Analysis
-
max time kernel
125s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2024 09:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
advanced_ip_scanner.exe
Resource
win7-20240903-en
windows7-x64
31 signatures
150 seconds
Behavioral task
behavioral2
Sample
advanced_ip_scanner.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
28 signatures
150 seconds
General
-
Target
advanced_ip_scanner.exe
-
Size
2.6MB
-
MD5
85921539592aeaff3fbe0e104f344db0
-
SHA1
2ca28c946d6632f70c70e555afa8d9a072039d79
-
SHA256
ad640f32617bf57f7b4547fc686cc3e0a9875811ef6be1cb257a0607c391fdb8
-
SHA512
76f07e5d36dabeb56ffc9301cc82c32a975f4e83ad5d165cc8631e1809675011eba85e3d542e8fd2b6b3ae3a9228f4ca5e7ff953fb1446559879c081aa94fbfb
-
SSDEEP
49152:wgwR1ifu1DBgutBPNUF+zTR3HLHaY2UtKvu5vgmAbjNFAF5hcb:wgwR1vguPPocHHfcJbJFAe
Malware Config
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023ca7-37.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4440 bcdedit.exe 4408 bcdedit.exe -
Renames multiple (5815) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 4056 wbadmin.exe -
pid Process 2248 wbadmin.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8s.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8c.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8c.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe BACHOKTECHET.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation advanced_ip_scanner.exe -
Executes dropped EXE 10 IoCs
pid Process 3984 7za.exe 2944 7za.exe 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe 2716 BACHOKTECHET.exe 4420 Everything.exe 2616 BACHOKTECHET.exe 4848 BACHOKTECHET.exe 2028 BACHOKTECHET.exe 4100 DC.exe 4272 Everything.exe -
Loads dropped DLL 5 IoCs
pid Process 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe 2716 BACHOKTECHET.exe 4848 BACHOKTECHET.exe 2028 BACHOKTECHET.exe 2616 BACHOKTECHET.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell\open ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command BACHOKTECHET.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell\open\command ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" BACHOKTECHET.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell\open\command BACHOKTECHET.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BACHOKTECHET = "\"C:\\Users\\Admin\\AppData\\Local\\BFBF5FF3-02FF-66A7-72D2-688544C61A80\\BACHOKTECHET.exe\" " ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\M: Everything.exe -
Power Settings 1 TTPs 15 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2552 powercfg.exe 1316 powercfg.exe 1908 powercfg.exe 1772 powercfg.exe 4312 powercfg.exe 1028 powercfg.exe 4556 powercfg.exe 2052 powercfg.exe 384 powercfg.exe 2524 powercfg.exe 2248 powercfg.exe 1800 powercfg.exe 3232 powercfg.exe 4156 powercfg.exe 3212 powercfg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons_retina.png.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.tree.dat.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSI.TTF.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_unshare_18.svg.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Spelling.api.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_RHP.aapp.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info.png.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-hover.svg.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\PlayStore_icon.svg.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-selector.css.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\PingWatch.xlsb.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\osmux.x-none.msi.16.x-none.vreg.dat.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Line_White@1x.png.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark-2x.png.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\plugin.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reminders_18.svg.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\InvokeUnpublish.csv.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\it-it\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon.png.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sl_get.svg.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan.png.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\selector.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot.cur.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\stopwords.ENU.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\ui-strings.js.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe -
