Malware Analysis Report

2024-09-11 01:05

Sample ID 240419-wyn91acf4y
Target 52e7a6b14d93e80ae2921306e9adaf26bf2f623a8d6ec22ab1ffe808b7cca4b6
SHA256 52e7a6b14d93e80ae2921306e9adaf26bf2f623a8d6ec22ab1ffe808b7cca4b6
Tags
phobos evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

52e7a6b14d93e80ae2921306e9adaf26bf2f623a8d6ec22ab1ffe808b7cca4b6

Threat Level: Known bad

The file 52e7a6b14d93e80ae2921306e9adaf26bf2f623a8d6ec22ab1ffe808b7cca4b6 was found to be: Known bad.

Malicious Activity Summary

phobos evasion persistence ransomware spyware stealer

Phobos

Modifies boot configuration data using bcdedit

Renames multiple (311) files with added filename extension

Deletes shadow copies

Renames multiple (62) files with added filename extension

Deletes backup catalog

Modifies Windows Firewall

Drops startup file

Reads user/profile data of web browsers

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Modifies Internet Explorer settings

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Impair Defenses
T1562
Disable or Modify System Firewall
T1562.004
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-04-19 18:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 18:19

Reported

2024-04-19 18:23

Platform

win7-20231129-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (311) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff = "C:\\Users\\Admin\\AppData\\Local\\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe" C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff = "C:\\Users\\Admin\\AppData\\Local\\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe" C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4XCMPANZ\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FW0P2MZH\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2GIU3NG8\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMDLW4SJ\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BP3UABCB\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\27PKR52P\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\bin\server\classes.jsa C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02373_.WMF.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02437_.WMF C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Traditional.dotx.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\drag.png C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\MP00021_.WMF.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLFLTR.DAT.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\msdaorar.dll.mui C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00438_.WMF C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.JS.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Country.css.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_es-419.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14565_.GIF.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Person.css.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNOteFilter.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.ELM C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\MMSL.ICO C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_F_COL.HXK.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47B.GIF.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\VBE6EXT.OLB.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02749U.BMP.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\RPLBRF35.CHM C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\tab_off.gif C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN103.XML.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152696.WMF C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152722.WMF.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02810J.JPG.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107148.WMF.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfoInternal.zip.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\Mozilla Firefox\removed-files.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105280.WMF C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll.id[2CA9B0D0-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2196 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 1696 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1696 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1696 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3064 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3064 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3064 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1696 wrote to memory of 1964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1696 wrote to memory of 1964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1696 wrote to memory of 1964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3064 wrote to memory of 780 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3064 wrote to memory of 780 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3064 wrote to memory of 780 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3064 wrote to memory of 1268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3064 wrote to memory of 1268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3064 wrote to memory of 1268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3064 wrote to memory of 2216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3064 wrote to memory of 2216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3064 wrote to memory of 2216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3064 wrote to memory of 1504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3064 wrote to memory of 1504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3064 wrote to memory of 1504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2196 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\SysWOW64\mshta.exe
PID 2196 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 2668 wrote to memory of 620 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2668 wrote to memory of 620 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2668 wrote to memory of 620 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2668 wrote to memory of 824 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2668 wrote to memory of 824 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2668 wrote to memory of 824 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2668 wrote to memory of 2012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2272 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2272 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 2272 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2668 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2668 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2668 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe

"C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe"

C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe

"C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id[2CA9B0D0-3451].[[email protected]].faust

MD5 992e8c3a55d2c6a7f7dd9438307cba51
SHA1 a302d6d5f9650a4eda9cabba4662b93dd71c5ca2
SHA256 45d88b8d4864477d42eb01624bf0c3892566ef4c52e8880474530eff8231a919
SHA512 0da20a95fa7f99c79d414d9c5bcaada9be8f819243f5b70619b401057a152864088c3607a4d93868f19c64fc1f489c02a23a75a60030b1425671fe3816731883

C:\Users\Public\Desktop\info.hta

MD5 7901e120644d6bb9e80bda7044ab3f35
SHA1 fbe617e9eab5e44f015255dc630ec9b61e67409c
SHA256 8632c35be893a18b911a3109132a1be826b4b2f3d2f15e1c8731bc8c6f18ae7d
SHA512 9d62085172d3dc9a2fe7ef38fcc002e1b3b30f9a1c14fa601b463a1ecc67466d0e7b1c43247e9eab8500fe5bb572663152fd0bee47b23ea92ddf3462acd63ff3

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 18:19

Reported

2024-04-19 18:23

Platform

win10v2004-20240226-en

Max time kernel

159s

Max time network

168s

Command Line

"C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (62) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff = "C:\\Users\\Admin\\AppData\\Local\\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe" C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff = "C:\\Users\\Admin\\AppData\\Local\\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe" C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationUI.resources.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Input.Manipulations.resources.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationTypes.resources.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Design.Editors.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\WindowsBase.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationProvider.resources.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Pipes.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.TypeExtensions.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Thread.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Design.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\PresentationCore.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Xaml.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscorrc.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\WindowsBase.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationUI.resources.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.CodeDom.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Input.Manipulations.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\7-Zip\Lang\ba.txt.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Content.xml C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationClient.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.VisualBasic.Forms.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Algorithms.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationUI.resources.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.FileVersionInfo.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.HttpListener.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.AccessControl.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.ReaderWriter.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationTypes.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Forms.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\ReachFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Forms.Design.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationClient.resources.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationClient.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\WindowsFormsIntegration.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\msdaps.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-utility-l1-1-0.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PenImc_cor3.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationTypes.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.Writer.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationFramework.resources.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\Microsoft.VisualBasic.Forms.resources.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Core.dll C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Pipes.AccessControl.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Memory.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Diagnostics.EventLog.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationUI.resources.dll.id[63E907E5-3451].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1072 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 1072 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 1072 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 1072 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe C:\Windows\system32\cmd.exe
PID 3204 wrote to memory of 452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3204 wrote to memory of 452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3740 wrote to memory of 1928 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3740 wrote to memory of 1928 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3740 wrote to memory of 1256 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3740 wrote to memory of 1256 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3204 wrote to memory of 4476 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3204 wrote to memory of 4476 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3204 wrote to memory of 2260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3204 wrote to memory of 2260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3204 wrote to memory of 1516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3204 wrote to memory of 1516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3204 wrote to memory of 832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3204 wrote to memory of 832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe

"C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe"

C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe

"C:\Users\Admin\AppData\Local\Temp\acf2e97465dbecc6f361ee9b971a0747b1ce17aaee76d59bf4215114ee5778ff.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.187.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 93.65.42.20.in-addr.arpa udp

Files

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[63E907E5-3451].[[email protected]].faust

MD5 92069d9f59882da05fafd74955cbe279
SHA1 5e02fa08e9abaeca32650ab32cc9896cb131ef68
SHA256 fcc623785b5501db873f3348cd4e37391d6cebaadca90cdc8096a7a52e81916e
SHA512 4c7b5e4f382a13d2e77408d9360fe21a43a9e7c05f8fd4c8d0666dcb8f45cda46a94d76f2064a91c345737e29eef26f078390e7b90efc2b5c8146ceb2a25fd5a