Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 01:07
Static task
static1
Behavioral task
behavioral1
Sample
45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe
Resource
win10v2004-20240704-en
General
-
Target
45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe
-
Size
66KB
-
MD5
87d6d2488b1260e70f4042bf1f292529
-
SHA1
161f9a79f8197c9b5de1beb7bd4d425d5c23b45b
-
SHA256
45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f
-
SHA512
a9d3930de1ff5849e61d1807c6de4b063790dc03f7e4f3f2101cbddde55002ffcc85d2ff433b753a5936403feedbc93c0f3658ffb5e8051d00ba58641e6afda7
-
SSDEEP
1536:/NeRBl5PT/rx1mzwRMSTdLpJy/jIlkugRGVy/SR1qo+tEgfNni:/QRrmzwR5JysFV12i
Malware Config
Extracted
C:\info.hta
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 2104 bcdedit.exe 2416 bcdedit.exe 1620 bcdedit.exe 2712 bcdedit.exe -
Renames multiple (315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 804 wbadmin.exe 2424 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2508 netsh.exe 1372 netsh.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f = "C:\\Users\\Admin\\AppData\\Local\\45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe" 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f = "C:\\Users\\Admin\\AppData\\Local\\45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe" 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\4BMSK8RG\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Public\Documents\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3S5WMYWY\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Public\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\94JSLQ0Q\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FTNKUS60\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Public\Videos\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FOCT73XI\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\Links\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\Music\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\D4RBNUS7\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RI1YAXDZ\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\updater.ini.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\vlc.mo 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUNGLE.HTM 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginMergeLetter.Dotx 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01181_.WMF 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153089.WMF 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\MSOSEC.XML.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FORM.JS 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285808.WMF.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18220_.WMF.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14768_.GIF.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous.png 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105390.WMF 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ONWordAddin.dll.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15276_.GIF 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left.gif.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\DEFAULT.XSL.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.Xml.xml.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02009_.WMF.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8F.GIF 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART5.BDR.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\La_Paz 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGMAIN.XML 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216112.JPG.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1AR.LEX.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files\7-Zip\Lang\pt.txt.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OART.DLL.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0332268.WMF 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SUBMIT.JS.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309664.JPG 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ContactPicker.dll.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\LISTBOX.JPG 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Catamarca.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files\Windows Media Player\wmpnssci.dll 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee90.tlb 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01183_.WMF.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7EN.dub.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00260_.WMF 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\ModifiedTelespace.ico.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.id[9069A95F-3483].[[email protected]].8base 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1744 vssadmin.exe 3056 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe Token: SeBackupPrivilege 1604 vssvc.exe Token: SeRestorePrivilege 1604 vssvc.exe Token: SeAuditPrivilege 1604 vssvc.exe Token: SeIncreaseQuotaPrivilege 856 WMIC.exe Token: SeSecurityPrivilege 856 WMIC.exe Token: SeTakeOwnershipPrivilege 856 WMIC.exe Token: SeLoadDriverPrivilege 856 WMIC.exe Token: SeSystemProfilePrivilege 856 WMIC.exe Token: SeSystemtimePrivilege 856 WMIC.exe Token: SeProfSingleProcessPrivilege 856 WMIC.exe Token: SeIncBasePriorityPrivilege 856 WMIC.exe Token: SeCreatePagefilePrivilege 856 WMIC.exe Token: SeBackupPrivilege 856 WMIC.exe Token: SeRestorePrivilege 856 WMIC.exe Token: SeShutdownPrivilege 856 WMIC.exe Token: SeDebugPrivilege 856 WMIC.exe Token: SeSystemEnvironmentPrivilege 856 WMIC.exe Token: SeRemoteShutdownPrivilege 856 WMIC.exe Token: SeUndockPrivilege 856 WMIC.exe Token: SeManageVolumePrivilege 856 WMIC.exe Token: 33 856 WMIC.exe Token: 34 856 WMIC.exe Token: 35 856 WMIC.exe Token: SeIncreaseQuotaPrivilege 856 WMIC.exe Token: SeSecurityPrivilege 856 WMIC.exe Token: SeTakeOwnershipPrivilege 856 WMIC.exe Token: SeLoadDriverPrivilege 856 WMIC.exe Token: SeSystemProfilePrivilege 856 WMIC.exe Token: SeSystemtimePrivilege 856 WMIC.exe Token: SeProfSingleProcessPrivilege 856 WMIC.exe Token: SeIncBasePriorityPrivilege 856 WMIC.exe Token: SeCreatePagefilePrivilege 856 WMIC.exe Token: SeBackupPrivilege 856 WMIC.exe Token: SeRestorePrivilege 856 WMIC.exe Token: SeShutdownPrivilege 856 WMIC.exe Token: SeDebugPrivilege 856 WMIC.exe Token: SeSystemEnvironmentPrivilege 856 WMIC.exe Token: SeRemoteShutdownPrivilege 856 WMIC.exe Token: SeUndockPrivilege 856 WMIC.exe Token: SeManageVolumePrivilege 856 WMIC.exe Token: 33 856 WMIC.exe Token: 34 856 WMIC.exe Token: 35 856 WMIC.exe Token: SeBackupPrivilege 1484 wbengine.exe Token: SeRestorePrivilege 1484 