Malware Analysis Report

2024-09-11 01:04

Sample ID 240726-hyzh3stapl
Target f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe
SHA256 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800
Tags
phobos aspackv2 credential_access defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800

Threat Level: Known bad

The file f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe was found to be: Known bad.

Malicious Activity Summary

phobos aspackv2 credential_access defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer

Phobos

Renames multiple (515) files with added filename extension

Deletes shadow copies

Modifies boot configuration data using bcdedit

Renames multiple (312) files with added filename extension

Credentials from Password Stores: Credentials from Web Browsers

Modifies Windows Firewall

Deletes backup catalog

Loads dropped DLL

Reads user/profile data of web browsers

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Drops startup file

Credentials from Password Stores: Windows Credential Manager

Drops desktop.ini file(s)

Adds Run key to start application

Drops file in Program Files directory

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Unsigned PE

Checks SCSI registry key(s)

Interacts with shadow copies

Uses Volume Shadow Copy service COM API

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Modifies Internet Explorer settings

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-26 07:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-26 07:09

Reported

2024-07-26 07:11

Platform

win7-20240708-en

Max time kernel

149s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

Signatures

Phobos

ransomware phobos

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (312) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800 = "C:\\Users\\Admin\\AppData\\Local\\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe" C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800 = "C:\\Users\\Admin\\AppData\\Local\\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe" C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V8SGIH7I\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZO1X14N3\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M720ATCO\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OW9ZQM06\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JY8H21Z\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MN6S8FGK\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Mozilla Firefox\browser\features\[email protected][445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Gradient.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WPEQU532.DLL.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\WATERMAR.ELM C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\background.gif C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01180_.WMF.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Essential.eftx.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_underline.gif C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.DesignTime.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Windows Journal\es-ES\Journal.exe.mui C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105380.WMF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237759.WMF.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05870_.WMF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Technic.thmx C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\logger\libconsole_logger_plugin.dll.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105710.WMF.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\UserControl.zip.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105294.WMF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FS3BOX.POC C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\info.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099169.WMF.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107526.WMF.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\MIMEDIR.DLL.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_m.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Green Bubbles.htm C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\BLUECALM.ELM.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\MSOCFUIUTILITIESDLL.DLL.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2F.GIF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\de-DE\TableTextService.dll.mui C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00057_.WMF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME05.CSS C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fy.txt C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18187_.WMF.id[445E6EC5-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\zGrw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2308 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 2308 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 2308 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 2308 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 2688 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2308 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2308 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2308 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2308 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2308 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2308 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2308 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 1768 wrote to memory of 2900 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1768 wrote to memory of 2900 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1768 wrote to memory of 2900 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3060 wrote to memory of 1676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3060 wrote to memory of 1676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3060 wrote to memory of 1676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3060 wrote to memory of 308 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3060 wrote to memory of 308 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3060 wrote to memory of 308 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1768 wrote to memory of 2380 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1768 wrote to memory of 2380 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1768 wrote to memory of 2380 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1768 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1768 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1768 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1768 wrote to memory of 1548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1768 wrote to memory of 1548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1768 wrote to memory of 1548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1768 wrote to memory of 676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1768 wrote to memory of 676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1768 wrote to memory of 676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2308 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2308 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2308 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2308 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2308 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 1264 wrote to memory of 848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1264 wrote to memory of 848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1264 wrote to memory of 848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1264 wrote to memory of 1704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1264 wrote to memory of 1704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1264 wrote to memory of 1704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1264 wrote to memory of 1344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

C:\Users\Admin\AppData\Local\Temp\zGrw.exe

C:\Users\Admin\AppData\Local\Temp\zGrw.exe

C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\46a60ee4.bat" "

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp

Files

memory/2308-0-0x0000000000E50000-0x0000000000E69000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zGrw.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/2688-12-0x0000000000140000-0x0000000000149000-memory.dmp

memory/2308-11-0x0000000000140000-0x0000000000149000-memory.dmp

memory/2308-10-0x0000000000140000-0x0000000000149000-memory.dmp

memory/2888-14-0x0000000000E50000-0x0000000000E69000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HTBGGANG\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

C:\Users\Admin\AppData\Local\Temp\412B185E.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Temp\46a60ee4.bat

MD5 8ed3afe57fec92045a0a0a4cc016b4ff
SHA1 f8ffd573af0e6431ec7914c707e48f52131d0ba9
SHA256 b222ace7f011daa88999241d2d7b946d1d4cabeaf6351a9e57dffbc3c9dd8ab4
SHA512 f62dd57c6291619edddc3d29743f2162398a5f3a05afc0670a40303803278bdda24b3010e74ccd52cb052bf503b95a63fd12a8789f77fc2d801528e8e44507ea

memory/2688-55-0x0000000000140000-0x0000000000149000-memory.dmp

C:\Program Files\7-Zip\Uninstall.exe

MD5 4ef72662bfd0b2528f610a73d27b9109
SHA1 da41b32ced1831b851c6cd8fd5b8de52ff18a4b3
SHA256 f0257199c0b3dc140bd70d980da966dec1cc1fc4ad9b666a61400d634adfa98c
SHA512 d77de4d1cfa334408b92afd9c7d1aec687fca66e0f71f296bd4c6d424a056d4f162a05adacd56c6f9fa757a9cdea1f8bc1bf493d967341ff2270050d05863485

