Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-10-2024 17:39
Static task
static1
Behavioral task
behavioral1
Sample
f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe
Resource
win10v2004-20241007-en
General
-
Target
f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe
-
Size
56KB
-
MD5
6262389396c23fa6b30e6c509b8124a6
-
SHA1
1e70cc88291eb973e05fb2320710adffb195560b
-
SHA256
f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3
-
SHA512
5db7cb41460a926dcafabb43b7379947fc07b5c1db9229ac1b1597bc53d3ac78f65da9a46c01ce687a879a5575fef42ece90bd251564a709c0b06884f3a6ad81
-
SSDEEP
1536:YNeRBl5PT/rx1mzwRMSTdLpJGaefu/BLPu2r8kgj:YQRrmzwR5JKu/MI8ke
Malware Config
Extracted
C:\info.hta
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 2812 bcdedit.exe 2720 bcdedit.exe 2304 bcdedit.exe 2568 bcdedit.exe -
Renames multiple (311) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2876 wbadmin.exe 352 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 3000 netsh.exe 1804 netsh.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 3 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3 = "C:\\Users\\Admin\\AppData\\Local\\f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe" f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3 = "C:\\Users\\Admin\\AppData\\Local\\f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe" f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Public\Downloads\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\Links\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Public\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\Searches\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\Videos\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Public\Libraries\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Public\Desktop\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U8F4PBMO\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4DY23DRT\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\98Y29LGS\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\Documents\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CUMHXU73\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\R627XHFP\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Public\Videos\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T072YXIW\desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18191_.WMF f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\HEADER.GIF.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\1px.gif f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099158.WMF.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00531_.WMF f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18223_.WMF f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files\Java\jre7\bin\tnameserv.exe.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\THMBNAIL.PNG f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKExcel.dll.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBHW6.CHM f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0185604.WMF f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02578_.WMF f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAME.DLL f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginReport.Dotx.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\rt3d.dll.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OWSSUPP.DLL.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10265_.GIF f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR18F.GIF f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\AddToViewArrow.jpg.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL105.XML f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7EN.LEX f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\library.js f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105588.WMF f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\cpu.css f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBOB6.CHM f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid.gif.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHEVI.DLL f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\settings.html f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files (x86)\desktop.ini.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187839.WMF.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293570.WMF.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.id[61B3AC2F-2833].[[email protected]].eject f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ED00019_.WMF f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00170_.WMF f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\bg_sidebar.png f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0183198.WMF f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GREET11.POC f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2872 vssadmin.exe 772 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe Token: SeBackupPrivilege 1260 vssvc.exe Token: SeRestorePrivilege 1260 vssvc.exe Token: SeAuditPrivilege 1260 vssvc.exe Token: SeIncreaseQuotaPrivilege 1600 WMIC.exe Token: SeSecurityPrivilege 1600 WMIC.exe Token: SeTakeOwnershipPrivilege 1600 WMIC.exe Token: SeLoadDriverPrivilege 1600 WMIC.exe Token: SeSystemProfilePrivilege 1600 WMIC.exe Token: SeSystemtimePrivilege 1600 WMIC.exe Token: SeProfSingleProcessPrivilege 1600 WMIC.exe Token: SeIncBasePriorityPrivilege 1600 WMIC.exe Token: SeCreatePagefilePrivilege 1600 WMIC.exe Token: SeBackupPrivilege 1600 WMIC.exe Token: SeRestorePrivilege 1600 WMIC.exe Token: SeShutdownPrivilege 1600 WMIC.exe Token: SeDebugPrivilege 1600 WMIC.exe Token: SeSystemEnvironmentPrivilege 1600 WMIC.exe Token: SeRemoteShutdownPrivilege 1600 WMIC.exe Token: SeUndockPrivilege 1600 WMIC.exe Token: SeManageVolumePrivilege 1600 WMIC.exe Token: 33 1600 WMIC.exe Token: 34 1600 WMIC.exe Token: 35 1600 WMIC.exe Token: SeIncreaseQuotaPrivilege 1600 WMIC.exe Token: SeSecurityPrivilege 1600 WMIC.exe Token: SeTakeOwnershipPrivilege 1600 WMIC.exe Token: SeLoadDriverPrivilege 1600 WMIC.exe Token: SeSystemProfilePrivilege 1600 WMIC.exe Token: SeSystemtimePrivilege 1600 WMIC.exe Token: SeProfSingleProcessPrivilege 1600 WMIC.exe Token: SeIncBasePriorityPrivilege 1600 WMIC.exe Token: SeCreatePagefilePrivilege 1600 WMIC.exe Token: SeBackupPrivilege 1600 WMIC.exe Token: SeRestorePrivilege 1600 WMIC.exe Token: SeShutdownPrivilege 1600 WMIC.exe Token: SeDebugPrivilege 1600 WMIC.exe Token: SeSystemEnvironmentPrivilege 1600 WMIC.exe Token: SeRemoteShutdownPrivilege 1600 WMIC.exe Token: SeUndockPrivilege 1600 WMIC.exe Token: SeManageVolumePrivilege 1600 WMIC.exe Token: 33 1600 WMIC.exe Token: 34 1600 WMIC.exe Token: 35 1600 WMIC.exe