Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
06/03/2025, 19:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe
Resource
win10ltsc2021-20250217-en
phoboscredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer
windows10-ltsc 2021-x64
28 signatures
150 seconds
General
-
Target
8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe
-
Size
164KB
-
MD5
7166d39e9c1cb17e1728d316531242b1
-
SHA1
d05810943685bcd70999ff0926215f5d6fe2637a
-
SHA256
8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7
-
SHA512
b377a2605a34a0fe98a1c49db7d3898e12850944c323b7a4d19c1f5e2081e688624127de529e961da530b7439813495cc254957cb2e16ffea999d943f0fc4214
-
SSDEEP
3072:0OLdjvSZkJXvtv+HQ7kvQ4sn++DXmHz5AL:RLdTS6Xvd+HQ7kvQ44L
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\info.hta
Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>
<html>
<head>
<meta charset='windows-1251'>
<title>cartilage</title>
<HTA:APPLICATION
ICON='msiexec.exe'
SINGLEINSTANCE='yes'
SysMenu="no">
<script language='JScript'>
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type='text/css'>
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #C6B5C4;
}
img {
display:inline-block;
}
.bold {
font-weight: bold;
}
.mark {
background: #B5CC8E;
padding: 2px 5px;
}
.header {
text-align: center;
font-size: 30px;
line-height: 50px;
font-weight: bold;
margin-bottom:20px;
}
.info {
background: #e6ecf2;
border-left: 10px solid #B58CB2;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FFA07A;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
.footer {
position:fixed;
bottom:0;
right:0;
text-align: right;
}
</style>
</head>
<body>
<div class='header'>
<img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='>
<div>All your files have been encrypted!</div>
</div>
<div class='bold'>All your files have been encrypted due to a security problem with your PC.</div>
<div class='bold'>If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div>
<div class='bold'>Or write us to the Tox: <span class='mark'>78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074</span></div>
<div class='bold'>Write this ID in the title of your message <span class='mark'>7C280C00-3483</span></div>
<div>
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
</div>
<div class='note info'>
<div class='title'>Free decryption as guarantee</div>
<ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul>
</div>
<div class='note info'>
<div class='title'>How to obtain Bitcoins</div>
<ul>
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
<br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>
<br> Also you can find other places to buy Bitcoins and beginners guide here:
<br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a>
</ul>
</div>
<div class='note alert'>
<div class='title'>Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>
Emails
class='mark'>[email protected]</span></div>
URLs
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Phobos family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 4336 bcdedit.exe 4408 bcdedit.exe 2060 bcdedit.exe 5116 bcdedit.exe -
Renames multiple (653) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 8 wbadmin.exe 3696 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1732 netsh.exe 4316 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 3 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7 = "C:\\Users\\Admin\\AppData\\Local\\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe" 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe Set value (str) \REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7 = "C:\\Users\\Admin\\AppData\\Local\\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe" 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1886653772-2813795769-2221171443-1000\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1886653772-2813795769-2221171443-1000\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Music\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Music\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Documents\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: mshta.exe File opened (read-only) \??\F: 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-down_32.svg 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\orb.idl 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.DLL.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\virgo-new-folder.svg.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\ui-strings.js.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-core-timezone-l1-1-0.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\ui-strings.js 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-string-l1-1-0.dll.