pid Process 3612 powershell.exe 3208 powershell.exe 2484 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BACHOKTECHET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BACHOKTECHET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language advanced_ip_scanner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BACHOKTECHET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BACHOKTECHET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" BACHOKTECHET.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell\open\command BACHOKTECHET.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\README_SOLVETHIS.txt\"" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\Software\Classes\.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open BACHOKTECHET.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ELONMUSKISGREEDY-Kr4JxBPyCC54gM1QsLxtrmQOwazrMVkGSCVZrk4RU3o\ = "mimicfile" BACHOKTECHET.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell\open ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell BACHOKTECHET.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell\open\command ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\exefile\shell ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command BACHOKTECHET.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 3612 powershell.exe 2484 powershell.exe 3208 powershell.exe 3208 powershell.exe 2484 powershell.exe 3612 powershell.exe 4848 BACHOKTECHET.exe 4848 BACHOKTECHET.exe 2616 BACHOKTECHET.exe 2616 BACHOKTECHET.exe 2716 BACHOKTECHET.exe 2716 BACHOKTECHET.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3984 7za.exe Token: 35 3984 7za.exe Token: SeRestorePrivilege 2944 7za.exe Token: 35 2944 7za.exe Token: SeSecurityPrivilege 2944 7za.exe Token: SeSecurityPrivilege 2944 7za.exe Token: SeIncreaseQuotaPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeSecurityPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeTakeOwnershipPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeLoadDriverPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeSystemProfilePrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeSystemtimePrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeProfSingleProcessPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeIncBasePriorityPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeCreatePagefilePrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeBackupPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeRestorePrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeShutdownPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeDebugPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeSystemEnvironmentPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeChangeNotifyPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeRemoteShutdownPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeUndockPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeManageVolumePrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeImpersonatePrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeCreateGlobalPrivilege 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: 33 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: 34 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: 35 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: 36 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe Token: SeIncreaseQuotaPrivilege 2716 BACHOKTECHET.exe Token: SeSecurityPrivilege 2716 BACHOKTECHET.exe Token: SeTakeOwnershipPrivilege 2716 BACHOKTECHET.exe Token: SeLoadDriverPrivilege 2716 BACHOKTECHET.exe Token: SeSystemProfilePrivilege 2716 BACHOKTECHET.exe Token: SeSystemtimePrivilege 2716 BACHOKTECHET.exe Token: SeProfSingleProcessPrivilege 2716 BACHOKTECHET.exe Token: SeIncBasePriorityPrivilege 2716 BACHOKTECHET.exe Token: SeCreatePagefilePrivilege 2716 BACHOKTECHET.exe Token: SeBackupPrivilege 2716 BACHOKTECHET.exe Token: SeRestorePrivilege 2716 BACHOKTECHET.exe Token: SeShutdownPrivilege 2716 BACHOKTECHET.exe Token: SeDebugPrivilege 2716 BACHOKTECHET.exe Token: SeSystemEnvironmentPrivilege 2716 BACHOKTECHET.exe Token: SeChangeNotifyPrivilege 2716 BACHOKTECHET.exe Token: SeRemoteShutdownPrivilege 2716 BACHOKTECHET.exe Token: SeUndockPrivilege 2716 BACHOKTECHET.exe Token: SeManageVolumePrivilege 2716 BACHOKTECHET.exe Token: SeImpersonatePrivilege 2716 BACHOKTECHET.exe Token: SeCreateGlobalPrivilege 2716 BACHOKTECHET.exe Token: 33 2716 BACHOKTECHET.exe Token: 34 2716 BACHOKTECHET.exe Token: 35 2716 BACHOKTECHET.exe Token: 36 2716 BACHOKTECHET.exe Token: SeIncreaseQuotaPrivilege 2616 BACHOKTECHET.exe Token: SeSecurityPrivilege 2616 BACHOKTECHET.exe Token: SeTakeOwnershipPrivilege 2616 BACHOKTECHET.exe Token: SeLoadDriverPrivilege 2616 BACHOKTECHET.exe Token: SeSystemProfilePrivilege 2616 BACHOKTECHET.exe Token: SeSystemtimePrivilege 2616 BACHOKTECHET.exe Token: SeIncreaseQuotaPrivilege 2028 BACHOKTECHET.exe Token: SeProfSingleProcessPrivilege 2616 BACHOKTECHET.exe Token: SeSecurityPrivilege 2028 BACHOKTECHET.exe Token: SeIncBasePriorityPrivilege 2616 BACHOKTECHET.