Malware Analysis Report

2024-09-22 16:19

Sample ID 240417-qr83yabb51
Target ca6c88a60221cb6ef36968bee531fedcb11d0d6f111e3b5527a5b1ca2a80ce93
SHA256 ca6c88a60221cb6ef36968bee531fedcb11d0d6f111e3b5527a5b1ca2a80ce93
Tags
avaddon evasion persistence ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ca6c88a60221cb6ef36968bee531fedcb11d0d6f111e3b5527a5b1ca2a80ce93

Threat Level: Known bad

The file ca6c88a60221cb6ef36968bee531fedcb11d0d6f111e3b5527a5b1ca2a80ce93 was found to be: Known bad.

Malicious Activity Summary

avaddon evasion persistence ransomware trojan

Avaddon payload

UAC bypass

Avaddon

Renames multiple (258) files with added filename extension

Renames multiple (172) files with added filename extension

Deletes shadow copies

Executes dropped EXE

Adds Run key to start application

Drops desktop.ini file(s)

Checks whether UAC is enabled

Enumerates connected drives

Looks up external IP address via web service

Program crash

Unsigned PE

Enumerates physical storage devices

Uses Volume Shadow Copy service COM API

Interacts with shadow copies

Modifies system certificate store

System policy modification

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-04-17 13:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-17 13:30

Reported

2024-04-17 13:35

Platform

win7-20240221-en

Max time kernel

150s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe"

Signatures

Avaddon

ransomware avaddon

Avaddon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Deletes shadow copies

ransomware

Renames multiple (258) files with added filename extension

ransomware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.myip.com N/A N/A
N/A api.myip.com N/A N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2224 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2224 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2224 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2224 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2224 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2224 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2224 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2224 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2224 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2224 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2224 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2224 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2648 wrote to memory of 2556 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\Microsoft\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
PID 2648 wrote to memory of 2556 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\Microsoft\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
PID 2648 wrote to memory of 2556 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\Microsoft\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
PID 2648 wrote to memory of 2556 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\Microsoft\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe

"C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\taskeng.exe

taskeng.exe {07AFAB89-0861-49D4-9F50-6E46A0609A01} S-1-5-21-406356229-2805545415-1236085040-1000:IKJSPGIM\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\Microsoft\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe

C:\Users\Admin\AppData\Roaming\Microsoft\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.myip.com udp
US 104.26.9.59:443 api.myip.com tcp
US 8.8.8.8:53 apps.identrust.com udp
IE 2.18.24.9:80 apps.identrust.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 2.21.17.29:80 x2.c.lencr.org tcp

Files

memory/2224-0-0x0000000000220000-0x00000000002A4000-memory.dmp

memory/2224-1-0x0000000000220000-0x00000000002A4000-memory.dmp

memory/2224-2-0x0000000001B50000-0x0000000001C69000-memory.dmp

memory/2224-3-0x0000000000400000-0x0000000001B46000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab6C6B.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar6DAA.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79e64c7de4d70860fa747f86d50ff5cb
SHA1 5650974eac55e883a26de6b1bb97ba600c2221cc
SHA256 52db0b266aa96b7aff43f6979a60ed835acca46151e7da674ac76c7fef900969
SHA512 9b34d617173c79d6614a7d1898c774ac84a6ea99ced5182152d0a9e0fb23b69c0d423c135b1764ef5a7eb9ab20de735412792a6f22fa2bbe17723360e14b2522

memory/2224-89-0x0000000000400000-0x0000000001B46000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\readme.html

MD5 9e04646d921d38c7aab0ea434b678439
SHA1 167f84f4cd66beed252b9bc17142708aead76b44
SHA256 9cea81fdeabf16a459fc57313757e9cf0de2b710cb4478b38d4d0f98a5b23e34
SHA512 432664011b521e00d702395af4d27bdd311b2f31e5118f68ea775a52b9f64389bce22c2ff5e11d28e676a0499182a553fa930f380082328d1d8e1e0fe58ad19e

memory/2224-786-0x0000000000400000-0x0000000001B46000-memory.dmp

memory/2224-869-0x0000000001B50000-0x0000000001C69000-memory.dmp

memory/2224-868-0x0000000000220000-0x00000000002A4000-memory.dmp

memory/2224-870-0x0000000000400000-0x0000000001B46000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe

