Analysis
-
max time kernel
149s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 04:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe
-
Size
56KB
-
MD5
6262389396c23fa6b30e6c509b8124a6
-
SHA1
1e70cc88291eb973e05fb2320710adffb195560b
-
SHA256
f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3
-
SHA512
5db7cb41460a926dcafabb43b7379947fc07b5c1db9229ac1b1597bc53d3ac78f65da9a46c01ce687a879a5575fef42ece90bd251564a709c0b06884f3a6ad81
-
SSDEEP
1536:YNeRBl5PT/rx1mzwRMSTdLpJGaefu/BLPu2r8kgj:YQRrmzwR5JKu/MI8ke
Malware Config
Extracted
C:\info.hta
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 2020 bcdedit.exe 2644 bcdedit.exe 2764 bcdedit.exe 1320 bcdedit.exe -
Renames multiple (318) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exewbadmin.exepid process 3068 wbadmin.exe 2804 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 1796 netsh.exe 2792 netsh.exe -
Drops startup file 3 IoCs
Processes:
2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe" 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe" 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exedescription ioc process File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\L0CT0ZLQ\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2660163958-4080398480-1122754539-1000\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFPGXSZI\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\4TWWWYKL\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZI5WZ4I\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2660163958-4080398480-1122754539-1000\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JAHTY535\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382939.JPG 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_TexturedBlue.gif 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\calendar.js 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\localizedSettings.css 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\ContactSelector.ico 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\SUCTION.WAV 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\it-IT\msadcor.dll.mui 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0187423.WMF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Apia.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENV98.POC.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_floating.png 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292278.WMF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21520_.GIF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OMSSMS.CFG 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0314068.JPG 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03257_.WMF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107150.WMF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_OFF.GIF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR.HXS.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR34F.GIF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00625_.WMF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\LATIN1.SHP.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL98.POC 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00910_.WMF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297749.WMF 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18214_.WMF.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\Java\jre7\bin\kcms.dll.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgzm.exe.mui.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPrintTemplate.html 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.dll 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File created C:\Program Files\7-Zip\Lang\ug.txt.id[606AFC11-2833].[[email protected]].eject 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.dll 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_decreaseindent.gif 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2768 vssadmin.exe 888 vssadmin.exe -
Processes:
mshta.exemshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exepid process 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe Token: SeBackupPrivilege 2616 vssvc.exe Token: SeRestorePrivilege 2616 vssvc.exe Token: SeAuditPrivilege 2616 vssvc.exe Token: SeIncreaseQuotaPrivilege 688 WMIC.exe Token: SeSecurityPrivilege 688 WMIC.exe Token: SeTakeOwnershipPrivilege 688 WMIC.exe Token: SeLoadDriverPrivilege 688 WMIC.exe Token: SeSystemProfilePrivilege 688 WMIC.exe Token: SeSystemtimePrivilege 688 WMIC.exe Token: SeProfSingleProcessPrivilege 688 WMIC.exe Token: SeIncBasePriorityPrivilege 688 WMIC.exe Token: SeCreatePagefilePrivilege 688 WMIC.exe Token: SeBackupPrivilege 688 WMIC.exe Token: SeRestorePrivilege 688 WMIC.exe Token: SeShutdownPrivilege 688 WMIC.exe Token: SeDebugPrivilege 688 WMIC.exe Token: SeSystemEnvironmentPrivilege 688 WMIC.exe Token: SeRemoteShutdownPrivilege 688 WMIC.exe Token: SeUndockPrivilege 688 WMIC.exe Token: SeManageVolumePrivilege 688 WMIC.exe Token: 33 688 WMIC.exe Token: 34 688 WMIC.exe Token: 35 688 WMIC.exe Token: SeIncreaseQuotaPrivilege 688 WMIC.exe Token: SeSecurityPrivilege 688 WMIC.exe Token: SeTakeOwnershipPrivilege 688 WMIC.exe Token: SeLoadDriverPrivilege 688 WMIC.exe Token: SeSystemProfilePrivilege 688 WMIC.exe Token: SeSystemtimePrivilege 688 WMIC.exe Token: SeProfSingleProcessPrivilege 688 WMIC.exe Token: SeIncBasePriorityPrivilege 688 WMIC.exe Token: SeCreatePagefilePrivilege 688 WMIC.exe Token: SeBackupPrivilege 688 WMIC.exe Token: SeRestorePrivilege 688 WMIC.exe Token: SeShutdownPrivilege 688 WMIC.exe Token: SeDebugPrivilege 688 WMIC.exe Token: SeSystemEnvironmentPrivilege 688 WMIC.exe Token: