Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 07:05
Static task
static1
Behavioral task
behavioral1
Sample
f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe
Resource
win10v2004-20240709-en
General
-
Target
f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe
-
Size
74KB
-
MD5
d347769098a8697660804d68eaac0622
-
SHA1
e2758e6c0751c30849614728a63aeb9e82ea3113
-
SHA256
f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800
-
SHA512
b4874af4ffd16bce8682f6ecedc5f2dd4ec0ebd34af438f760e3aeeefef55e6cb634598f9edbe5e829cdbb4e3e701f11f0890faaee43a669b081b0f74acc34aa
-
SSDEEP
1536:mNeRBl5PT/rx1mzwRMSTdLpJPgEEt4AwMEz9UQzdbGCq2iW7z:mQRrmzwR5Jw45MEyQ5GCH
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span>
class='mark'>[email protected]</span>
class='mark'>[email protected]</span>
http://www.w3.org/TR/html4/strict.dtd'>
https://pidgin.im/download/windows/</li>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 2212 bcdedit.exe 2104 bcdedit.exe 2248 bcdedit.exe 2828 bcdedit.exe -
Renames multiple (309) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1076 wbadmin.exe 3040 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2976 netsh.exe 1692 netsh.exe -
resource yara_rule behavioral1/files/0x000a0000000122db-2.dat aspack_v212_v242 -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 3 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe -
Executes dropped EXE 1 IoCs
pid Process 2108 zGrw.exe -
Loads dropped DLL 2 IoCs
pid Process 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800 = "C:\\Users\\Admin\\AppData\\Local\\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe" f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800 = "C:\\Users\\Admin\\AppData\\Local\\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe" f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FGBCC7A8\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XLI5Q0EH\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Public\Documents\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Public\Libraries\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\Videos\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JVMDVGRW\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9P9LRO9\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Public\Desktop\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\Documents\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OJBRRE9R\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Public\Downloads\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Public\Videos\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FH198YO1\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\G4UA8T7D\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\HICCUP.WAV f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePage.gif f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImageMask.bmp.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianReport.Dotx f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\wmpnssui.dll.mui f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\MMSS.ICO.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\GreenBubbles.jpg f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_off.gif.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Windows Sidebar\it-IT\sbdrop.dll.mui f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\SKY.ELM.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00956_.WMF.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02055_.WMF.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Newsprint.thmx.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0214948.WMF.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115843.GIF f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\Office14\INTLDATE.DLL.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\Office14\THOCRAPI.DLL.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files\Microsoft Games\Solitaire\es-ES\Solitaire.exe.mui.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdasc.dll f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ja.dll.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00935_.WMF f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\PREVIEW.GIF.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090027.WMF f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239611.WMF f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR34F.GIF f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\NOTE.CFG f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DigitalInk.jpg.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR40F.GIF f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENV11.POC.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Discussion.gta f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01237_.GIF.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImages.jpg.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01241_.GIF.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198021.WMF.id[A862BB42-3542].