Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02-07-2024 23:32
Static task
static1
Behavioral task
behavioral1
Sample
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe
Resource
win10v2004-20240508-en
General
-
Target
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe
-
Size
55KB
-
MD5
ec656f2e9d53e5c30ae03301cc4348ea
-
SHA1
abe66e0123a837890ff0f64039e5cc9b91549866
-
SHA256
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08
-
SHA512
dc3a0e6d74954f2662cf7196e4b63cffbba4e6d41801767ef91c91eab853af3e3d1f6a529b0415bffc0269adb4030e57870865838237ac6cc54fb866379df554
-
SSDEEP
1536:YNeRBl5PT/rx1mzwRMSTdLpJZtqoQOcO:YQRrmzwR5JAOF
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 1560 bcdedit.exe 1952 bcdedit.exe 1348 bcdedit.exe 2080 bcdedit.exe -
Renames multiple (313) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exewbadmin.exepid process 2112 wbadmin.exe 272 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 1148 netsh.exe 2656 netsh.exe -
Drops startup file 3 IoCs
Processes:
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08 = "C:\\Users\\Admin\\AppData\\Local\\2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe" 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08 = "C:\\Users\\Admin\\AppData\\Local\\2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe" 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XHX8DMHP\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ASWW3GU0\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Public\Music\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\334W6EWO\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\B5JWTXJ4\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KIMP0IT\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exedescription ioc process File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Engine.resources.dll 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SCHOL_02.MID 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\VCTRN_01.MID 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Foundry.xml.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Couture.thmx.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Flow.xml.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\WMPMediaSharing.dll.mui 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341475.JPG 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB11.BDR 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Internet Explorer\msdbg2.dll 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\BloodPressureTracker.xltx.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107288.WMF 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02404_.WMF 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\WATERMAR.INF.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\service.js 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTAREA.JPG 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299763.WMF.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\timeZones.js 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\COMPASS.INF 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.INF.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files\7-Zip\Lang\fi.txt.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0228959.WMF.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384895.JPG 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00784_.WMF 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14579_.GIF 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.id[B47A1C67-2822].[[email protected]].eight 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Karachi 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excel.exe.manifest 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_disable.gif 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PULLQUOTEBB.DPV 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\WMPDMC.exe.mui 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1520 vssadmin.exe 2700 vssadmin.exe -
Processes:
mshta.exemshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exepid process 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe Token: SeBackupPrivilege 1588 vssvc.exe Token: SeRestorePrivilege 1588 vssvc.exe Token: SeAuditPrivilege 1588 vssvc.exe Token: SeIncreaseQuotaPrivilege 1296 WMIC.exe Token: SeSecurityPrivilege 1296 WMIC.exe Token: SeTakeOwnershipPrivilege 1296 WMIC.exe Token: SeLoadDriverPrivilege 1296 WMIC.exe Token: SeSystemProfilePrivilege 1296 WMIC.exe Token: SeSystemtimePrivilege 1296 WMIC.exe Token: SeProfSingleProcessPrivilege 1296 WMIC.exe Token: SeIncBasePriorityPrivilege 1296 WMIC.exe Token: SeCreatePagefilePrivilege 1296 WMIC.exe Token: SeBackupPrivilege 1296 WMIC.exe Token: SeRestorePrivilege 1296 WMIC.exe Token: SeShutdownPrivilege 1296 WMIC.exe Token: SeDebugPrivilege 1296 WMIC.exe Token: SeSystemEnvironmentPrivilege 1296 WMIC.exe Token: SeRemoteShutdownPrivilege 1296 WMIC.exe Token: SeUndockPrivilege 1296 WMIC.exe Token: SeManageVolumePrivilege 1296 WMIC.exe Token: 33 1296 WMIC.exe Token: 34 1296 WMIC.exe Token: 35 1296 WMIC.exe Token: SeIncreaseQuotaPrivilege 1296 WMIC.exe Token: SeSecurityPrivilege 1296 WMIC.exe Token: SeTakeOwnershipPrivilege 1296 WMIC.exe Token: SeLoadDriverPrivilege 1296 WMIC.exe Token: SeSystemProfilePrivilege 1296 WMIC.exe Token: SeSystemtimePrivilege 1296 WMIC.exe Token: SeProfSingleProcessPrivilege 1296 WMIC.exe Token: SeIncBasePriorityPrivilege 1296 WMIC.exe Token: SeCreatePagefilePrivilege 1296 WMIC.exe Token: SeBackupPrivilege 1296 WMIC.exe Token: SeRestorePrivilege 1296 WMIC.exe Token: SeShutdownPrivilege 1296 WMIC.exe Token: SeDebugPrivilege 1296 WMIC.exe Token: SeSystemEnvironmentPrivilege 1296 WMIC.exe Token: SeRemoteShutdownPrivilege 1296 WMIC.exe Token: SeUndockPrivilege 1296 WMIC.exe Token: SeManageVolumePrivilege 1296 WMIC.exe Token: 33 1296 WMIC.exe Token: 34 1296 WMIC.exe Token: 35 1296 WMIC.exe Token: SeBackupPrivilege 2948 wbengine.exe Token: SeRestorePrivilege 2948 wbengine.exe Token: SeSecurityPrivilege 2948 wbengine.exe Token: SeIncreaseQuotaPrivilege 868 WMIC.exe Token: SeSecurityPrivilege 868 WMIC.exe Token: SeTakeOwnershipPrivilege 868 WMIC.exe Token: SeLoadDriverPrivilege 868 WMIC.exe Token: SeSystemProfilePrivilege 868 WMIC.exe Token: SeSystemtimePrivilege 