit.exe 2024 bcdedit.exe 1608 bcdedit.exe -
Renames multiple (311) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1668 wbadmin.exe 2876 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2628 netsh.exe 2272 netsh.exe -
Drops startup file 3 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f = "C:\\Users\\Admin\\AppData\\Local\\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe" 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f = "C:\\Users\\Admin\\AppData\\Local\\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe" 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\Links\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JWM3U1DD\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Public\Videos\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\EQ2PZD61\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A9XVYA91\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\Music\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Public\Music\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BB4W7M7Z\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MG62UP6H\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6UZVS19T\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_es.properties 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen.css 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Microsoft Games\Chess\ChessMCE.png 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\Java\jre7\bin\sunec.dll.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WHIRL1.WMF 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\QRCode.pmp 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSPTLS.DLL.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241037.WMF 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLWVW.DLL.IDX_DLL.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SecStoreFile.ico.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_COL.HXT.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.BusinessData.xml.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanMergeLetter.Dotx.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Damascus 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_iw.dll 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLBAR.INF 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02441_.WMF.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10337_.GIF 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBPAGE.DPV 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\RECALL.DLL.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEWSTR.DLL 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\slideShow.js 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237759.WMF.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CUP.WMF 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Concourse.xml 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR48B.GIF 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Messenger.xml.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_On.png 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMDOS.FAE 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotionblur_plugin.dll.id[E9E9EA12-3483].[[email protected]].8base 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\grayStateIcon.png 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2612 vssadmin.exe 2548 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{116439E1-F0C6-11EE-9DC0-D20227E6D795} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe Token: SeBackupPrivilege 2576 vssvc.exe Token: SeRestorePrivilege 2576 vssvc.exe Token: SeAuditPrivilege 2576 vssvc.exe Token: SeIncreaseQuotaPrivilege 1948 WMIC.exe Token: SeSecurityPrivilege 1948 WMIC.exe Token: SeTakeOwnershipPrivilege 1948 WMIC.exe Token: SeLoadDriverPrivilege 1948 WMIC.exe Token: SeSystemProfilePrivilege 1948 WMIC.exe Token: SeSystemtimePrivilege 1948 WMIC.exe Token: SeProfSingleProcessPrivilege 1948 WMIC.exe Token: SeIncBasePriorityPrivilege 1948 WMIC.exe Token: SeCreatePagefilePrivilege 1948 WMIC.exe Token: SeBackupPrivilege 1948 WMIC.exe Token: SeRestorePrivilege 1948 WMIC.exe Token: SeShutdownPrivilege 1948 WMIC.exe Token: SeDebugPrivilege 1948 WMIC.exe Token: SeSystemEnvironmentPrivilege 1948 WMIC.exe Token: SeRemoteShutdownPrivilege 1948 WMIC.exe Token: SeUndockPrivilege 1948 WMIC.exe Token: SeManageVolumePrivilege 1948 WMIC.exe Token: 33 1948 WMIC.exe Token: 34 1948 WMIC.exe Token: 35 1948 WMIC.exe Token: SeIncreaseQuotaPrivilege 1948 WMIC.exe Token: SeSecurityPrivilege 1948 WMIC.exe Token: SeTakeOwnershipPrivilege 1948 WMIC.exe Token: SeLoadDriverPrivilege 1948 WMIC.exe Token: SeSystemProfilePrivilege 1948 WMIC.exe Token: SeSystemtimePrivilege 1948 WMIC.exe Token: SeProfSingleProcessPrivilege 1948 WMIC.exe Token: SeIncBasePriorityPrivilege 1948 WMIC.exe Token: SeCreatePagefilePrivilege 1948 WMIC.exe Token: SeBackupPrivilege 1948 WMIC.exe Token: SeRestorePrivilege 1948 WMIC.exe Token: SeShutdownPrivilege 1948 WMIC.exe Token: SeDebugPrivilege 1948 WMIC.exe Token: SeSystemEnvironmentPrivilege 1948 WMIC.exe Token: SeRemoteShutdownPrivilege 1948 WMIC.exe Token: SeUndockPrivilege 1948 WMIC.exe Token: SeManageVolumePrivilege 1948 WMIC.exe Token: 33 1948 WMIC.exe Token: 34 1948 WMIC.exe Token: 35 1948 WMIC.exe Token: SeBackupPrivilege 1812 wbengine.exe Token: SeRestorePrivilege 1812 wbengine.exe Token: SeSecurityPrivilege 1812 wbengine.exe Token: SeIncreaseQuotaPrivilege 2856 WMIC.exe Token: SeSecurityPrivilege 2856 WMIC.exe Token: SeTakeOwnershipPrivilege 2856 WMIC.exe Token: SeLoadDriverPrivilege 2856 WMIC.exe Token: SeSystemProfilePrivilege 2856 WMIC.exe Token: SeSystemtimePrivilege 2856 WMIC.exe Token: SeProfSingleProcessPrivilege 2856 WMIC.exe Token: SeIncBasePriorityPrivilege 2856 WMIC.exe Token: SeCreatePagefilePrivilege 2856 WMIC.exe Token: SeBackupPrivilege 2856 WMIC.exe Token: SeRestorePrivilege 2856 WMIC.exe Token: SeShutdownPrivilege 2856 WMIC.exe Token: SeDebugPrivilege 2856 WMIC.exe Token: SeSystemEnvironmentPrivilege 2856 WMIC.exe Token: SeRemoteShutdownPrivilege 2856 WMIC.exe Token: SeUndockPrivilege 2856 WMIC.exe Token: SeManageVolumePrivilege 2856 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 296 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 296 iexplore.exe 296 iexplore.exe 