[[email protected]].faust f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zGrw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2608 vssadmin.exe 2372 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe Token: SeBackupPrivilege 876 vssvc.exe Token: SeRestorePrivilege 876 vssvc.exe Token: SeAuditPrivilege 876 vssvc.exe Token: SeIncreaseQuotaPrivilege 1032 WMIC.exe Token: SeSecurityPrivilege 1032 WMIC.exe Token: SeTakeOwnershipPrivilege 1032 WMIC.exe Token: SeLoadDriverPrivilege 1032 WMIC.exe Token: SeSystemProfilePrivilege 1032 WMIC.exe Token: SeSystemtimePrivilege 1032 WMIC.exe Token: SeProfSingleProcessPrivilege 1032 WMIC.exe Token: SeIncBasePriorityPrivilege 1032 WMIC.exe Token: SeCreatePagefilePrivilege 1032 WMIC.exe Token: SeBackupPrivilege 1032 WMIC.exe Token: SeRestorePrivilege 1032 WMIC.exe Token: SeShutdownPrivilege 1032 WMIC.exe Token: SeDebugPrivilege 1032 WMIC.exe Token: SeSystemEnvironmentPrivilege 1032 WMIC.exe Token: SeRemoteShutdownPrivilege 1032 WMIC.exe Token: SeUndockPrivilege 1032 WMIC.exe Token: SeManageVolumePrivilege 1032 WMIC.exe Token: 33 1032 WMIC.exe Token: 34 1032 WMIC.exe Token: 35 1032 WMIC.exe Token: SeIncreaseQuotaPrivilege 1032 WMIC.exe Token: SeSecurityPrivilege 1032 WMIC.exe Token: SeTakeOwnershipPrivilege 1032 WMIC.exe Token: SeLoadDriverPrivilege 1032 WMIC.exe Token: SeSystemProfilePrivilege 1032 WMIC.exe Token: SeSystemtimePrivilege 1032 WMIC.exe Token: SeProfSingleProcessPrivilege 1032 WMIC.exe Token: SeIncBasePriorityPrivilege 1032 WMIC.exe Token: SeCreatePagefilePrivilege 1032 WMIC.exe Token: SeBackupPrivilege 1032 WMIC.exe Token: SeRestorePrivilege 1032 WMIC.exe Token: SeShutdownPrivilege 1032 WMIC.exe Token: SeDebugPrivilege 1032 WMIC.exe Token: SeSystemEnvironmentPrivilege 1032 WMIC.exe Token: SeRemoteShutdownPrivilege 1032 WMIC.exe Token: SeUndockPrivilege 1032 WMIC.exe Token: SeManageVolumePrivilege 1032 WMIC.exe Token: 33 1032 WMIC.exe Token: 34 1032 WMIC.exe Token: 35 1032 WMIC.exe Token: SeBackupPrivilege 200 wbengine.exe Token: SeRestorePrivilege 200 wbengine.exe Token: SeSecurityPrivilege 200 wbengine.exe Token: SeIncreaseQuotaPrivilege 880 WMIC.exe Token: SeSecurityPrivilege 880 WMIC.exe Token: SeTakeOwnershipPrivilege 880 WMIC.exe Token: SeLoadDriverPrivilege 880 WMIC.exe Token: SeSystemProfilePrivilege 880 WMIC.exe Token: SeSystemtimePrivilege 880 WMIC.exe Token: SeProfSingleProcessPrivilege 880 WMIC.exe Token: SeIncBasePriorityPrivilege 880 WMIC.exe Token: SeCreatePagefilePrivilege 880 WMIC.exe Token: SeBackupPrivilege 880 WMIC.exe Token: SeRestorePrivilege 880 WMIC.exe Token: SeShutdownPrivilege 880 WMIC.exe Token: SeDebugPrivilege 880 WMIC.exe Token: SeSystemEnvironmentPrivilege 880 WMIC.exe Token: SeRemoteShutdownPrivilege 880 WMIC.exe Token: SeUndockPrivilege 880 WMIC.exe Token: SeManageVolumePrivilege 880 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2108 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 31 PID 2484 wrote to memory of 2108 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 31 PID 2484 wrote to memory of 2108 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 31 PID 2484 wrote to memory of 2108 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 31 PID 2484 wrote to memory of 2804 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 34 PID 2484 wrote to memory of 2804 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 34 PID 2484 wrote to memory of 2804 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 34 PID 2484 wrote to memory of 2804 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 34 PID 2484 wrote to memory of 2648 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 35 PID 2484 wrote to memory of 2648 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 35 PID 2484 wrote to memory of 2648 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 35 PID 2484 wrote to memory of 2648 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 35 PID 2804 wrote to memory of 2608 2804 cmd.exe 38 PID 2804 wrote to memory of 2608 2804 cmd.exe 38 PID 2804 wrote to memory of 2608 2804 cmd.exe 38 PID 2648 wrote to memory of 2976 2648 cmd.exe 39 PID 2648 wrote to memory of 2976 2648 cmd.exe 39 PID 2648 wrote to memory of 2976 2648 cmd.exe 39 PID 2648 wrote to memory of 1692 2648 cmd.exe 42 PID 2648 wrote to memory of 1692 2648 cmd.exe 42 PID 2648 wrote to memory of 1692 2648 cmd.exe 42 PID 2804 wrote to memory of 1032 2804 cmd.exe 43 PID 2804 wrote to memory of 1032 2804 cmd.exe 43 PID 2804 wrote to memory of 1032 2804 cmd.exe 43 PID 2804 wrote to memory of 2212 2804 cmd.exe 45 PID 2804 wrote to memory of 2212 2804 cmd.exe 45 PID 2804 wrote to memory of 2212 2804 cmd.exe 45 PID 2804 wrote to memory of 2104 2804 cmd.exe 46 PID 2804 wrote to memory of 2104 2804 cmd.exe 46 PID 2804 wrote to memory of 2104 2804 cmd.exe 46 PID 2804 wrote to memory of 1076 2804 cmd.exe 47 PID 2804 wrote to memory of 1076 2804 cmd.exe 47 PID 2804 wrote to memory of 1076 2804 cmd.exe 47 PID 2108 wrote to memory of 1516 2108 zGrw.exe 51 PID 2108 wrote to memory of 1516 2108 zGrw.exe 51 PID 2108 wrote to memory of 1516 2108 zGrw.exe 51 PID 2108 wrote to memory of 1516 2108 zGrw.exe 51 PID 2484 wrote to memory of 1744 