Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 11:25
Static task
static1
Behavioral task
behavioral1
Sample
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe
Resource
win10v2004-20240508-en
General
-
Target
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe
-
Size
56KB
-
MD5
531aeb4fc0b06a16dfe2b047b33ea027
-
SHA1
c2858ba4814885399d7f47f0f2cd4f1fee1d3754
-
SHA256
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47
-
SHA512
b0718cbdd3f5996a2a87b0abd5d7161cb3295dbc612342e2729f4919e5e4ee915ba9e5798ea3afad344d4d2385919f517165c1214d90590efffba11f04ea7655
-
SSDEEP
768:6vrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EWQKB77b4M/z8:ENeRBl5PT/rx1mzwRMSTdLpJWnIMQR
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 2900 bcdedit.exe 4036 bcdedit.exe 3356 bcdedit.exe 4440 bcdedit.exe -
Renames multiple (514) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exewbadmin.exepid process 4448 wbadmin.exe 3200 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 4460 netsh.exe 2216 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe -
Drops startup file 3 IoCs
Processes:
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47 = "C:\\Users\\Admin\\AppData\\Local\\00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe" 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47 = "C:\\Users\\Admin\\AppData\\Local\\00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe" 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Links\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Public\Music\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Public\Videos\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files (x86)\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Public\Documents\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Public\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Music\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe -
Drops file in Program Files directory 64 IoCs
Processes:
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_whats_new_v2.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sl-SI\View3d\3DViewerProductDescription-universal.xml 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as90.xsl 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.MsuProvider.resources.dll.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\he.pak.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\THMBNAIL.PNG.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadce.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\MedTile.scale-125.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteWideTile.scale-400.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\MedTile.scale-200.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\upe.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\BLENDS.INF 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SKY.ELM.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-100.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\Common.ExcelServices.Resources.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-100.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-128.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-200.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlOuterCircleHover.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\ui-strings.js 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\th.pak 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\ui-strings.js 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-125.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-60.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\trdtv2r41.xsl 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-200.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.winmd 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-100_contrast-black.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ui-strings.js.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-100.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\kweather.png 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_47.dll.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.id[64F51CAD-3546].[[email protected]].faust 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vds.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1340 vssadmin.exe 1788 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exepid process 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe Token: SeBackupPrivilege 5080 vssvc.exe Token: SeRestorePrivilege 5080 vssvc.exe Token: SeAuditPrivilege 5080 vssvc.exe Token: SeIncreaseQuotaPrivilege 1324 WMIC.exe Token: SeSecurityPrivilege 1324 WMIC.exe Token: SeTakeOwnershipPrivilege 1324 WMIC.exe Token: SeLoadDriverPrivilege 1324 WMIC.exe Token: SeSystemProfilePrivilege 1324 WMIC.exe Token: SeSystemtimePrivilege 1324 WMIC.exe Token: SeProfSingleProcessPrivilege 1324 WMIC.exe Token: SeIncBasePriorityPrivilege 1324 WMIC.exe Token: SeCreatePagefilePrivilege 1324 WMIC.exe Token: SeBackupPrivilege 1324 WMIC.exe Token: SeRestorePrivilege 1324 WMIC.exe Token: SeShutdownPrivilege 1324 WMIC.exe Token: SeDebugPrivilege 1324 WMIC.exe Token: SeSystemEnvironmentPrivilege 1324 WMIC.exe Token: SeRemoteShutdownPrivilege 1324 WMIC.exe Token: SeUndockPrivilege 1324 WMIC.exe Token: SeManageVolumePrivilege 1324 WMIC.exe Token: 33 1324 WMIC.exe Token: 34 1324 WMIC.exe Token: 35 1324 WMIC.exe Token: 36 1324 WMIC.exe Token: SeIncreaseQuotaPrivilege 