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2976 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 29 PID 2676 wrote to memory of 2976 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 29 PID 2676 wrote to memory of 2504 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 30 PID 2676 wrote to memory of 2976 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 29 PID 2676 wrote to memory of 2976 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 29 PID 2676 wrote to memory of 2504 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 30 PID 2676 wrote to memory of 2504 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 30 PID 2676 wrote to memory of 2504 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 30 PID 2976 wrote to memory of 2628 2976 cmd.exe 33 PID 2976 wrote to memory of 2628 2976 cmd.exe 33 PID 2976 wrote to memory of 2628 2976 cmd.exe 33 PID 2504 wrote to memory of 2612 2504 cmd.exe 34 PID 2504 wrote to memory of 2612 2504 cmd.exe 34 PID 2504 wrote to memory of 2612 2504 cmd.exe 34 PID 2976 wrote to memory of 2272 2976 cmd.exe 37 PID 2976 wrote to memory of 2272 2976 cmd.exe 37 PID 2976 wrote to memory of 2272 2976 cmd.exe 37 PID 2504 wrote to memory of 1948 2504 cmd.exe 39 PID 2504 wrote to memory of 1948 2504 cmd.exe 39 PID 2504 wrote to memory of 1948 2504 cmd.exe 39 PID 2504 wrote to memory of 324 2504 cmd.exe 41 PID 2504 wrote to memory of 324 2504 cmd.exe 41 PID 2504 wrote to memory of 324 2504 cmd.exe 41 PID 2504 wrote to memory of 2952 2504 cmd.exe 42 PID 2504 wrote to memory of 2952 2504 cmd.exe 42 PID 2504 wrote to memory of 2952 2504 cmd.exe 42 PID 2504 wrote to memory of 1668 2504 cmd.exe 43 PID 2504 wrote to memory of 1668 2504 cmd.exe 43 PID 2504 wrote to memory of 1668 2504 cmd.exe 43 PID 2676 wrote to memory of 836 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 48 PID 2676 wrote to memory of 836 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 48 PID 2676 wrote to memory of 836 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 48 PID 2676 wrote to memory of 836 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 48 PID 2676 wrote to memory of 1964 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 49 PID 2676 wrote to memory of 1964 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 49 PID 2676 wrote to memory of 1964 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 49 PID 2676 wrote to memory of 1964 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 49 PID 2676 wrote to memory of 1252 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 50 PID 2676 wrote to memory of 1252 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 50 PID 2676 wrote to memory of 1252 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 50 PID 2676 wrote to memory of 1252 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 50 PID 2676 wrote to memory of 2556 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 52 PID 2676 wrote to memory of 2556 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 52 PID 2676 wrote to memory of 2556 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 52 PID 2676 wrote to memory of 2556 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 52 PID 2676 wrote to memory of 2440 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 53 PID 2676 wrote to memory of 2440 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 53 PID 2676 wrote to memory of 2440 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 53 PID 2676 wrote to memory of 2440 2676 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 53 PID 2440 wrote to memory of 2548 2440 cmd.exe 55 PID 2440 wrote to memory of 2548 2440 cmd.exe 55 PID 2440 wrote to memory of 2548 2440 cmd.exe 55 PID 2440 wrote to memory of 2856 2440 cmd.exe 56 PID 2440 wrote to memory of 2856 2440 cmd.exe 56 PID 2440 wrote to memory of 2856 2440 cmd.exe 56 PID 2440 wrote to memory of 2024 2440 cmd.exe 57 PID 2440 wrote to memory of 2024 2440 cmd.exe 57 PID 2440 wrote to memory of 2024 2440 cmd.exe 57 PID 2440 wrote to memory of 1608 2440 cmd.exe 58 PID 2440 wrote to memory of 1608 2440 cmd.exe 58 PID 2440 wrote to memory of 1608 2440 cmd.exe 58 PID 2440 wrote to memory of 2876 2440 cmd.exe 59 PID 2440 wrote to memory of 2876 2440 cmd.exe 59 PID 2440 wrote to memory of 2876 2440 cmd.exe 59 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe"C:\Users\Admin\AppData\Local\Temp\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe"C:\Users\Admin\AppData\Local\Temp\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe"2⤵PID:2792
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
PID:2628
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:2272
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2612
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:324
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2952
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1668
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:836
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
PID:1964
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:1252
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2556
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2548
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2024
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1608
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2876
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2424
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1684
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:296 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:296 CREDAT:472068 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id[E9E9EA12-3483].[[email protected]].8base
Filesize6.3MB
MD50a16f925f74854d35ca1da6b2b3c5639
SHA11b4d0f47b5906664ed91f07034eb6ed45dedc75a
SHA256d2494b3fbca5e9386c4aa7d5a84f43a3e3fd7bb19677632e8cc39ab79ea52c36
SHA512e936f59ea2ca46a80be85b3daa1dd358a28736bba95a7452df08007fcc4f662cb858654be1c8c1c71b9b2bad6b208e19d9050d3402b3e74b37f717bef370492c
-
Filesize
9KB
MD508d589cffad676c213700c30813e1913
SHA18951a2731d8b7f4d3124b53a4204ecca73bd744c
SHA25662bf4a46cf2f53d7e0c8696f2da845a182bd82d24950123aa1d98ad0671e4c28
SHA512f8bef68c366063a714043503861464558196e54f59e2fee2ed8a185392f4a783453f0e1c0274b00aea52cf99f40c50f02c47e1005c64073ebcae48fe6d04525a