Malware Analysis Report

2024-09-11 01:17

Sample ID 240419-wx88sabg52
Target a1a4fb75dec19097c5acc1d7557fdbc69a1021c4da47cc2c96aa1c03d7ef51eb
SHA256 a1a4fb75dec19097c5acc1d7557fdbc69a1021c4da47cc2c96aa1c03d7ef51eb
Tags
phobos evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a1a4fb75dec19097c5acc1d7557fdbc69a1021c4da47cc2c96aa1c03d7ef51eb

Threat Level: Known bad

The file a1a4fb75dec19097c5acc1d7557fdbc69a1021c4da47cc2c96aa1c03d7ef51eb was found to be: Known bad.

Malicious Activity Summary

phobos evasion persistence ransomware spyware stealer

Phobos

Modifies boot configuration data using bcdedit

Renames multiple (521) files with added filename extension

Renames multiple (311) files with added filename extension

Deletes shadow copies

Deletes backup catalog

Modifies Windows Firewall

Drops startup file

Reads user/profile data of web browsers

Checks computer location settings

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Interacts with shadow copies

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Impair Defenses
T1562
Disable or Modify System Firewall
T1562.004
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-04-19 18:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 18:19

Reported

2024-04-19 18:22

Platform

win7-20240221-en

Max time kernel

149s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (311) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce = "C:\\Users\\Admin\\AppData\\Local\\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe" C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce = "C:\\Users\\Admin\\AppData\\Local\\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe" C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2RM92H5V\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HUNEJ1HU\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6UZVS19T\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JWM3U1DD\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BB4W7M7Z\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21314_.GIF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_OFF.GIF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\MAPIPH.DLL.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\pdmproxy100.dll C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299587.WMF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7.dll C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cuiaba.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_snow.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\28.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Angles.eftx.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215709.WMF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02412K.JPG C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\Discussion14.gta.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00453_.WMF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00640_.WMF C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0278882.WMF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199475.WMF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02287_.WMF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WZCNFLCT.CHM C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02282_.WMF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02312_.WMF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR5B.GIF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00414_.WMF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03236_.WMF C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Austin.xml.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\icon.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImages.jpg.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_el.dll C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187647.WMF.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02058U.BMP.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca.id[B4EE4A50-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02261_.WMF C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1196 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1196 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1196 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1196 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1196 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1196 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1196 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1196 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 2528 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2528 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2528 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3040 wrote to memory of 2228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3040 wrote to memory of 2228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3040 wrote to memory of 2228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2528 wrote to memory of 1364 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2528 wrote to memory of 1364 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2528 wrote to memory of 1364 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3040 wrote to memory of 2404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3040 wrote to memory of 2404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3040 wrote to memory of 2404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3040 wrote to memory of 2020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3040 wrote to memory of 2020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3040 wrote to memory of 2020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3040 wrote to memory of 1756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3040 wrote to memory of 1756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3040 wrote to memory of 1756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3040 wrote to memory of 2536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3040 wrote to memory of 2536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3040 wrote to memory of 2536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1196 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1196 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1196 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1196 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1196 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1720 wrote to memory of 2720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1720 wrote to memory of 2720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1720 wrote to memory of 2720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1720 wrote to memory of 276 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1720 wrote to memory of 276 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1720 wrote to memory of 276 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1720 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1720 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1720 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1720 wrote to memory of 780 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1720 wrote to memory of 780 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1720 wrote to memory of 780 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1720 wrote to memory of 984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1720 wrote to memory of 984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1720 wrote to memory of 984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe

"C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe"

C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe

"C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[B4EE4A50-3411].[[email protected]].Elbie

MD5 5b3e6a0b1b2afa616443288aad4b5605
SHA1 fec7611a1718c556bc2d5ce05829479d5a4d2a8a
SHA256 2dc9b885eee13fa6909d6297b44429ac7bcbf041b8e68336126350cfc12533de
SHA512 983e14a72b2a21b68d00eb7fdfd75388ffe4e8267140394d3a8c4bd08c50f98cf654710664b5f2bf4dc6ca40b59ee06f714ec542024ab327b51e2d1d89be7304

