Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
06/03/2025, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe
Resource
win10v2004-20250217-en
General
-
Target
8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe
-
Size
164KB
-
MD5
7166d39e9c1cb17e1728d316531242b1
-
SHA1
d05810943685bcd70999ff0926215f5d6fe2637a
-
SHA256
8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7
-
SHA512
b377a2605a34a0fe98a1c49db7d3898e12850944c323b7a4d19c1f5e2081e688624127de529e961da530b7439813495cc254957cb2e16ffea999d943f0fc4214
-
SSDEEP
3072:0OLdjvSZkJXvtv+HQ7kvQ4sn++DXmHz5AL:RLdTS6Xvd+HQ7kvQ44L
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Phobos family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 2456 bcdedit.exe 1620 bcdedit.exe 1948 bcdedit.exe 2772 bcdedit.exe -
Renames multiple (310) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1580 wbadmin.exe 2276 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2832 netsh.exe 2992 netsh.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 3 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7 = "C:\\Users\\Admin\\AppData\\Local\\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe" 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe Set value (str) \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7 = "C:\\Users\\Admin\\AppData\\Local\\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe" 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\05JF5XCW\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-677481364-2238709445-1347953534-1000\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\KZ8AGS28\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-677481364-2238709445-1347953534-1000\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\07ABS1DK\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Links\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8IHN5N04\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Music\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Music\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02092_.WMF 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\7-Zip\Lang\kab.txt.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcs.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\SPRING.ELM.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233070.WMF 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14656_.GIF 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QRYINT32.DLL 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_justify.gif 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Windows NT\TableTextService\fr-FR\TableTextService.dll.mui 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21318_.GIF.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR11F.GIF.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14756_.GIF 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\THOCR.PSP 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\picturePuzzle.html 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099146.WMF 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0324704.WMF 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanResume.Dotx 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Windows NT\Accessories\WordpadFilter.dll 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Java\jre7\lib\tzmappings 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_pl.dll.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN090.XML.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Java\jre7\lib\fontconfig.properties.src.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_dot.png 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\PUSH.WAV 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\service.js 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216570.WMF.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\EMAILMOD.POC.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\107.accdt.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\APIFile_8.ico.id[CDEA1146-3483].[[email protected]].8base 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2800 vssadmin.exe 2180 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe Token: SeBackupPrivilege 1636 vssvc.exe Token: SeRestorePrivilege 1636 vssvc.exe Token: SeAuditPrivilege 1636 vssvc.exe Token: SeIncreaseQuotaPrivilege 2672 WMIC.exe Token: SeSecurityPrivilege 2672 WMIC.exe Token: SeTakeOwnershipPrivilege 2672 WMIC.exe Token: SeLoadDriverPrivilege 2672 WMIC.exe Token: SeSystemProfilePrivilege 2672 WMIC.exe Token: SeSystemtimePrivilege 2672 WMIC.exe Token: SeProfSingleProcessPrivilege 2672 WMIC.exe Token: SeIncBasePriorityPrivilege 2672 WMIC.exe Token: SeCreatePagefilePrivilege 2672 WMIC.exe Token: SeBackupPrivilege 2672 WMIC.exe Token: SeRestorePrivilege 2672 WMIC.exe Token: SeShutdownPrivilege 2672 WMIC.exe Token: SeDebugPrivilege 2672 WMIC.exe Token: SeSystemEnvironmentPrivilege 2672 WMIC.exe Token: SeRemoteShutdownPrivilege 2672 WMIC.exe Token: SeUndockPrivilege 2672 WMIC.exe Token: SeManageVolumePrivilege 2672 WMIC.exe Token: 33 2672 WMIC.exe Token: 34 2672 WMIC.exe Token: 35 2672 WMIC.exe Token: SeIncreaseQuotaPrivilege 2672 WMIC.exe Token: SeSecurityPrivilege 2672 WMIC.exe Token: SeTakeOwnershipPrivilege 2672 WMIC.exe Token: SeLoadDriverPrivilege 2672 WMIC.exe Token: SeSystemProfilePrivilege 2672 WMIC.exe Token: SeSystemtimePrivilege 2672 WMIC.exe Token: SeProfSingleProcessPrivilege 2672 WMIC.exe Token: SeIncBasePriorityPrivilege 2672 WMIC.exe Token: SeCreatePagefilePrivilege 2672 WMIC.exe Token: SeBackupPrivilege 2672 WMIC.exe Token: SeRestorePrivilege 2672 WMIC.exe Token: SeShutdownPrivilege 2672 WMIC.exe Token: SeDebugPrivilege 2672 WMIC.exe Token: SeSystemEnvironmentPrivilege 2672 WMIC.exe Token: SeRemoteShutdownPrivilege 2672 WMIC.exe Token: SeUndockPrivilege 2672 WMIC.exe Token: SeManageVolumePrivilege 2672 WMIC.exe Token: 33 2672 WMIC.exe Token: 34 2672 WMIC.exe Token: 35 2672 WMIC.exe Token: SeBackupPrivilege 2428 wbengine.exe Token: SeRestorePrivilege 2428 wbengine.exe Token: SeSecurityPrivilege 2428 wbengine.exe Token: SeIncreaseQuotaPrivilege 2856 WMIC.exe Token: SeSecurityPrivilege 2856 WMIC.exe Token: SeTakeOwnershipPrivilege 2856 WMIC.exe Token: SeLoadDriverPrivilege 2856 WMIC.exe Token: SeSystemProfilePrivilege 2856 WMIC.exe Token: SeSystemtimePrivilege 