Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Deletes backup catalog

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\netsh.exe	N/A
N/A	N/A	C:\Windows\system32\netsh.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe"	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe"	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\7-Zip\Lang\cy.txt.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\7-Zip\7z.dll.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\7-Zip\Lang\pt.txt.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\7-Zip\Lang\tt.txt.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\ado\msadomd.dll	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\desktop.ini.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\7-Zip\Lang\kab.txt.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\EnableRemove.rar.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\Common.fxh	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\7-Zip\Lang\ky.txt.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\7-Zip\Lang\pl.txt.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DismountDebug.xls.id[A7B57FDF-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2224 wrote to memory of 636	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 2224 wrote to memory of 636	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 2224 wrote to memory of 636	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 2224 wrote to memory of 636	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 2224 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 2224 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 2224 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 2224 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 2756 wrote to memory of 2632	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 2756 wrote to memory of 2632	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 2756 wrote to memory of 2632	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 636 wrote to memory of 2644	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 636 wrote to memory of 2644	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 636 wrote to memory of 2644	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 2756 wrote to memory of 1816	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2756 wrote to memory of 1816	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2756 wrote to memory of 1816	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe"

C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

N/A

Files

C:\info.hta

MD5	9afb2ba93502c75eaa3b8db2c5ab6d15
SHA1	42fefd0ab263661e77c99bfbe861042f1785d98f
SHA256	45d1fab2977acd6af1a87713858c757a951c92dc239eca6367642a1458c961bd
SHA512	4bc0d3001a0da675b9a8f471c87e99919981dfc647dadbd73070218ee57489961276c33a00361fdea707250c149ba54add0dd3029bb7937e2055848275486060

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-02 22:28

Reported

2024-05-02 22:30

Platform

win10v2004-20240419-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Renames multiple (512) files with added filename extension

ransomware

Deletes backup catalog

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\netsh.exe	N/A
N/A	N/A	C:\Windows\system32\netsh.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe"	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe"	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-17203666-93769886-2545153620-1000\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Public\Documents\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Public\Pictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\$Recycle.Bin\S-1-5-21-17203666-93769886-2545153620-1000\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Searches\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Links\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Public\Videos\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Documents\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Public\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Public\Downloads\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Videos\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Public\Desktop\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Public\Libraries\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files (x86)\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\Music\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Users\Public\Music\desktop.ini	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\SpherePixelShader.cso	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\sendforsignature.svg.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ml.dll.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsStoreLogo.contrast-white_scale-100.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_retina.png.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppStoreLogo.scale-125.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Snooze.scale-64.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\ui-strings.js	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-36.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\Microsoft Office\root\vfs\System\VEN2232.OLB.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_selected_18.svg	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.scale-150.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-100_contrast-black.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-200_contrast-white.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-256_contrast-black.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Close2x.png.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-200_contrast-black.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedAppList.scale-200_contrast-white.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\logo.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-16_altform-unplated_contrast-white.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_contrast-white.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-60_altform-unplated.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-150_contrast-white.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.scale-100.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\ui-strings.js.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WEBSANDBOX.DLL.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\NewConvert.tiff	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\LargeTile.scale-125.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\ui-strings.js.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Microsoft.People.Relevance.QueryClient.winmd	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_File_Transfer_Incoming.m4a	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-100.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ar.dll.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Grid.Grouping.Windows.dll	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsLargeTile.scale-100.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\SoftLandingAssetDark.gif.DATA	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-16_altform-lightunplated.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-100_contrast-white.png	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.id[C0B6D75C-3316].[[email protected]].mango	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	C:\Windows\System32\vds.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	C:\Windows\System32\vds.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	C:\Windows\System32\vds.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	C:\Windows\System32\vds.exe	N/A

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\wbengine.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\wbengine.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\system32\wbengine.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1296 wrote to memory of 3932	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 1296 wrote to memory of 3932	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 1296 wrote to memory of 3060	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 1296 wrote to memory of 3060	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 3932 wrote to memory of 2752	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 3932 wrote to memory of 2752	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 3060 wrote to memory of 3940	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 3060 wrote to memory of 3940	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 3060 wrote to memory of 1896	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 3060 wrote to memory of 1896	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 3932 wrote to memory of 3280	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 3932 wrote to memory of 3280	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 3932 wrote to memory of 444	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 3932 wrote to memory of 444	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 3932 wrote to memory of 2436	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Conhost.exe
PID 3932 wrote to memory of 2436	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Conhost.exe
PID 3932 wrote to memory of 2792	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\wbadmin.exe
PID 3932 wrote to memory of 2792	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\wbadmin.exe
PID 1296 wrote to memory of 792	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 792	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 792	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 4872	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 4872	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 4872	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 4720	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 4720	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 4720	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 464	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 464	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 464	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\SysWOW64\mshta.exe
PID 1296 wrote to memory of 1904	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 1296 wrote to memory of 1904	N/A	C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe	C:\Windows\system32\cmd.exe
PID 1904 wrote to memory of 3692	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 1904 wrote to memory of 3692	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 1904 wrote to memory of 1732	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1904 wrote to memory of 1732	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 1904 wrote to memory of 716	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 1904 wrote to memory of 716	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 1904 wrote to memory of 2248	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 1904 wrote to memory of 2248	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 1904 wrote to memory of 1896	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\wbadmin.exe
PID 1904 wrote to memory of 1896	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe"

C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	71.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	79.190.18.2.in-addr.arpa	udp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp

Files

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[C0B6D75C-3316].[[email protected]].mango

MD5	0f173fb5a01b17a32ff5ebe68870ef83
SHA1	8336c5c3df58a6fe7a56704de7af1ce8022aaa51
SHA256	aa7b7d703b57009843145963d914c63746439a78b705112e97c40c0df7e3ca53
SHA512	161c480addda6affdf8e0728b101a6d007ed1ae3c7cdc6ebb05a868df3443957c5c1d5334af7e1ba5fade9307ee23f0c55feb9fb80977d66f68ef3a329f597a4

C:\info.hta

MD5	3a8d6ad08807b7524bd52dbed00328a0
SHA1	2c123e6a44b0672b67a1eac8a8ae6272a731dd3c
SHA256	03a19b1642924b0ddb92a680a35067b088fa4cd37385807b6e1306efa527dd39
SHA512	41b701444ea84e1168a7ff22b3b88d1b42143ddde2da715c4c44634f251cabddf77e69f9e9b7141975d76597f58141669fddbfaa1af41b5ab6f68ae115009b8e

Sample ID	240502-2dta4sac27
Target	2024-05-02_d35b28401ff2f12c55296e95fd0b82ad_phobos
SHA256	7fb02a35bf5c3ae045dd33295ebc72e2c927684058c0194207f2cf3226571f3a
Tags	phobos defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Analysis Report

2024-09-11 01:17

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files