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4420 Everything.exe 4272 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4424 wrote to memory of 3984 4424 advanced_ip_scanner.exe 86 PID 4424 wrote to memory of 3984 4424 advanced_ip_scanner.exe 86 PID 4424 wrote to memory of 3984 4424 advanced_ip_scanner.exe 86 PID 4424 wrote to memory of 2944 4424 advanced_ip_scanner.exe 88 PID 4424 wrote to memory of 2944 4424 advanced_ip_scanner.exe 88 PID 4424 wrote to memory of 2944 4424 advanced_ip_scanner.exe 88 PID 4424 wrote to memory of 2560 4424 advanced_ip_scanner.exe 90 PID 4424 wrote to memory of 2560 4424 advanced_ip_scanner.exe 90 PID 4424 wrote to memory of 2560 4424 advanced_ip_scanner.exe 90 PID 2560 wrote to memory of 2716 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe 91 PID 2560 wrote to memory of 2716 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe 91 PID 2560 wrote to memory of 2716 2560 ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe 91 PID 2716 wrote to memory of 4852 2716 BACHOKTECHET.exe 93 PID 2716 wrote to memory of 4852 2716 BACHOKTECHET.exe 93 PID 2716 wrote to memory of 4852 2716 BACHOKTECHET.exe 93 PID 2716 wrote to memory of 2028 2716 BACHOKTECHET.exe 94 PID 2716 wrote to memory of 2028 2716 BACHOKTECHET.exe 94 PID 2716 wrote to memory of 2028 2716 BACHOKTECHET.exe 94 PID 2716 wrote to memory of 2616 2716 BACHOKTECHET.exe 95 PID 2716 wrote to memory of 2616 2716 BACHOKTECHET.exe 95 PID 2716 wrote to memory of 2616 2716 BACHOKTECHET.exe 95 PID 2716 wrote to memory of 4848 2716 BACHOKTECHET.exe 96 PID 2716 wrote to memory of 4848 2716 BACHOKTECHET.exe 96 PID 2716 wrote to memory of 4848 2716 BACHOKTECHET.exe 96 PID 2716 wrote to memory of 4420 2716 BACHOKTECHET.exe 92 PID 2716 wrote to memory of 4420 2716 BACHOKTECHET.exe 92 PID 2716 wrote to memory of 4420 2716 BACHOKTECHET.exe 92 PID 4852 wrote to memory of 4100 4852 cmd.exe 98 PID 4852 wrote to memory of 4100 4852 cmd.exe 98 PID 4852 wrote to memory of 4100 4852 cmd.exe 98 PID 2716 wrote to memory of 384 2716 BACHOKTECHET.exe 100 PID 2716 wrote to memory of 384 2716 BACHOKTECHET.exe 100 PID 2716 wrote to memory of 1028 2716 BACHOKTECHET.exe 101 PID 2716 wrote to memory of 1028 2716 BACHOKTECHET.exe 101 PID 2716 wrote to memory of 2524 2716 BACHOKTECHET.exe 102 PID 2716 wrote to memory of 2524 2716 BACHOKTECHET.exe 102 PID 2716 wrote to memory of 4156 2716 BACHOKTECHET.exe 103 PID 2716 wrote to memory of 4156 2716 BACHOKTECHET.exe 103 PID 2716 wrote to memory of 4312 2716 BACHOKTECHET.exe 104 PID 2716 wrote to memory of 4312 2716 BACHOKTECHET.exe 104 PID 2716 wrote to memory of 2052 2716 BACHOKTECHET.exe 105 PID 2716 wrote to memory of 2052 2716 BACHOKTECHET.exe 105 PID 2716 wrote to memory of 1772 2716 BACHOKTECHET.exe 107 PID 2716 wrote to memory of 1772 2716 BACHOKTECHET.exe 107 PID 2716 wrote to memory of 3232 2716 BACHOKTECHET.exe 108 PID 2716 wrote to memory of 3232 2716 BACHOKTECHET.exe 108 PID 2716 wrote to memory of 1800 2716 BACHOKTECHET.exe 109 PID 2716 wrote to memory of 1800 2716 BACHOKTECHET.exe 109 PID 2716 wrote to memory of 2552 2716 BACHOKTECHET.exe 111 PID 2716 wrote to memory of 2552 2716 BACHOKTECHET.exe 111 PID 2716 wrote to memory of 1908 2716 BACHOKTECHET.exe 112 PID 2716 wrote to memory of 1908 2716 BACHOKTECHET.exe 112 PID 2716 wrote to memory of 4556 2716 BACHOKTECHET.exe 113 PID 2716 wrote to memory of 4556 2716 BACHOKTECHET.exe 113 PID 2716 wrote to memory of 1316 2716 BACHOKTECHET.exe 114 PID 2716 wrote to memory of 1316 2716 BACHOKTECHET.exe 114 PID 2716 wrote to memory of 3212 2716 BACHOKTECHET.exe 116 PID 2716 wrote to memory of 3212 2716 BACHOKTECHET.exe 116 PID 2716 wrote to memory of 2248 2716 BACHOKTECHET.exe 117 PID 2716 wrote to memory of 2248 2716 BACHOKTECHET.exe 117 PID 2716 wrote to memory of 3208 2716 BACHOKTECHET.exe 118 PID 2716 wrote to memory of 3208 2716 BACHOKTECHET.exe 118 PID 2716 wrote to memory of 2484 2716 BACHOKTECHET.exe 120 PID 2716 wrote to memory of 2484 2716 BACHOKTECHET.exe 120 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System BACHOKTECHET.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection BACHOKTECHET.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" BACHOKTECHET.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer BACHOKTECHET.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" BACHOKTECHET.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\advanced_ip_scanner.exe"C:\Users\Admin\AppData\Local\Temp\advanced_ip_scanner.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p1197321047146881885 Everything64.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2716 -
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\Everything.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4420
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\DC.exeDC.exe /D5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4100
-
-
-
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe" -e watch -pid 2716 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\BACHOKTECHET.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4848
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off4⤵
- Power Settings
PID:384
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:1028
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:2524
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:4156
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:4312
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:2052
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:1772