Token: SeBackupPrivilege 2272 wbengine.exe Token: SeRestorePrivilege 2272 wbengine.exe Token: SeSecurityPrivilege 2272 wbengine.exe Token: SeIncreaseQuotaPrivilege 1040 WMIC.exe Token: SeSecurityPrivilege 1040 WMIC.exe Token: SeTakeOwnershipPrivilege 1040 WMIC.exe Token: SeLoadDriverPrivilege 1040 WMIC.exe Token: SeSystemProfilePrivilege 1040 WMIC.exe Token: SeSystemtimePrivilege 1040 WMIC.exe Token: SeProfSingleProcessPrivilege 1040 WMIC.exe Token: SeIncBasePriorityPrivilege 1040 WMIC.exe Token: SeCreatePagefilePrivilege 1040 WMIC.exe Token: SeBackupPrivilege 1040 WMIC.exe Token: SeRestorePrivilege 1040 WMIC.exe Token: SeShutdownPrivilege 1040 WMIC.exe Token: SeDebugPrivilege 1040 WMIC.exe Token: SeSystemEnvironmentPrivilege 1040 WMIC.exe Token: SeRemoteShutdownPrivilege 1040 WMIC.exe Token: SeUndockPrivilege 1040 WMIC.exe Token: SeManageVolumePrivilege 1040 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 1500 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 32 PID 2120 wrote to memory of 1500 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 32 PID 2120 wrote to memory of 1500 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 32 PID 2120 wrote to memory of 1500 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 32 PID 2120 wrote to memory of 2316 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 33 PID 2120 wrote to memory of 2316 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 33 PID 2120 wrote to memory of 2316 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 33 PID 2120 wrote to memory of 2316 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 33 PID 1500 wrote to memory of 2872 1500 cmd.exe 36 PID 1500 wrote to memory of 2872 1500 cmd.exe 36 PID 1500 wrote to memory of 2872 1500 cmd.exe 36 PID 2316 wrote to memory of 3000 2316 cmd.exe 37 PID 2316 wrote to memory of 3000 2316 cmd.exe 37 PID 2316 wrote to memory of 3000 2316 cmd.exe 37 PID 2316 wrote to memory of 1804 2316 cmd.exe 39 PID 2316 wrote to memory of 1804 2316 cmd.exe 39 PID 2316 wrote to memory of 1804 2316 cmd.exe 39 PID 1500 wrote to memory of 1600 1500 cmd.exe 41 PID 1500 wrote to memory of 1600 1500 cmd.exe 41 PID 1500 wrote to memory of 1600 1500 cmd.exe 41 PID 1500 wrote to memory of 2812 1500 cmd.exe 43 PID 1500 wrote to memory of 2812 1500 cmd.exe 43 PID 1500 wrote to memory of 2812 1500 cmd.exe 43 PID 1500 wrote to memory of 2720 1500 cmd.exe 44 PID 1500 wrote to memory of 2720 1500 cmd.exe 44 PID 1500 wrote to memory of 2720 1500 cmd.exe 44 PID 1500 wrote to memory of 2876 1500 cmd.exe 45 PID 1500 wrote to memory of 2876 1500 cmd.exe 45 PID 1500 wrote to memory of 2876 1500 cmd.exe 45 PID 2120 wrote to memory of 2440 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 50 PID 2120 wrote to memory of 2440 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 50 PID 2120 wrote to memory of 2440 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 50 PID 2120 wrote to memory of 2440 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 50 PID 2120 wrote to memory of 2676 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 51 PID 2120 wrote to memory of 2676 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 51 PID 2120 wrote to memory of 2676 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 51 PID 2120 wrote to memory of 2676 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 51 PID 2120 wrote to memory of 2916 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 52 PID 2120 wrote to memory of 2916 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 52 PID 2120 wrote to memory of 2916 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 52 PID 2120 wrote to memory of 2916 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 52 PID 2120 wrote to memory of 2688 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 53 PID 2120 wrote to memory of 2688 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 53 PID 2120 wrote to memory of 2688 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 53 PID 2120 wrote to memory of 2688 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 53 PID 2120 wrote to memory of 400 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 54 PID 2120 wrote to memory of 400 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 54 PID 2120 wrote to memory of 400 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 54 PID 2120 wrote to memory of 400 2120 f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe 54 PID 400 wrote to memory of 772 400 cmd.exe 56 PID 400 wrote to memory of 772 400 cmd.exe 56 PID 400 wrote to memory of 772 400 cmd.exe 56 PID 400 wrote to memory of 1040 400 cmd.exe 57 PID 400 wrote to memory of 1040 400 cmd.exe 57 PID 400 wrote to memory of 1040 400 cmd.exe 57 PID 400 wrote to memory of 2304 400 cmd.exe 58 PID 400 wrote to memory of 2304 400 cmd.exe 58 PID 400 wrote to memory of 2304 400 cmd.exe 58 PID 400 wrote to memory of 2568 400 cmd.exe 59 PID 400 wrote to memory of 2568 400 cmd.exe 59 PID 400 wrote to memory of 2568 400 cmd.exe 59 PID 400 wrote to memory of 352 400 cmd.exe 60 PID 400 wrote to memory of 352 400 cmd.exe 60 PID 400 wrote to memory of 352 400 cmd.exe 60 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe"C:\Users\Admin\AppData\Local\Temp\f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe"C:\Users\Admin\AppData\Local\Temp\f5545a722ebba70116e5081b4ec8e6f0c4c6d2231999dfbe1946d7ef5d5d81f3.exe"2⤵PID:2308
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2872
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2812
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2720
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2876
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3000
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1804
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2440
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2676
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2916
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2688
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:772
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2304
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2568
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:352
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2800
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2132
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD50f6c78c20798a9c91309d92b4b345e78
SHA10ec34e0216271511dbf79b45cd96af632bd212e5
SHA25677c3a57fad3d56e1c5a344a17d0b2c28138d117ef2f1ea5d21c820fb4dc9ea4f
SHA5125ed8e096d2084704eeb47e3ea53966162f906fcde11570efec555d3375543396b94d492e8ecd9431be0c1628fd068f7f35e1f43af6a62630fb998c09e1fbae92