SeRemoteShutdownPrivilege 688 WMIC.exe Token: SeUndockPrivilege 688 WMIC.exe Token: SeManageVolumePrivilege 688 WMIC.exe Token: 33 688 WMIC.exe Token: 34 688 WMIC.exe Token: 35 688 WMIC.exe Token: SeBackupPrivilege 1852 wbengine.exe Token: SeRestorePrivilege 1852 wbengine.exe Token: SeSecurityPrivilege 1852 wbengine.exe Token: SeIncreaseQuotaPrivilege 1064 WMIC.exe Token: SeSecurityPrivilege 1064 WMIC.exe Token: SeTakeOwnershipPrivilege 1064 WMIC.exe Token: SeLoadDriverPrivilege 1064 WMIC.exe Token: SeSystemProfilePrivilege 1064 WMIC.exe Token: SeSystemtimePrivilege 1064 WMIC.exe Token: SeProfSingleProcessPrivilege 1064 WMIC.exe Token: SeIncBasePriorityPrivilege 1064 WMIC.exe Token: SeCreatePagefilePrivilege 1064 WMIC.exe Token: SeBackupPrivilege 1064 WMIC.exe Token: SeRestorePrivilege 1064 WMIC.exe Token: SeShutdownPrivilege 1064 WMIC.exe Token: SeDebugPrivilege 1064 WMIC.exe Token: SeSystemEnvironmentPrivilege 1064 WMIC.exe Token: SeRemoteShutdownPrivilege 1064 WMIC.exe Token: SeUndockPrivilege 1064 WMIC.exe Token: SeManageVolumePrivilege 1064 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.execmd.execmd.execmd.exedescription pid process target process PID 3044 wrote to memory of 2308 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 3044 wrote to memory of 2308 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 3044 wrote to memory of 2308 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 3044 wrote to memory of 2308 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 3044 wrote to memory of 2012 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 3044 wrote to memory of 2012 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 3044 wrote to memory of 2012 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 3044 wrote to memory of 2012 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 2012 wrote to memory of 2792 2012 cmd.exe netsh.exe PID 2012 wrote to memory of 2792 2012 cmd.exe netsh.exe PID 2012 wrote to memory of 2792 2012 cmd.exe netsh.exe PID 2308 wrote to memory of 2768 2308 cmd.exe vssadmin.exe PID 2308 wrote to memory of 2768 2308 cmd.exe vssadmin.exe PID 2308 wrote to memory of 2768 2308 cmd.exe vssadmin.exe PID 2012 wrote to memory of 1796 2012 cmd.exe netsh.exe PID 2012 wrote to memory of 1796 2012 cmd.exe netsh.exe PID 2012 wrote to memory of 1796 2012 cmd.exe netsh.exe PID 2308 wrote to memory of 688 2308 cmd.exe WMIC.exe PID 2308 wrote to memory of 688 2308 cmd.exe WMIC.exe PID 2308 wrote to memory of 688 2308 cmd.exe WMIC.exe PID 2308 wrote to memory of 2020 2308 cmd.exe bcdedit.exe PID 2308 wrote to memory of 2020 2308 cmd.exe bcdedit.exe PID 2308 wrote to memory of 2020 2308 cmd.exe bcdedit.exe PID 2308 wrote to memory of 2644 2308 cmd.exe bcdedit.exe PID 2308 wrote to memory of 2644 2308 cmd.exe bcdedit.exe PID 2308 wrote to memory of 2644 2308 cmd.exe bcdedit.exe PID 2308 wrote to memory of 3068 2308 cmd.exe wbadmin.exe PID 2308 wrote to memory of 3068 2308 cmd.exe wbadmin.exe PID 2308 wrote to memory of 3068 2308 cmd.exe wbadmin.exe PID 3044 wrote to memory of 1732 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 1732 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 1732 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 1732 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 2976 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 2976 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 2976 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 2976 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 2748 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 2748 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 2748 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 2748 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 1968 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 1968 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 1968 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 1968 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe mshta.exe PID 3044 wrote to memory of 220 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 3044 wrote to memory of 220 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 3044 wrote to memory of 220 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 3044 wrote to memory of 220 3044 2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe cmd.exe PID 220 wrote to memory of 888 220 cmd.exe vssadmin.exe PID 220 wrote to memory of 888 220 cmd.exe vssadmin.exe PID 220 wrote to memory of 888 220 cmd.exe vssadmin.exe PID 220 wrote to memory of 1064 220 cmd.exe WMIC.exe PID 220 wrote to memory of 1064 220 cmd.exe WMIC.exe PID 220 wrote to memory of 1064 220 cmd.exe WMIC.exe PID 220 wrote to memory of 2764 220 cmd.exe bcdedit.exe PID 220 wrote to memory of 2764 220 cmd.exe bcdedit.exe PID 220 wrote to memory of 2764 220 cmd.exe bcdedit.exe PID 220 wrote to memory of 1320 220 cmd.exe bcdedit.exe PID 220 wrote to memory of 1320 220 cmd.exe bcdedit.exe PID 220 wrote to memory of 1320 220 cmd.exe bcdedit.exe PID 220 wrote to memory of 2804 220 cmd.exe wbadmin.exe PID 220 wrote to memory of 2804 220 cmd.exe wbadmin.exe PID 220 wrote to memory of 2804 220 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_6262389396c23fa6b30e6c509b8124a6_phobos.exe"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\info.htaFilesize
5KB
MD5c9d0943b0a28ceb8a3940815ceffebdf
SHA17f987cd6a94451a603814e7ab91254a8b08eb925
SHA25637630422540f40532536fe345563d3452c4afa87e396fbf479f3c8adb4f8128f
SHA51208f6ae0d71887acfea7e9b5b839435a7243d122732d309a22cfe81c22af8747f9902b570245f9e3dc306114b1901dbb9bc530664469807f58805a4d88be9b1f1