868 WMIC.exe Token: SeProfSingleProcessPrivilege 868 WMIC.exe Token: SeIncBasePriorityPrivilege 868 WMIC.exe Token: SeCreatePagefilePrivilege 868 WMIC.exe Token: SeBackupPrivilege 868 WMIC.exe Token: SeRestorePrivilege 868 WMIC.exe Token: SeShutdownPrivilege 868 WMIC.exe Token: SeDebugPrivilege 868 WMIC.exe Token: SeSystemEnvironmentPrivilege 868 WMIC.exe Token: SeRemoteShutdownPrivilege 868 WMIC.exe Token: SeUndockPrivilege 868 WMIC.exe Token: SeManageVolumePrivilege 868 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.execmd.execmd.execmd.exedescription pid process target process PID 2392 wrote to memory of 1276 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 2392 wrote to memory of 2820 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 2392 wrote to memory of 2820 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 2392 wrote to memory of 2820 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 2392 wrote to memory of 2820 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 2392 wrote to memory of 1276 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 2392 wrote to memory of 1276 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 2392 wrote to memory of 1276 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 1276 wrote to memory of 2700 1276 cmd.exe vssadmin.exe PID 1276 wrote to memory of 2700 1276 cmd.exe vssadmin.exe PID 1276 wrote to memory of 2700 1276 cmd.exe vssadmin.exe PID 2820 wrote to memory of 2656 2820 cmd.exe netsh.exe PID 2820 wrote to memory of 2656 2820 cmd.exe netsh.exe PID 2820 wrote to memory of 2656 2820 cmd.exe netsh.exe PID 2820 wrote to memory of 1148 2820 cmd.exe netsh.exe PID 2820 wrote to memory of 1148 2820 cmd.exe netsh.exe PID 2820 wrote to memory of 1148 2820 cmd.exe netsh.exe PID 1276 wrote to memory of 1296 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1296 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1296 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1560 1276 cmd.exe bcdedit.exe PID 1276 wrote to memory of 1560 1276 cmd.exe bcdedit.exe PID 1276 wrote to memory of 1560 1276 cmd.exe bcdedit.exe PID 1276 wrote to memory of 1952 1276 cmd.exe bcdedit.exe PID 1276 wrote to memory of 1952 1276 cmd.exe bcdedit.exe PID 1276 wrote to memory of 1952 1276 cmd.exe bcdedit.exe PID 1276 wrote to memory of 2112 1276 cmd.exe wbadmin.exe PID 1276 wrote to memory of 2112 1276 cmd.exe wbadmin.exe PID 1276 wrote to memory of 2112 1276 cmd.exe wbadmin.exe PID 2392 wrote to memory of 2820 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 2820 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 2820 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 2820 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 2292 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 2292 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 2292 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 2292 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 2164 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 2164 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 2164 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 2164 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 220 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 220 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 220 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 220 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe mshta.exe PID 2392 wrote to memory of 1040 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 2392 wrote to memory of 1040 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 2392 wrote to memory of 1040 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 2392 wrote to memory of 1040 2392 2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe cmd.exe PID 1040 wrote to memory of 1520 1040 cmd.exe vssadmin.exe PID 1040 wrote to memory of 1520 1040 cmd.exe vssadmin.exe PID 1040 wrote to memory of 1520 1040 cmd.exe vssadmin.exe PID 1040 wrote to memory of 868 1040 cmd.exe WMIC.exe PID 1040 wrote to memory of 868 1040 cmd.exe WMIC.exe PID 1040 wrote to memory of 868 1040 cmd.exe WMIC.exe PID 1040 wrote to memory of 1348 1040 cmd.exe bcdedit.exe PID 1040 wrote to memory of 1348 1040 cmd.exe bcdedit.exe PID 1040 wrote to memory of 1348 1040 cmd.exe bcdedit.exe PID 1040 wrote to memory of 2080 1040 cmd.exe bcdedit.exe PID 1040 wrote to memory of 2080 1040 cmd.exe bcdedit.exe PID 1040 wrote to memory of 2080 1040 cmd.exe bcdedit.exe PID 1040 wrote to memory of 272 1040 cmd.exe wbadmin.exe PID 1040 wrote to memory of 272 1040 cmd.exe wbadmin.exe PID 1040 wrote to memory of 272 1040 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe"C:\Users\Admin\AppData\Local\Temp\2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe"C:\Users\Admin\AppData\Local\Temp\2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08.exe"2⤵PID:2404
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2700 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1296 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1560 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1952 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2112 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2656 -
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1148 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2820 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2292 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2164 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:220 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1520 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:868 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1348 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2080 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:272
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1080
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:204
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD58ab748c6871be62e85b1cc3bfc3f6cc5
SHA15dd9ee741e257079022914ece8a07739f9933462
SHA25606afca935dadb8022872ba9e803520bdbb3841fa8e37862ea2fd680d54ac2c2b
SHA51251f7c4cd9b690c9fb4295eeaf8ad319558d816bdb51f02d4a34a442c14ee205511d56c8cdbfdce2bbda90374c4612923ac19b567649b96399e479cdf8c021547