1324 WMIC.exe Token: SeSecurityPrivilege 1324 WMIC.exe Token: SeTakeOwnershipPrivilege 1324 WMIC.exe Token: SeLoadDriverPrivilege 1324 WMIC.exe Token: SeSystemProfilePrivilege 1324 WMIC.exe Token: SeSystemtimePrivilege 1324 WMIC.exe Token: SeProfSingleProcessPrivilege 1324 WMIC.exe Token: SeIncBasePriorityPrivilege 1324 WMIC.exe Token: SeCreatePagefilePrivilege 1324 WMIC.exe Token: SeBackupPrivilege 1324 WMIC.exe Token: SeRestorePrivilege 1324 WMIC.exe Token: SeShutdownPrivilege 1324 WMIC.exe Token: SeDebugPrivilege 1324 WMIC.exe Token: SeSystemEnvironmentPrivilege 1324 WMIC.exe Token: SeRemoteShutdownPrivilege 1324 WMIC.exe Token: SeUndockPrivilege 1324 WMIC.exe Token: SeManageVolumePrivilege 1324 WMIC.exe Token: 33 1324 WMIC.exe Token: 34 1324 WMIC.exe Token: 35 1324 WMIC.exe Token: 36 1324 WMIC.exe Token: SeBackupPrivilege 1948 wbengine.exe Token: SeRestorePrivilege 1948 wbengine.exe Token: SeSecurityPrivilege 1948 wbengine.exe Token: SeIncreaseQuotaPrivilege 2748 WMIC.exe Token: SeSecurityPrivilege 2748 WMIC.exe Token: SeTakeOwnershipPrivilege 2748 WMIC.exe Token: SeLoadDriverPrivilege 2748 WMIC.exe Token: SeSystemProfilePrivilege 2748 WMIC.exe Token: SeSystemtimePrivilege 2748 WMIC.exe Token: SeProfSingleProcessPrivilege 2748 WMIC.exe Token: SeIncBasePriorityPrivilege 2748 WMIC.exe Token: SeCreatePagefilePrivilege 2748 WMIC.exe Token: SeBackupPrivilege 2748 WMIC.exe Token: SeRestorePrivilege 2748 WMIC.exe Token: SeShutdownPrivilege 2748 WMIC.exe Token: SeDebugPrivilege 2748 WMIC.exe Token: SeSystemEnvironmentPrivilege 2748 WMIC.exe Token: SeRemoteShutdownPrivilege 2748 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.execmd.execmd.execmd.exedescription pid process target process PID 4272 wrote to memory of 4316 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe cmd.exe PID 4272 wrote to memory of 4316 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe cmd.exe PID 4272 wrote to memory of 4032 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe cmd.exe PID 4272 wrote to memory of 4032 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe cmd.exe PID 4032 wrote to memory of 2216 4032 cmd.exe netsh.exe PID 4032 wrote to memory of 2216 4032 cmd.exe netsh.exe PID 4316 wrote to memory of 1340 4316 cmd.exe vssadmin.exe PID 4316 wrote to memory of 1340 4316 cmd.exe vssadmin.exe PID 4032 wrote to memory of 4460 4032 cmd.exe netsh.exe PID 4032 wrote to memory of 4460 4032 cmd.exe netsh.exe PID 4316 wrote to memory of 1324 4316 cmd.exe WMIC.exe PID 4316 wrote to memory of 1324 4316 cmd.exe WMIC.exe PID 4316 wrote to memory of 2900 4316 cmd.exe bcdedit.exe PID 4316 wrote to memory of 2900 4316 cmd.exe bcdedit.exe PID 4316 wrote to memory of 4036 4316 cmd.exe bcdedit.exe PID 4316 wrote to memory of 4036 4316 cmd.exe bcdedit.exe PID 4316 wrote to memory of 4448 4316 cmd.exe wbadmin.exe PID 4316 wrote to memory of 4448 4316 cmd.exe wbadmin.exe PID 4272 wrote to memory of 2192 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 2192 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 2192 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 3092 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 3092 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 3092 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 4448 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 4448 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 4448 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 1348 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 1348 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 1348 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe mshta.exe PID 4272 wrote to memory of 1368 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe cmd.exe PID 4272 wrote to memory of 1368 4272 00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe cmd.exe PID 1368 wrote to memory of 1788 1368 cmd.exe vssadmin.exe PID 1368 wrote to memory of 1788 1368 cmd.exe vssadmin.exe PID 1368 wrote to memory of 2748 1368 cmd.exe WMIC.exe PID 1368 wrote to memory of 2748 1368 cmd.exe WMIC.exe PID 1368 wrote to memory of 3356 1368 cmd.exe bcdedit.exe PID 1368 wrote to memory of 3356 1368 cmd.exe bcdedit.exe PID 1368 wrote to memory of 4440 1368 cmd.exe bcdedit.exe PID 1368 wrote to memory of 4440 1368 cmd.exe bcdedit.exe PID 1368 wrote to memory of 3200 1368 cmd.exe wbadmin.exe PID 1368 wrote to memory of 3200 1368 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe"C:\Users\Admin\AppData\Local\Temp\00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe"C:\Users\Admin\AppData\Local\Temp\00723db8c6513a9b8a79b8b8cc7d9da9f23a8a5454149ed12768937ca15d1a47.exe"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
3File Deletion
3Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[64F51CAD-3546].[[email protected]].faustFilesize
2.7MB
MD5dea456f99abf815830a0de95b0d9b958
SHA14891843fc3f77096130da3a64be8c74feede77d5
SHA256e5e5121b5218d670777b734d679d1fef7829735113c56cee2b38a21e1483fe67
SHA512d711a79a9195e91f90951a3fb1e309f72ceb913ebee45ba0e574e21a44f5f18dcfc89018d6cdd2fbf03034c1bbde09970bda19325e8c2f9e6d34b62d4a42cd22
-
C:\info.htaFilesize
5KB
MD5436b7e45767745c008de8763e5091f67
SHA1d9a7369ec831a9a8af93e6d1a18fceea5f89dcff
SHA2564b5e7f013f080ef9482ad90ea6fbf441d0c5e55f63426d93a1df28d84be5276a
SHA5129455f9ed22c915f24bdd9d69522341bbcc0e84a254609949e9f935c8295b22574eef9f7924f2ec2ba5396d722d84d08a76f8aafe3780353e64ece70989cc784e