Analysis
-
max time kernel
97s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
07-07-2024 16:49
Static task
static1
Behavioral task
behavioral1
Sample
Fast.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Fast.exe
Resource
win10v2004-20240704-en
General
-
Target
Fast.exe
-
Size
66KB
-
MD5
87d6d2488b1260e70f4042bf1f292529
-
SHA1
161f9a79f8197c9b5de1beb7bd4d425d5c23b45b
-
SHA256
45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f
-
SHA512
a9d3930de1ff5849e61d1807c6de4b063790dc03f7e4f3f2101cbddde55002ffcc85d2ff433b753a5936403feedbc93c0f3658ffb5e8051d00ba58641e6afda7
-
SSDEEP
1536:/NeRBl5PT/rx1mzwRMSTdLpJy/jIlkugRGVy/SR1qo+tEgfNni:/QRrmzwR5JysFV12i
Malware Config
Extracted
C:\info.hta
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 1456 bcdedit.exe 1656 bcdedit.exe 212 bcdedit.exe 1548 bcdedit.exe -
Renames multiple (245) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exewbadmin.exepid process 2808 wbadmin.exe 2976 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 1528 netsh.exe 1752 netsh.exe -
Drops startup file 1 IoCs
Processes:
Fast.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\Fast.exe Fast.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Fast.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe" Fast.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe" Fast.exe -
Drops desktop.ini file(s) 14 IoCs
Processes:
Fast.exedescription ioc process File opened for modification C:\Program Files (x86)\desktop.ini Fast.exe File opened for modification C:\Program Files\desktop.ini Fast.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini Fast.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini Fast.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini Fast.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini Fast.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini Fast.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini Fast.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini Fast.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini Fast.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini Fast.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini Fast.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI Fast.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Fast.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.id[340E0446-3483].[[email protected]].8base Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar Fast.exe File created C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.id[340E0446-3483].[[email protected]].8base Fast.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287417.WMF Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1B.GIF Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341742.JPG Fast.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.id[340E0446-3483].[[email protected]].8base Fast.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files\Windows Media Player\fr-FR\wmpnscfg.exe.mui Fast.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384862.JPG Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Aspect.eftx Fast.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14582_.GIF.id[340E0446-3483].[[email protected]].8base Fast.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14515_.GIF Fast.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml Fast.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02091_.WMF.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml Fast.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\THMBNAIL.PNG.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02285_.WMF Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css Fast.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\METCONV.DLL.id[340E0446-3483].[[email protected]].8base Fast.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Apex.thmx.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png Fast.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE Fast.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\MAPIR.DLL.IDX_DLL.id[340E0446-3483].[[email protected]].8base Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\DRUMROLL.WAV.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv Fast.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png Fast.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099193.GIF.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files\7-Zip\History.txt Fast.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll Fast.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01160_.WMF Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ACCOLKI.DLL.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll Fast.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\slideShow.js Fast.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Urban.xml.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_COL.HXT Fast.exe File opened for modification C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui Fast.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png Fast.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Teal.css Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198234.WMF Fast.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00389_.WMF.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02371_.WMF Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.id[340E0446-3483].[[email protected]].8base Fast.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEINTL.DLL.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_hu.dll Fast.exe File created C:\Program Files\OpenUpdate.ADT.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png Fast.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099176.WMF.id[340E0446-3483].[[email protected]].8base Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18198_.WMF Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImageMask.bmp Fast.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt Fast.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2612 vssadmin.exe 484 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Fast.exepid process 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe 2292 Fast.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