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe

MD5 8385157bbf9d2c1acd717d7b23f1b8c7
SHA1 99fbe9dfbb12090a5cd62499877bd22bdaf7932f
SHA256 f5a23cb22a1d0e1b91b4c1187952a0affe1ae7ecb19cd684e054432a49b1151b
SHA512 d65910efedbd66b281a624d8432b5c3e1dbd21e6f29dd21ed3e4533305a6b1abd575246d4e024eedf9c9fa0699001665d0903b6fe1afcb04a663ed3ef49dd352

memory/2308-9328-0x0000000000E50000-0x0000000000E69000-memory.dmp

C:\info.hta

MD5 09a1a3615cb2360b22f8057feab8383b
SHA1 7da623d57cca674cd9d2879deb90ff8a2f62c7d4
SHA256 9dba357eef1c11f6841e88f742f55e558089e31662379f72122bb9bd01057822
SHA512 739078ba4a9e4af1316131b27cb5702d463f3e811c5a162e41f8675b3ba75c6563a8f230e100a3953116462d0081ce0535548fac291e9b127aca7dde99947ef5

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-26 07:09

Reported

2024-07-26 07:11

Platform

win10v2004-20240709-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

Signatures

Phobos

ransomware phobos

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (515) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\zGrw.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800 = "C:\\Users\\Admin\\AppData\\Local\\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe" C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800 = "C:\\Users\\Admin\\AppData\\Local\\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe" C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\identity_helper.Sparse.Dev.msix.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\icudtl.dat.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-400.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon.png.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedSplash.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4 C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\bg_get.svg.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_empty_state.svg.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libmpg123_plugin.dll.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_listview_selected.svg.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ta.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\sl.pak C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vreg\dcf.x-none.msi.16.x-none.vreg.dat C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.scale-100.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-200.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-tw_get.svg C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\BuildInfo.xml C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOXMLMF.DLL C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png.id[478EA8F4-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\concrt140.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7cb.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\zGrw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2972 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 2972 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 2972 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 448 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 448 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 448 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 3252 wrote to memory of 1576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3252 wrote to memory of 1576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3468 wrote to memory of 228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3468 wrote to memory of 228 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3252 wrote to memory of 3028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3252 wrote to memory of 3028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3468 wrote to memory of 1772 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3468 wrote to memory of 1772 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3468 wrote to memory of 4496 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3468 wrote to memory of 4496 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3468 wrote to memory of 2956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3468 wrote to memory of 2956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3468 wrote to memory of 3024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3468 wrote to memory of 3024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2972 wrote to memory of 5348 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5348 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5348 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5384 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5384 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5384 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5440 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5440 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5440 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5460 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5460 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5460 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2972 wrote to memory of 5476 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 5476 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 5476 wrote to memory of 5736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 5476 wrote to memory of 5736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 5476 wrote to memory of 5844 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5476 wrote to memory of 5844 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5476 wrote to memory of 5872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5476 wrote to memory of 5872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5476 wrote to memory of 5888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5476 wrote to memory of 5888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 5476 wrote to memory of 5892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 5476 wrote to memory of 5892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

C:\Users\Admin\AppData\Local\Temp\zGrw.exe

C:\Users\Admin\AppData\Local\Temp\zGrw.exe

C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4de40b6a.bat" "

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp

Files

memory/2972-0-0x0000000000460000-0x0000000000479000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zGrw.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/448-5-0x0000000000BA0000-0x0000000000BA9000-memory.dmp

memory/3660-7-0x0000000000460000-0x0000000000479000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\686A613B.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5G8JI3LV\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

memory/448-47-0x0000000000BA0000-0x0000000000BA9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4de40b6a.bat

MD5 360e9bc0f8762a0ef89b623dad883744
SHA1 a991e23f98d2d26ae1847d5025adea6b7f66af81
SHA256 2074001ec9f88df5cec5688d8f2c234d6792f20a6abc7d8132a460de0ccc99f0
SHA512 0702375d308c85ff73857bc6bd32f903cd8a6f8d2f8504f876d1ef416c196a5b17f304a6acf42c5a60c29bbf7357b5fe950e18325b878f090a7c243004b21ce3

C:\Program Files\7-Zip\Uninstall.exe

MD5 05be86d220260788e9c03a82d1a0e697
SHA1 779f8696fd653e1009de22a5d34b365db42be972
SHA256 2ef6d41bc8225878d7aa158fa7f751e5661aab77b43a7a379d669496dbae5113
SHA512 672135e115877d6a650358e215821b2b6fc020b51fdc1c3306f24e60cc5c03e5d3fa746f65601deb0ce758dd716efaf12690957942e589f87050962c1afb1146

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id[478EA8F4-3542].[[email protected]].faust

MD5 17e98cdd49e9f4307631f73d185c9ce9
SHA1 9e9698c41f489f4315ca75e705c0b12bb171464e
SHA256 943e641e139fab53efe4d502093466ebaeefcff63c2672a784d3993a9b8a1688
SHA512 0217b79361c15772e4e0c45c607fb82b47e964c3bd7a33971e7facfccdb82bf9f394157f306d9d1a1a0a6447a01da3302546b7d86e2512e64cb5f7e9864a8559

memory/2972-9948-0x0000000000460000-0x0000000000479000-memory.dmp

C:\info.hta

MD5 2c292a670ae2074b8bc81d35a1c4a988
SHA1 3a9f58879045a35152dbc66ce7aebcbabd7e6161
SHA256 c459856d526b37108d3c813c73035c967f6f0badf68406dc9a70fc528b1b7140
SHA512 5e98660719db34c66decc7958d71d02c2dee64365c5b705e319cde1b4e97bd4156fcc26512bbb13bd207f9b88d4d62dad26cf88147b37c80946c476c1740eac3