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-heap-l1-1-0.dll.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinEditors.v8.1.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.CoreProviders.dll.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close.png.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right.gif 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\ui-strings.js 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\ui-strings.js 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\ui-strings.js.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\nub.png.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Analytics.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\edge_game_assist\EdgeGameAssist.msix.DATA 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\tr.pak.DATA.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroSup64.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\ui-strings.js 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\ui-strings.js.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\ui-strings.js.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw\ui-strings.js 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\mi.pak.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\eventlog_provider.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll.id[7C280C00-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 444 4084 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2348 vssadmin.exe 464 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000_Classes\Local Settings 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2076 WMIC.exe 2076 WMIC.exe 2076 WMIC.exe 2076 WMIC.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe Token: SeBackupPrivilege 4704 vssvc.exe Token: SeRestorePrivilege 4704 vssvc.exe Token: SeAuditPrivilege 4704 vssvc.exe Token: SeIncreaseQuotaPrivilege 2076 WMIC.exe Token: SeSecurityPrivilege 2076 WMIC.exe Token: SeTakeOwnershipPrivilege 2076 WMIC.exe Token: SeLoadDriverPrivilege 2076 WMIC.exe Token: SeSystemProfilePrivilege 2076 WMIC.exe Token: SeSystemtimePrivilege 2076 WMIC.exe Token: SeProfSingleProcessPrivilege 2076 WMIC.exe Token: SeIncBasePriorityPrivilege 2076 WMIC.exe Token: SeCreatePagefilePrivilege 2076 WMIC.exe Token: SeBackupPrivilege 2076 WMIC.exe Token: SeRestorePrivilege 2076 WMIC.exe Token: SeShutdownPrivilege 2076 WMIC.exe Token: SeDebugPrivilege 2076 WMIC.exe Token: SeSystemEnvironmentPrivilege 2076 WMIC.exe Token: SeRemoteShutdownPrivilege 2076 WMIC.exe Token: SeUndockPrivilege 2076 WMIC.exe Token: SeManageVolumePrivilege 2076 WMIC.exe Token: 33 2076 WMIC.exe Token: 34 2076 WMIC.exe Token: 35 2076 WMIC.exe Token: 36 2076 WMIC.exe Token: SeIncreaseQuotaPrivilege 2076 WMIC.exe Token: SeSecurityPrivilege 2076 WMIC.exe Token: SeTakeOwnershipPrivilege 2076 WMIC.exe Token: SeLoadDriverPrivilege 2076 WMIC.exe Token: SeSystemProfilePrivilege 2076 WMIC.exe Token: SeSystemtimePrivilege 2076 WMIC.exe Token: SeProfSingleProcessPrivilege 2076 WMIC.exe Token: SeIncBasePriorityPrivilege 2076 WMIC.exe Token: SeCreatePagefilePrivilege 2076 WMIC.exe Token: SeBackupPrivilege 2076 WMIC.exe Token: SeRestorePrivilege 2076 WMIC.exe Token: SeShutdownPrivilege 2076 WMIC.exe Token: SeDebugPrivilege 2076 WMIC.exe Token: SeSystemEnvironmentPrivilege 2076 WMIC.exe Token: SeRemoteShutdownPrivilege 2076 WMIC.exe Token: SeUndockPrivilege 2076 WMIC.exe Token: SeManageVolumePrivilege 2076 WMIC.exe Token: 33 2076 WMIC.exe Token: 34 2076 WMIC.exe Token: 35 2076 WMIC.exe Token: 36 2076 WMIC.exe Token: SeBackupPrivilege 2036 wbengine.exe Token: SeRestorePrivilege 2036 wbengine.exe Token: SeSecurityPrivilege 2036 wbengine.exe Token: SeIncreaseQuotaPrivilege 1276 WMIC.exe Token: SeSecurityPrivilege 1276 WMIC.exe Token: SeTakeOwnershipPrivilege 1276 WMIC.exe Token: SeLoadDriverPrivilege 1276 WMIC.exe Token: SeSystemProfilePrivilege 1276 WMIC.exe Token: SeSystemtimePrivilege 1276 WMIC.exe Token: SeProfSingleProcessPrivilege 1276 WMIC.exe Token: SeIncBasePriorityPrivilege 1276 WMIC.exe Token: SeCreatePagefilePrivilege 1276 WMIC.exe Token: SeBackupPrivilege 1276 WMIC.exe Token: SeRestorePrivilege 1276 WMIC.exe Token: SeShutdownPrivilege 1276 WMIC.exe Token: SeDebugPrivilege 1276 WMIC.exe Token: SeSystemEnvironmentPrivilege 1276 WMIC.exe Token: SeRemoteShutdownPrivilege 1276 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 3764 wrote to memory of 3432 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 92 PID 3764 wrote to memory of 3432 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 92 PID 3764 wrote to memory of 3060 