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:3232
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:1800
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:2552
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:1908
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:4556
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:1316
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵
- Power Settings
PID:3212
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵
- Power Settings
PID:2248
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3208
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2484
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:4440
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:4408
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4056
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:2248
-
-
C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\Everything.exe"C:\Users\Admin\AppData\Local\BFBF5FF3-02FF-66A7-72D2-688544C61A80\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4272
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- System Location Discovery: System Language Discovery
PID:4388
-
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4324
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4860
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4720
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1988
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4556
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2248
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1572
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4484
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3548
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1592
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1756
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4816
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:3176
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1852
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4600
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5544
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.2MB
MD52bab6af6abc13764401c543e29b03996
SHA14575b1301908fa0a6745155a13842376e8a874dd
SHA256a8a2334de86d4457745a8f7452555b655c763e63e801f2ad4ed7f2f5296e08a6
SHA512c2c7431eb54bb3dbe31488ca2400508d6a17c7119b201acb6ab4996dd77e12aef7cbc6a6bbf267ec8680b13cc445be0bc43a720482e699afa90bf0cd00680397
-
Filesize
20KB
MD59c0c6094b957401491f7b0fe14f91a2c
SHA16ac694ad5890a3babc6f5c43b877ec48fa44f33d
SHA25616b311e663c2da112a16a52d36c91f37d592d2f07912ef6cfe17c9dfd873ffe9
SHA512981d77aa03c2ee88d0abdfe86a0630cc8b9c922088656393d5bd8ec56ad07a28de269fc16de61cc8710d62546ba95afc19139ed89b6d00e24ba145cc6ad8134d
-
Filesize
32B
MD5e3371567aa6c94d091de412b8a22e7b8
SHA141074a0e5fdd0bafd7a1240a59aa87329372e659
SHA256ae3ad010223725e46b220de090653fffd068f15f5a87aef817527f48a46c9edb
SHA512c796e8e17989c0c5eb76f2bfb0d2f837789fd904b520dba2845989f7e4c332fb53c7d4172c69b8b5d3a38d04ff5d6bc492723bd65a5c5bda0f1c5c21564e028b
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
663B
MD5d008c06abbb351dd176312b07dbf7ac3
SHA15921da1745729d7b3b30d39b0c9617e2b494e8ec
SHA256d4c0ba066b7a4ea36fcd3e4b74c07c391df7c96e0aeb901d04a6203b63b7a391
SHA5127f6b3fb1f29a8b23c1a5d0be68d312dc91b684f0581b598724de406986ecc618a87ade674030f56b9cc60b47aaf30a593beac8f185646dc6981ec62ebf511c3c
-
Filesize
1KB
MD55131e6f69b4a3c130474dfe117246b14
SHA195cdcf42f95c86b81094477e8fa75f38585a6995
SHA25686edc35b755371ae484161cf5405fb845bf0d0e83e2c63ca7ba355f65b23a49c
SHA512f841ae992819033d7499a816dc1fca2eb8437493813acf3c3c5ddee30657d3aec80c66c7a850b82333c6bc6aa81e61f3f07aa0c8811a44af5b393e8a886cb0b6
-
Filesize
210B
MD5f48067c39b81ebcaef918ee1b2226e1a
SHA1092240ee6d1a37bb14dc330375862d7bfdfc28ff
SHA256c2966f06cb6a4a314d5ace764ac3949c83500c383ad260b0e9e3fd60da20092c
SHA512330e77cabb8221258490ee2ae969de5492564eb2f1e4907a555a1b4b40d3b7fef686c09e7c137f3179f793d0a316ab48b891e982b90e915ed6888217faf82f03
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
-
Filesize
802KB
MD5ac34ba84a5054cd701efad5dd14645c9
SHA1dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
SHA256c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
SHA512df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ENC_default_default_2024-08-23_22-53-04=ELONMUSKISGREEDY.exe
Filesize2.3MB
MD536adf0930dee86c24335c023b9de1956
SHA1f7400c68d2a13c9ddad0adb1ace6b70ed9a47bd6
SHA256b3658008f5c35db1cc1c72fbf9587b8de23e5a3efd53186805deef84b09318d2
SHA51209eb1c90760c4b065880874318f3107a096820203854fff48dc8e26d330e3b483be1a84c3e5cd57a87345190f1d2c92349587b5628dbed1d2a8adde34fae040b
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
1.6MB
MD5b5ccae67ddfb858b2f764cd6d4065e99
SHA1208bbca7a59bb1926e93c4986700a47c06fdd7b2
SHA256915a72236ead8270af5fdf315b1128bdd98eecae53dd82653748e456d8dc3c2b
SHA5128b4666a823f918396c2b36df22279ec20e949c3fc184058b5dd9425b49a9d3dcb1e1e901e995a13334df820931b981d00c102dbad276f3fb870312fb0aac5427
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82