wbengine.exe Token: SeSecurityPrivilege 1484 wbengine.exe Token: SeIncreaseQuotaPrivilege 2616 WMIC.exe Token: SeSecurityPrivilege 2616 WMIC.exe Token: SeTakeOwnershipPrivilege 2616 WMIC.exe Token: SeLoadDriverPrivilege 2616 WMIC.exe Token: SeSystemProfilePrivilege 2616 WMIC.exe Token: SeSystemtimePrivilege 2616 WMIC.exe Token: SeProfSingleProcessPrivilege 2616 WMIC.exe Token: SeIncBasePriorityPrivilege 2616 WMIC.exe Token: SeCreatePagefilePrivilege 2616 WMIC.exe Token: SeBackupPrivilege 2616 WMIC.exe Token: SeRestorePrivilege 2616 WMIC.exe Token: SeShutdownPrivilege 2616 WMIC.exe Token: SeDebugPrivilege 2616 WMIC.exe Token: SeSystemEnvironmentPrivilege 2616 WMIC.exe Token: SeRemoteShutdownPrivilege 2616 WMIC.exe Token: SeUndockPrivilege 2616 WMIC.exe Token: SeManageVolumePrivilege 2616 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2020 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 29 PID 2412 wrote to memory of 2020 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 29 PID 2412 wrote to memory of 2020 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 29 PID 2412 wrote to memory of 2020 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 29 PID 2412 wrote to memory of 1300 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 30 PID 2412 wrote to memory of 1300 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 30 PID 2412 wrote to memory of 1300 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 30 PID 2412 wrote to memory of 1300 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 30 PID 1300 wrote to memory of 2508 1300 cmd.exe 33 PID 1300 wrote to memory of 2508 1300 cmd.exe 33 PID 1300 wrote to memory of 2508 1300 cmd.exe 33 PID 2020 wrote to memory of 3056 2020 cmd.exe 34 PID 2020 wrote to memory of 3056 2020 cmd.exe 34 PID 2020 wrote to memory of 3056 2020 cmd.exe 34 PID 1300 wrote to memory of 1372 1300 cmd.exe 36 PID 1300 wrote to memory of 1372 1300 cmd.exe 36 PID 1300 wrote to memory of 1372 1300 cmd.exe 36 PID 2020 wrote to memory of 856 2020 cmd.exe 38 PID 2020 wrote to memory of 856 2020 cmd.exe 38 PID 2020 wrote to memory of 856 2020 cmd.exe 38 PID 2020 wrote to memory of 2104 2020 cmd.exe 40 PID 2020 wrote to memory of 2104 2020 cmd.exe 40 PID 2020 wrote to memory of 2104 2020 cmd.exe 40 PID 2020 wrote to memory of 2416 2020 cmd.exe 41 PID 2020 wrote to memory of 2416 2020 cmd.exe 41 PID 2020 wrote to memory of 2416 2020 cmd.exe 41 PID 2020 wrote to memory of 804 2020 cmd.exe 42 PID 2020 wrote to memory of 804 2020 cmd.exe 42 PID 2020 wrote to memory of 804 2020 cmd.exe 42 PID 2412 wrote to memory of 2452 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 47 PID 2412 wrote to memory of 2452 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 47 PID 2412 wrote to memory of 2452 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 47 PID 2412 wrote to memory of 2452 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 47 PID 2412 wrote to memory of 876 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 49 PID 2412 wrote to memory of 876 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 49 PID 2412 wrote to memory of 876 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 49 PID 2412 wrote to memory of 876 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 49 PID 2412 wrote to memory of 1944 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 50 PID 2412 wrote to memory of 1944 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 50 PID 2412 wrote to memory of 1944 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 50 PID 2412 wrote to memory of 1944 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 50 PID 2412 wrote to memory of 2260 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 51 PID 2412 wrote to memory of 2260 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 51 PID 2412 wrote to memory of 2260 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 51 PID 2412 wrote to memory of 2260 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 51 PID 2412 wrote to memory of 2532 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 52 PID 2412 wrote to memory of 2532 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 52 PID 2412 wrote to memory of 2532 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 52 PID 2412 wrote to memory of 2532 2412 45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe 52 PID 2532 wrote to memory of 1744 2532 cmd.exe 54 PID 2532 wrote to memory of 1744 2532 cmd.exe 54 PID 2532 wrote to memory of 1744 2532 cmd.exe 54 PID 2532 wrote to memory of 2616 2532 cmd.exe 55 PID 2532 wrote to memory of 2616 2532 cmd.exe 55 PID 2532 wrote to memory of 2616 2532 cmd.exe 55 PID 2532 wrote to memory of 1620 2532 cmd.exe 56 PID 2532 wrote to memory of 1620 2532 cmd.exe 56 PID 2532 wrote to memory of 1620 2532 cmd.exe 56 PID 2532 wrote to memory of 2712 2532 cmd.exe 57 PID 2532 wrote to memory of 2712 2532 cmd.exe 57 PID 2532 wrote to memory of 2712 2532 cmd.exe 57 PID 2532 wrote to memory of 2424 2532 cmd.exe 58 PID 2532 wrote to memory of 2424 2532 cmd.exe 58 PID 2532 wrote to memory of 2424 2532 cmd.exe 58 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe"C:\Users\Admin\AppData\Local\Temp\45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe"C:\Users\Admin\AppData\Local\Temp\45de59851d68929632346d6f894dc8c1b6a5c4197db83c2e33c60631efc0b39f.exe"2⤵PID:2172
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3056
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2104
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2416
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:804
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2508
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1372
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2452
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:876
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:1944
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2260
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1744
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1620
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2712
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2424
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1816
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1708
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD58705212043da66bf191fe8ecb94fd0f7
SHA16e36e9c4fbc2ad650362ffa725702dfac7a7d708
SHA256d6fdff1bb74b0c93b5b418c31adec319081d1db60dcdf6ecc578a8a16e48ae98
SHA512723da46d08613a4a6064d9158fcc8331bd1e18da68c45c4cbb63d96080c1aeddb84e1a15e2cc1412433009b18a8cf62cadc3931b834963dbd6c70c50dbc4657a