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 93 PID 3764 wrote to memory of 3060 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 93 PID 3060 wrote to memory of 1732 3060 cmd.exe 96 PID 3060 wrote to memory of 1732 3060 cmd.exe 96 PID 3432 wrote to memory of 2348 3432 cmd.exe 97 PID 3432 wrote to memory of 2348 3432 cmd.exe 97 PID 3060 wrote to memory of 4316 3060 cmd.exe 100 PID 3060 wrote to memory of 4316 3060 cmd.exe 100 PID 3432 wrote to memory of 2076 3432 cmd.exe 101 PID 3432 wrote to memory of 2076 3432 cmd.exe 101 PID 3432 wrote to memory of 4336 3432 cmd.exe 104 PID 3432 wrote to memory of 4336 3432 cmd.exe 104 PID 3432 wrote to memory of 4408 3432 cmd.exe 105 PID 3432 wrote to memory of 4408 3432 cmd.exe 105 PID 3432 wrote to memory of 8 3432 cmd.exe 107 PID 3432 wrote to memory of 8 3432 cmd.exe 107 PID 3764 wrote to memory of 4068 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 115 PID 3764 wrote to memory of 4068 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 115 PID 3764 wrote to memory of 4068 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 115 PID 3764 wrote to memory of 2992 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 116 PID 3764 wrote to memory of 2992 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 116 PID 3764 wrote to memory of 2992 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 116 PID 3764 wrote to memory of 2388 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 117 PID 3764 wrote to memory of 2388 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 117 PID 3764 wrote to memory of 2388 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 117 PID 3764 wrote to memory of 2468 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 118 PID 3764 wrote to memory of 2468 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 118 PID 3764 wrote to memory of 2468 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 118 PID 3764 wrote to memory of 1144 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 119 PID 3764 wrote to memory of 1144 3764 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 119 PID 1144 wrote to memory of 464 1144 cmd.exe 121 PID 1144 wrote to memory of 464 1144 cmd.exe 121 PID 1144 wrote to memory of 1276 1144 cmd.exe 122 PID 1144 wrote to memory of 1276 1144 cmd.exe 122 PID 1144 wrote to memory of 2060 1144 cmd.exe 123 PID 1144 wrote to memory of 2060 1144 cmd.exe 123 PID 1144 wrote to memory of 5116 1144 cmd.exe 124 PID 1144 wrote to memory of 5116 1144 cmd.exe 124 PID 1144 wrote to memory of 3696 1144 cmd.exe 125 PID 1144 wrote to memory of 3696 1144 cmd.exe 125 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe"C:\Users\Admin\AppData\Local\Temp\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe"C:\Users\Admin\AppData\Local\Temp\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe"2⤵PID:4084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 5003⤵
- Program crash
PID:444
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2348
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:4336
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:4408
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:8
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1732
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4316
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:4068
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:2992
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:2388
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2468
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:464
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2060
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:5116
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:3696
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4084 -ip 40841⤵PID:3628
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2992
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:1320
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[7C280C00-3483].[[email protected]].8base
Filesize2.7MB
MD54d7aa617fc70fd9450ea1adca31c1d13
SHA1fe73e584a6cd76a8cdda736afcd1d3ee049f3989
SHA256ad417a59e19ff1200cca14a4c02d9798816694fef3292a29911a277563f0f4ad
SHA512296c47e3236697a361ced5307bd62c6fd081b6dcc9c758f032608f07d4816d6b1f2f618f8bbff506d2385459a021a5a3216968fd014ca0f28de9c09d16e88281
-
Filesize
5KB
MD572553ed0df6499b34d17a15a46678e69
SHA1c83b768724ebb0deb97637366a88ba83a2c1d265
SHA25694b54c4b8a659d606ebce2eda6b4b7a1536684a3f6100ecd785d53c7ea0dd427
SHA512983e1f114b57ef4595e87cd516d17f8c91ef22e5c2fc0f6fbc7c29f16ddb1c1f6901559926099104ef4372eceecba4f52233865b072875383a624d8b6aa4ec86