2856 WMIC.exe Token: SeProfSingleProcessPrivilege 2856 WMIC.exe Token: SeIncBasePriorityPrivilege 2856 WMIC.exe Token: SeCreatePagefilePrivilege 2856 WMIC.exe Token: SeBackupPrivilege 2856 WMIC.exe Token: SeRestorePrivilege 2856 WMIC.exe Token: SeShutdownPrivilege 2856 WMIC.exe Token: SeDebugPrivilege 2856 WMIC.exe Token: SeSystemEnvironmentPrivilege 2856 WMIC.exe Token: SeRemoteShutdownPrivilege 2856 WMIC.exe Token: SeUndockPrivilege 2856 WMIC.exe Token: SeManageVolumePrivilege 2856 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2444 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 32 PID 2260 wrote to memory of 2444 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 32 PID 2260 wrote to memory of 2444 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 32 PID 2260 wrote to memory of 2444 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 32 PID 2260 wrote to memory of 2816 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 33 PID 2260 wrote to memory of 2816 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 33 PID 2260 wrote to memory of 2816 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 33 PID 2260 wrote to memory of 2816 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 33 PID 2816 wrote to memory of 2832 2816 cmd.exe 36 PID 2816 wrote to memory of 2832 2816 cmd.exe 36 PID 2816 wrote to memory of 2832 2816 cmd.exe 36 PID 2444 wrote to memory of 2800 2444 cmd.exe 37 PID 2444 wrote to memory of 2800 2444 cmd.exe 37 PID 2444 wrote to memory of 2800 2444 cmd.exe 37 PID 2816 wrote to memory of 2992 2816 cmd.exe 40 PID 2816 wrote to memory of 2992 2816 cmd.exe 40 PID 2816 wrote to memory of 2992 2816 cmd.exe 40 PID 2444 wrote to memory of 2672 2444 cmd.exe 42 PID 2444 wrote to memory of 2672 2444 cmd.exe 42 PID 2444 wrote to memory of 2672 2444 cmd.exe 42 PID 2444 wrote to memory of 2456 2444 cmd.exe 44 PID 2444 wrote to memory of 2456 2444 cmd.exe 44 PID 2444 wrote to memory of 2456 2444 cmd.exe 44 PID 2444 wrote to memory of 1620 2444 cmd.exe 45 PID 2444 wrote to memory of 1620 2444 cmd.exe 45 PID 2444 wrote to memory of 1620 2444 cmd.exe 45 PID 2444 wrote to memory of 1580 2444 cmd.exe 46 PID 2444 wrote to memory of 1580 2444 cmd.exe 46 PID 2444 wrote to memory of 1580 2444 cmd.exe 46 PID 2260 wrote to memory of 2680 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 50 PID 2260 wrote to memory of 2680 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 50 PID 2260 wrote to memory of 2680 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 50 PID 2260 wrote to memory of 2680 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 50 PID 2260 wrote to memory of 2752 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 51 PID 2260 wrote to memory of 2752 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 51 PID 2260 wrote to memory of 2752 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 51 PID 2260 wrote to memory of 2752 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 51 PID 2260 wrote to memory of 764 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 52 PID 2260 wrote to memory of 764 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 52 PID 2260 wrote to memory of 764 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 52 PID 2260 wrote to memory of 764 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 52 PID 2260 wrote to memory of 2692 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 53 PID 2260 wrote to memory of 2692 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 53 PID 2260 wrote to memory of 2692 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 53 PID 2260 wrote to memory of 2692 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 53 PID 2260 wrote to memory of 1680 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 54 PID 2260 wrote to memory of 1680 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 54 PID 2260 wrote to memory of 1680 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 54 PID 2260 wrote to memory of 1680 2260 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe 54 PID 1680 wrote to memory of 2180 1680 cmd.exe 56 PID 1680 wrote to memory of 2180 1680 cmd.exe 56 PID 1680 wrote to memory of 2180 1680 cmd.exe 56 PID 1680 wrote to memory of 2856 1680 cmd.exe 57 PID 1680 wrote to memory of 2856 1680 cmd.exe 57 PID 1680 wrote to memory of 2856 1680 cmd.exe 57 PID 1680 wrote to memory of 1948 1680 cmd.exe 59 PID 1680 wrote to memory of 1948 1680 cmd.exe 59 PID 1680 wrote to memory of 1948 1680 cmd.exe 59 PID 1680 wrote to memory of 2772 1680 cmd.exe 60 PID 1680 wrote to memory of 2772 1680 cmd.exe 60 PID 1680 wrote to memory of 2772 1680 cmd.exe 60 PID 1680 wrote to memory of 2276 1680 cmd.exe 61 PID 1680 wrote to memory of 2276 1680 cmd.exe 61 PID 1680 wrote to memory of 2276 1680 cmd.exe 61 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe"C:\Users\Admin\AppData\Local\Temp\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe"C:\Users\Admin\AppData\Local\Temp\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe"2⤵PID:1804
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2800
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2456
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1620
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1580
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2832
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2992
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2680
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2752
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:764
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2692
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2180
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1948
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2772
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2276
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2716
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1524
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD543c5d4fbc2be20f145cb1947f39430fe
SHA100ede19981eea10a376a71a52007831efb449994
SHA2563914685b648d863c483ec7ccbfecbf40b38a56d72306017fc67104ff27b667ba
SHA512bc45a50a80ed20e8e3148ba9ed1b05bea0f5b68376a36f8ee1afb83dc24f84b8c45a18b55c46f0cf8aba60323cc263b13e69f8afe4eeb0b997cdf480cc2f513a