C:\info.hta

MD5 462a43c11150b7f3deb25bae64d33b15
SHA1 ee634134fb26a278fe8fcd3342dfb6ebfbf52139
SHA256 0ff1662567fc549cf8df074566cb1fe2bc3440b6d613efcce2d9957b6350b1dc
SHA512 daa3b201f1d21cd034055d7bf2e835043f79263588b01b52b75b5075dd549b35957fcd42e6a4bb4288b8b703d08e46ecdb1489dc9efa213d5ce5ec14d0963e47

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 18:19

Reported

2024-04-19 18:22

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (521) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce = "C:\\Users\\Admin\\AppData\\Local\\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe" C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce = "C:\\Users\\Admin\\AppData\\Local\\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe" C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4084619521-2220719027-1909462854-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\RunningLate.scale-80.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WideTile.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_removeme-default_18.svg C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-press.svg C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\orcl7.xsl C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\logo_retina.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_wob.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\af.pak.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\gd.pak C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreRating\StoreRatingRules.xml C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\FeedbackThumbnail.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordcnv.dll.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-36.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\mpvis.dll.mui C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-125.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.format.ps1xml C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\organize_poster.jpg C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ta.pak.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\PaintMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\added.txt C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-150.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-72.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\et.pak C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\WPGIMP32.FLT C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\msedgeupdateres_nb.dll.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfigOnLogon.xml.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\ui-strings.js.id[426485F1-3411].[[email protected]].Elbie C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\ui-strings.js C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg5.jpg C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1044 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1044 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1044 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1044 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 4192 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4192 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2344 wrote to memory of 3396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2344 wrote to memory of 3396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4192 wrote to memory of 4348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4192 wrote to memory of 4348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2344 wrote to memory of 3480 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2344 wrote to memory of 3480 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2344 wrote to memory of 2644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2344 wrote to memory of 2644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2344 wrote to memory of 2656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2344 wrote to memory of 2656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2344 wrote to memory of 3000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2344 wrote to memory of 3000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1044 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\SysWOW64\mshta.exe
PID 1044 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1044 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe C:\Windows\system32\cmd.exe
PID 1844 wrote to memory of 220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1844 wrote to memory of 220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1844 wrote to memory of 3968 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1844 wrote to memory of 3968 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1844 wrote to memory of 2056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1844 wrote to memory of 2056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1844 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1844 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1844 wrote to memory of 4168 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1844 wrote to memory of 4168 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe

"C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe"

C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe

"C:\Users\Admin\AppData\Local\Temp\1ca85c7d735a4bdc8900acd52f4ec46bf0d0f13908907657175bbf92d82e28ce.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 206.221.208.4.in-addr.arpa udp
US 8.8.8.8:53 132.46.30.184.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[426485F1-3411].[[email protected]].Elbie

MD5 9a5c0d8b3358f56825af33b335773360
SHA1 d50e365e94cacbb835034c1e6c7267d9edb5b0f9
SHA256 d91d9a04c9496db35fbe683a51e1954193170a80d9e811331d5079461fa5427c
SHA512 72aefaeba2f98c9b3f10d63ff9dbb8d44290b202ac29fc2075a254cbfcf65913270798effe7ecbcb2c569c204b64765f006ef31ff7c5a81835df582bfc3c2d69

C:\info.hta

MD5 e90f9c0806e44c048426256a9ad4b3d4
SHA1 7357438f14df72f10c24f9cbeaec2c4fca6178ca
SHA256 240e32187b62fac07eb599b1a4f11a2c210cb1b7b1b9edd55f4e65cd1bc6f5e6
SHA512 5eb2f8c0b902ef66ed8da41a574bb19317ee8790acfbf6bf34ca05e58905e03d25e6007c79d699e8d78ef4bf5bd80ac0b7ca38afa52cf05bb47a860ad6542e8e