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 53 PID 2484 wrote to memory of 1744 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 53 PID 2484 wrote to memory of 1744 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 53 PID 2484 wrote to memory of 1744 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 53 PID 2484 wrote to memory of 2012 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 54 PID 2484 wrote to memory of 2012 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 54 PID 2484 wrote to memory of 2012 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 54 PID 2484 wrote to memory of 2012 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 54 PID 2484 wrote to memory of 1968 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 55 PID 2484 wrote to memory of 1968 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 55 PID 2484 wrote to memory of 1968 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 55 PID 2484 wrote to memory of 1968 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 55 PID 2484 wrote to memory of 2700 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 57 PID 2484 wrote to memory of 2700 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 57 PID 2484 wrote to memory of 2700 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 57 PID 2484 wrote to memory of 2700 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 57 PID 2484 wrote to memory of 3016 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 58 PID 2484 wrote to memory of 3016 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 58 PID 2484 wrote to memory of 3016 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 58 PID 2484 wrote to memory of 3016 2484 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe 58 PID 3016 wrote to memory of 2372 3016 cmd.exe 60 PID 3016 wrote to memory of 2372 3016 cmd.exe 60 PID 3016 wrote to memory of 2372 3016 cmd.exe 60 PID 3016 wrote to memory of 880 3016 cmd.exe 61 PID 3016 wrote to memory of 880 3016 cmd.exe 61 PID 3016 wrote to memory of 880 3016 cmd.exe 61 PID 3016 wrote to memory of 2248 3016 cmd.exe 62 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\zGrw.exeC:\Users\Admin\AppData\Local\Temp\zGrw.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3c09740d.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1516
-
-
-
C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"2⤵PID:2696
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2608
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2212
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2104
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1076
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2976
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1692
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1744
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2012
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1968
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2700
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2372
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:880
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2248
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2828
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:3040
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:876
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:200
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1744
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2284
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
MD5f20781b44d7f5bfb952095f27654dea2
SHA1702e51591b7b7687ca9337b15e6092d1d6acd551
SHA2566f26bd157694c309f9eb4b64188b86a0d56775b46b927468abd9d72f99b8e44f
SHA5120edab6e5215215f0d5b6c47c2aa2202f34eeca6949ec9b95a829ef478f491617023fb6fa36efd784ed9d2a521c005cb284247a7197156315e4a2833da2504e64
-
Filesize
31KB
MD5b5749c3b44ad0e2bdf0eb0b1b4213a82
SHA16ef08a2ef0f9f9d74b1ac775091ee3b649b282e2
SHA2566fdd2a20939a51af9a8623112d79688286b8f50a3f4afd6faa1986a2e12a0ade
SHA5127c0faf31fadcbf5a5df0ee8b441fc7b6f124bc7027b30632cfadf060c7afcd07752c13654798cb9abff97f9901dda239eb1981ea206bb9074e5b2e47730acf52
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\69P6875H\k2[1].rar
Filesize4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
183B
MD58f599ac449d923fa7e0db0c478153015
SHA14199b11bd42027a02ff28570d39438e2ad7ff7fc
SHA2569d5bc82b619294d5ff5a15c3c7880cf98f9dae454f8436e49fc29d19b29097c0
SHA5127090ab152f78fe869ec0b2cf10cdff7cb3c4a17adc077b016fa281b04ef48852c55f53a904b7af01899a9847243213b197358b369931a7534febf4682c230c80
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
6KB
MD5dc6f9cb205f18d53d20145ac9b5a78c0
SHA1caa02010e9155ff7a19f0bfb57280b4b8b8d1060
SHA256449d556e5c93207397d156176bbddf3e04fb0bc865e503e19c26f014171704a4
SHA512ad2236a04642232d55ba9105c336a7c2aa4d533b13e4fcb0f06d6666991ba43f475ee7d2d2d41ff26aa77fbaf6fdc8c18263d876d8743dda67e45843baf41df6
-
Filesize
15KB
MD5f7d21de5c4e81341eccd280c11ddcc9a
SHA1d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA2564485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3