Malware Analysis Report

2024-09-11 01:04

Sample ID 240703-bq8cpathmk
Target 2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos
SHA256 8f8d76d157e5e4dbd7210cb19ce27b3734147c430a534143c97b90c1f5e35249
Tags
phobos defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8f8d76d157e5e4dbd7210cb19ce27b3734147c430a534143c97b90c1f5e35249

Threat Level: Known bad

The file 2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos was found to be: Known bad.

Malicious Activity Summary

phobos defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer

Phobos

Renames multiple (519) files with added filename extension

Modifies boot configuration data using bcdedit

Renames multiple (314) files with added filename extension

Deletes shadow copies

Modifies Windows Firewall

Deletes backup catalog

Checks computer location settings

Reads user/profile data of web browsers

Drops startup file

Drops desktop.ini file(s)

Adds Run key to start application

Drops file in Program Files directory

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Uses Task Scheduler COM API

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Interacts with shadow copies

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Windows Management Instrumentation
T1047
Command and Scripting Interpreter
T1059
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Event Triggered Execution
T1546
Netsh Helper DLL
T1546.007
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Event Triggered Execution
T1546
Netsh Helper DLL
T1546.007
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Impair Defenses
T1562
Disable or Modify System Firewall
T1562.004
Modify Registry
T1112
Direct Volume Access
T1006
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-03 01:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-03 01:22

Reported

2024-07-03 01:24

Platform

win7-20240419-en

Max time kernel

149s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (314) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe" C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe" C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KIMP0IT\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\QE6QYUAB\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XHX8DMHP\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIYQP923\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\334W6EWO\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\L54IQZD2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ASWW3GU0\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\B5JWTXJ4\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02503U.BMP C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Class.zip C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Montevideo.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\RMNSQUE.INF.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\excel.exe.manifest.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_en.dub.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_disabled.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107266.WMF.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Aspect.thmx.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\WMPDMC.exe.mui C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Swift_Current C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237759.WMF C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382963.JPG C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN01164_.WMF.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15020_.GIF.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME03.CSS.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB2A.BDR C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\IPDSINTL.DLL.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jre7\bin\jpeg.dll.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0183574.WMF C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Pushpin.eftx C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Installed_schemas14.xss.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUNGLE.HTM.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jre7\bin\jaas_nt.dll.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14533_.GIF C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GIFT.XML C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\FormatImport.DVR-MS.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103262.WMF C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18219_.WMF.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ.DLL.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART11.BDR C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryLetter.dotx C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dataset.zip C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.id[1A333942-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Windows Media Player\de-DE\WMPDMCCore.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2036 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 2668 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1884 wrote to memory of 2668 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1884 wrote to memory of 2668 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2160 wrote to memory of 1844 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2160 wrote to memory of 1844 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2160 wrote to memory of 1844 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2160 wrote to memory of 540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2160 wrote to memory of 540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2160 wrote to memory of 540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1884 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1884 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1884 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1884 wrote to memory of 1284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1884 wrote to memory of 1284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1884 wrote to memory of 1284 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1884 wrote to memory of 320 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1884 wrote to memory of 320 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1884 wrote to memory of 320 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1884 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1884 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1884 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2036 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2036 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 2784 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2532 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2424 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2784 wrote to memory of 2424 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2784 wrote to memory of 2424 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2784 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 2336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2784 wrote to memory of 2336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2784 wrote to memory of 2336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe"

C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

N/A

Files

C:\info.hta

MD5 daca5e52ed9e88cfd7e10e1b8577f6f6
SHA1 dc09086188a91ba148e91613fb9a2fa25a45b6e0
SHA256 b0cd36b9562ff8c8c05937e0933ea6624cf03c70c1577bc62ca8e62c9848fcbf
SHA512 e10a41e0863e279e6481a70769934c1eab39a3f0692fdee5c5b6109cb7321e2952a510768974ef0d4bb261406c8cfae0d699ec39cc58a2c2fab3e7d530ef4a3f

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-03 01:22

Reported

2024-07-03 01:24

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (519) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe" C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe" C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookMedTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\sfs_icons.png.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\mojo_core.dll.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Common Files\System\en-US\wab32res.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.ArchiverProviders.dll C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected][7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-20_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\7-Zip\Lang\mk.txt.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_04.jpg C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons2x.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\es-419_get.svg.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-32.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.Format.ps1xml C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\ui-strings.js.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\README.txt C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-20_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\MixerBranding\mixer_nopic.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\editpdf-selector.js C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\EnsoUI\dashboard_slomo_ON.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\ui-strings.js.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\MSASignIn.dll C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Toast.svg C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoDev.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\MSFT_PackageManagement.schema.mfl C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\StoreLogo.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.id[7CFCEA60-3333].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 968 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 968 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 968 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 968 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 5084 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5084 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5096 wrote to memory of 2580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 5096 wrote to memory of 2580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 5084 wrote to memory of 4296 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5084 wrote to memory of 4296 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5096 wrote to memory of 3576 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5096 wrote to memory of 3576 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5096 wrote to memory of 2604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5096 wrote to memory of 2604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5096 wrote to memory of 2952 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5096 wrote to memory of 2952 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5096 wrote to memory of 3208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 5096 wrote to memory of 3208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 968 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 968 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 968 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4472 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4472 wrote to memory of 1168 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4472 wrote to memory of 1168 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4472 wrote to memory of 4316 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4472 wrote to memory of 4316 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4472 wrote to memory of 1588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4472 wrote to memory of 1588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4472 wrote to memory of 2084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4472 wrote to memory of 2084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe"

C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-07-03_5ec053bc341fb1b3504bd95b1bba7d71_phobos.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[7CFCEA60-3333].[[email protected]].faust

MD5 3f4e1d13e74b1a2dcaacd4a6318f4ba2
SHA1 646f7d73f26cd338521232e86b29c03cbc462852
SHA256 90226cb91d1584408879d27faf36a02d5bef250a041714db32ded1fa35a7b0eb
SHA512 4483434be5dcfc63c892ca8ea717b3daf43d690f852ff2a58f5202941421debecc004f41cb705f57514dabcbacb9edc8ca989425c78ca9eddaad18c075b35e85

C:\info.hta

MD5 93d595ffb75c20b8712a035ce978d1a2
SHA1 8adb24a3875968d53e7456c407b298b9f8446eca
SHA256 67b01cd5ba35e4ff6a978d4285ca04f555ca66e4422a63bb8855e261eba88531
SHA512 03ff886c34a3df81b771282ab497c1ce923598453e00440c9d4a97909cce10740ebd89a2298d935b619b7dfa44b3172793a7479eadd5c13ec4f3d00da1532814