MD5 c83f30c065f7f61428eac2370ddb4f53
SHA1 cfd70af0c89d7b00839c1d32852c53c603d35e32
SHA256 bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc
SHA512 26100fdf2bba32c0a2f5d27589e730e6af4a16b5cad16cb8ec6314e4291ca1858e35906645636617dacca7c72be6792b01f2bbc073c4468701326e8c889e1d51

memory/2556-879-0x00000000002A0000-0x0000000000324000-memory.dmp

memory/2556-880-0x00000000002A0000-0x0000000000324000-memory.dmp

memory/2556-881-0x0000000000400000-0x0000000001B46000-memory.dmp

memory/2556-884-0x0000000000400000-0x0000000001B46000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-17 13:30

Reported

2024-04-17 13:35

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe"

Signatures

Avaddon

ransomware avaddon

Avaddon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Renames multiple (172) files with added filename extension

ransomware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-4092317236-2027488869-1227795436-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.myip.com N/A N/A
N/A api.myip.com N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\Microsoft\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 992 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 992 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 992 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 992 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 992 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 992 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 992 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 992 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 992 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe C:\Windows\SysWOW64\Wbem\wmic.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe

"C:\Users\Admin\AppData\Local\Temp\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1812

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1632

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1812

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1668

C:\Users\Admin\AppData\Roaming\Microsoft\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe

C:\Users\Admin\AppData\Roaming\Microsoft\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2360 -ip 2360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 892

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 132.250.30.184.in-addr.arpa udp
US 8.8.8.8:53 api.myip.com udp
US 172.67.75.163:443 api.myip.com tcp
US 8.8.8.8:53 163.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 29.17.21.2.in-addr.arpa udp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 2.21.17.29:80 x2.c.lencr.org tcp
N/A 10.127.0.1:445 tcp
N/A 10.127.0.1:139 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 81.139.73.23.in-addr.arpa udp
N/A 10.127.0.3:445 tcp
N/A 10.127.0.3:139 tcp
US 8.8.8.8:53 3.0.127.10.in-addr.arpa udp
N/A 10.127.0.4:445 tcp
N/A 10.127.0.4:139 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 4.0.127.10.in-addr.arpa udp
N/A 10.127.0.5:445 tcp
N/A 10.127.0.5:139 tcp
US 8.8.8.8:53 5.0.127.10.in-addr.arpa udp
N/A 10.127.0.6:445 tcp
N/A 10.127.0.6:139 tcp

Files

memory/992-1-0x0000000001DC0000-0x0000000001E48000-memory.dmp

memory/992-2-0x0000000001E50000-0x0000000001F69000-memory.dmp

memory/992-3-0x0000000000400000-0x0000000001B46000-memory.dmp

C:\Users\Admin\Desktop\readme.html

MD5 2817fb32eabacc4d6d41948d809eac4e
SHA1 9c67482b9091773d77f8667287646c686350e71b
SHA256 3e7d44e773758cabe794e125e49a15bd23471ab540752b398014c57b368cc7bd
SHA512 5a4ebd9506b0e37e288eeefbaa3b82e76b32175b1af7a6731613b376e0361db5aebf15cc0a8a8f638e0cafba3f5315a7d90f606f013b711ddad1a43566d70682

memory/992-61-0x0000000001DC0000-0x0000000001E48000-memory.dmp

memory/992-239-0x0000000000400000-0x0000000001B46000-memory.dmp

memory/992-441-0x0000000001E50000-0x0000000001F69000-memory.dmp

memory/992-535-0x0000000000400000-0x0000000001B46000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc.exe

MD5 c83f30c065f7f61428eac2370ddb4f53
SHA1 cfd70af0c89d7b00839c1d32852c53c603d35e32
SHA256 bcb69244dc69a152af4dca3849bb4f3ca634ad785926304c672dbf8a3c38e7bc
SHA512 26100fdf2bba32c0a2f5d27589e730e6af4a16b5cad16cb8ec6314e4291ca1858e35906645636617dacca7c72be6792b01f2bbc073c4468701326e8c889e1d51

memory/2360-543-0x0000000001C50000-0x0000000001CDD000-memory.dmp

memory/2360-544-0x0000000000400000-0x0000000001B46000-memory.dmp