Fast.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeDebugPrivilege 2292 Fast.exe Token: SeBackupPrivilege 1884 vssvc.exe Token: SeRestorePrivilege 1884 vssvc.exe Token: SeAuditPrivilege 1884 vssvc.exe Token: SeIncreaseQuotaPrivilege 2972 WMIC.exe Token: SeSecurityPrivilege 2972 WMIC.exe Token: SeTakeOwnershipPrivilege 2972 WMIC.exe Token: SeLoadDriverPrivilege 2972 WMIC.exe Token: SeSystemProfilePrivilege 2972 WMIC.exe Token: SeSystemtimePrivilege 2972 WMIC.exe Token: SeProfSingleProcessPrivilege 2972 WMIC.exe Token: SeIncBasePriorityPrivilege 2972 WMIC.exe Token: SeCreatePagefilePrivilege 2972 WMIC.exe Token: SeBackupPrivilege 2972 WMIC.exe Token: SeRestorePrivilege 2972 WMIC.exe Token: SeShutdownPrivilege 2972 WMIC.exe Token: SeDebugPrivilege 2972 WMIC.exe Token: SeSystemEnvironmentPrivilege 2972 WMIC.exe Token: SeRemoteShutdownPrivilege 2972 WMIC.exe Token: SeUndockPrivilege 2972 WMIC.exe Token: SeManageVolumePrivilege 2972 WMIC.exe Token: 33 2972 WMIC.exe Token: 34 2972 WMIC.exe Token: 35 2972 WMIC.exe Token: SeIncreaseQuotaPrivilege 2972 WMIC.exe Token: SeSecurityPrivilege 2972 WMIC.exe Token: SeTakeOwnershipPrivilege 2972 WMIC.exe Token: SeLoadDriverPrivilege 2972 WMIC.exe Token: SeSystemProfilePrivilege 2972 WMIC.exe Token: SeSystemtimePrivilege 2972 WMIC.exe Token: SeProfSingleProcessPrivilege 2972 WMIC.exe Token: SeIncBasePriorityPrivilege 2972 WMIC.exe Token: SeCreatePagefilePrivilege 2972 WMIC.exe Token: SeBackupPrivilege 2972 WMIC.exe Token: SeRestorePrivilege 2972 WMIC.exe Token: SeShutdownPrivilege 2972 WMIC.exe Token: SeDebugPrivilege 2972 WMIC.exe Token: SeSystemEnvironmentPrivilege 2972 WMIC.exe Token: SeRemoteShutdownPrivilege 2972 WMIC.exe Token: SeUndockPrivilege 2972 WMIC.exe Token: SeManageVolumePrivilege 2972 WMIC.exe Token: 33 2972 WMIC.exe Token: 34 2972 WMIC.exe Token: 35 2972 WMIC.exe Token: SeBackupPrivilege 2764 wbengine.exe Token: SeRestorePrivilege 2764 wbengine.exe Token: SeSecurityPrivilege 2764 wbengine.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
Fast.execmd.execmd.exedescription pid process target process PID 2292 wrote to memory of 2980 2292 Fast.exe cmd.exe PID 2292 wrote to memory of 2980 2292 Fast.exe cmd.exe PID 2292 wrote to memory of 2980 2292 Fast.exe cmd.exe PID 2292 wrote to memory of 2980 2292 Fast.exe cmd.exe PID 2292 wrote to memory of 2884 2292 Fast.exe cmd.exe PID 2292 wrote to memory of 2884 2292 Fast.exe cmd.exe PID 2292 wrote to memory of 2884 2292 Fast.exe cmd.exe PID 2292 wrote to memory of 2884 2292 Fast.exe cmd.exe PID 2980 wrote to memory of 2612 2980 cmd.exe vssadmin.exe PID 2980 wrote to memory of 2612 2980 cmd.exe vssadmin.exe PID 2980 wrote to memory of 2612 2980 cmd.exe vssadmin.exe PID 2884 wrote to memory of 1528 2884 cmd.exe netsh.exe PID 2884 wrote to memory of 1528 2884 cmd.exe netsh.exe PID 2884 wrote to memory of 1528 2884 cmd.exe netsh.exe PID 2884 wrote to memory of 1752 2884 cmd.exe netsh.exe PID 2884 wrote to memory of 1752 2884 cmd.exe netsh.exe PID 2884 wrote to memory of 1752 2884 cmd.exe netsh.exe PID 2980 wrote to memory of 2972 2980 cmd.exe WMIC.exe PID 2980 wrote to memory of 2972 2980 cmd.exe WMIC.exe PID 2980 wrote to memory of 2972 2980 cmd.exe WMIC.exe PID 2980 wrote to memory of 1456 2980 cmd.exe bcdedit.exe PID 2980 wrote to memory of 1456 2980 cmd.exe bcdedit.exe PID 2980 wrote to memory of 1456 2980 cmd.exe bcdedit.exe PID 2980 wrote to memory of 1656 2980 cmd.exe bcdedit.exe PID 2980 wrote to memory of 1656 2980 cmd.exe bcdedit.exe PID 2980 wrote to memory of 1656 2980 cmd.exe bcdedit.exe PID 2980 wrote to memory of 2808 2980 cmd.exe wbadmin.exe PID 2980 wrote to memory of 2808 2980 cmd.exe wbadmin.exe PID 2980 wrote to memory of 2808 2980 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fast.exe"C:\Users\Admin\AppData\Local\Temp\Fast.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\Fast.exe"C:\Users\Admin\AppData\Local\Temp\Fast.exe"2⤵PID:2728
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2612 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1456 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1656 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2808 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1528 -
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1752 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵PID:1080
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵PID:900
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵PID:2328
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵PID:2224
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵PID:1420
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:484 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:2856
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:212 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1548 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2976
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1888
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1604
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.id[340E0446-3483].[[email protected]].8base
Filesize24.4MB
MD54e6a3d1a10d894bf394bf71ebd8f9d5e
SHA1f4eb95f1565e14210531ddc087fd19de893d56ef
SHA256a2a46f03ca77548b6257fe4c81029dbc4ad09477b5e299f64dd30ba44f1e2b5f
SHA51259a04a3a67a22e225b8c7f4d99803ef3172b7374588adfb52eeffddd1dfacf1a677cfe240c81f69fbad17fc183840d7d575dd497d4c4a42bfaa95141c7b9ef1d
-
Filesize
9KB
MD532ba90b2bcea58e674b434d108abb638
SHA1d4976f72b5d601bff95818dd9d05eacf4caacaa5
SHA256ad26790201e8bba346a5ab50e9fb7e1f8eabb8600ef57f66d32e3f62a6757054
SHA51293c9b1d8070aaa85d74228acb852f621a1346f8a70d8a1519c269775d91eca74b69e4f81370927354c63085dbd1cdf56e66a4abc6b5a947437ba8f97df6244c7