Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/03/2025, 22:56
Static task
static1
Behavioral task
behavioral1
Sample
6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe
Resource
win10v2004-20250217-en
General
-
Target
6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe
-
Size
1.1MB
-
MD5
1a38216cf1bdf152d20172b91613a68b
-
SHA1
59c49124a13a1bd0d6df0d870d400bf887f59a10
-
SHA256
05f2409c26496e37a1dc127969da7855f1720f27aec24a035e38b59038a7ca82
-
SHA512
502c6156a859e85be73bc7af318135a3af9885044d74ade58c1702364f888a946582aaa74a0166c92e319136fe20cf80bfc66d7aca4ce5d398bf694ceb63c296
-
SSDEEP
6144:Q2VgVp1BDwmFEVdbu2+dHHbt/khGVGYpBf3tAqqtf07rl0Ea4JfTpKiUWk41o1xE:Q2ubbHOcXd30tcp0Ea4dpKJWxm1iTH
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
class='mark'>[email protected]
[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Phobos family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1632 bcdedit.exe 1992 bcdedit.exe 2556 bcdedit.exe 2088 bcdedit.exe -
Renames multiple (311) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2568 wbadmin.exe 1828 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2784 netsh.exe 2816 netsh.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 3 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy = "C:\\Users\\Admin\\AppData\\Local\\6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe" 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy = "C:\\Users\\Admin\\AppData\\Local\\6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe" 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\3W44XPEP\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\75GKCLJR\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Public\Documents\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\GKATPXW1\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GFIGH6G\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Public\Videos\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\L7XNHY48\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8O71085\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\calendar.css 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101862.BMP.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImages.jpg 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_over.gif 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous.png 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Araguaina 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02398_.WMF 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR5B.GIF 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL109.XML 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198447.WMF.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00726_.WMF.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\SPLASH.WAV 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate.css 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199473.WMF 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18187_.WMF 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Wordcnvr.dll.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledb32r.dll 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\settings.css 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00361_.WMF.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Metro.thmx.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Premium.gif 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\oisctrl.dll 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187851.WMF 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME01.CSS 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\wmpnssui.dll.mui 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\DELIMR.FAE 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\it-IT\msader15.dll.mui 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05710_.WMF.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME10.CSS 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_OFF.GIF.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21331_.GIF 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\XLLEX.DLL.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ERROR.GIF.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\THMBNAIL.PNG 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html.id[530B1288-2987].[[email protected]].eking 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OCRHC.DAT 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.AR.XML 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187829.WMF 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2328 vssadmin.exe 2956 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe Token: SeBackupPrivilege 2184 vssvc.exe Token: SeRestorePrivilege 2184 vssvc.exe Token: SeAuditPrivilege 2184 vssvc.exe Token: SeIncreaseQuotaPrivilege 3056 WMIC.exe Token: SeSecurityPrivilege 3056 WMIC.exe Token: SeTakeOwnershipPrivilege 3056 WMIC.exe Token: SeLoadDriverPrivilege 3056 WMIC.exe Token: SeSystemProfilePrivilege 3056 WMIC.exe Token: SeSystemtimePrivilege 3056 WMIC.exe Token: SeProfSingleProcessPrivilege 3056 WMIC.exe Token: SeIncBasePriorityPrivilege 3056 WMIC.exe Token: SeCreatePagefilePrivilege 3056 WMIC.exe Token: SeBackupPrivilege 3056 WMIC.exe Token: SeRestorePrivilege 3056 WMIC.exe Token: SeShutdownPrivilege 3056 WMIC.exe Token: SeDebugPrivilege 3056 WMIC.exe Token: SeSystemEnvironmentPrivilege 3056 WMIC.exe Token: SeRemoteShutdownPrivilege 3056 WMIC.exe Token: SeUndockPrivilege 3056 WMIC.exe Token: SeManageVolumePrivilege 3056 WMIC.exe Token: 33 3056 WMIC.exe Token: 34 3056 WMIC.exe Token: 35 3056 WMIC.exe Token: SeIncreaseQuotaPrivilege 3056 WMIC.exe Token: SeSecurityPrivilege 3056 WMIC.exe Token: SeTakeOwnershipPrivilege 3056 WMIC.exe Token: SeLoadDriverPrivilege 3056 WMIC.exe Token: SeSystemProfilePrivilege 3056 WMIC.exe Token: SeSystemtimePrivilege 3056 WMIC.exe Token: SeProfSingleProcessPrivilege 3056 WMIC.exe Token: SeIncBasePriorityPrivilege 3056 WMIC.exe Token: SeCreatePagefilePrivilege 3056 WMIC.exe Token: SeBackupPrivilege 3056 WMIC.exe Token: SeRestorePrivilege 3056 WMIC.exe Token: SeShutdownPrivilege 3056 WMIC.exe Token: SeDebugPrivilege 3056 WMIC.exe Token: SeSystemEnvironmentPrivilege 3056 WMIC.exe Token: SeRemoteShutdownPrivilege 3056 WMIC.exe Token: SeUndockPrivilege 3056 WMIC.exe Token: SeManageVolumePrivilege 3056 WMIC.exe Token: 33 3056 WMIC.exe Token: 34 3056 WMIC.exe Token: 35 3056 WMIC.exe Token: SeBackupPrivilege 2452 wbengine.exe Token: SeRestorePrivilege 2452 wbengine.exe Token: SeSecurityPrivilege 2452 wbengine.exe Token: SeIncreaseQuotaPrivilege 3060 WMIC.exe Token: SeSecurityPrivilege 3060 WMIC.exe Token: SeTakeOwnershipPrivilege 3060 WMIC.exe Token: SeLoadDriverPrivilege 3060 WMIC.exe Token: SeSystemProfilePrivilege 3060 WMIC.exe Token: SeSystemtimePrivilege 3060 WMIC.exe Token: SeProfSingleProcessPrivilege 3060 WMIC.exe Token: SeIncBasePriorityPrivilege 3060 WMIC.exe Token: SeCreatePagefilePrivilege 3060 WMIC.exe Token: SeBackupPrivilege 3060 WMIC.exe Token: SeRestorePrivilege 3060 WMIC.exe Token: SeShutdownPrivilege 3060 WMIC.exe Token: SeDebugPrivilege 3060 WMIC.exe Token: SeSystemEnvironmentPrivilege 3060 WMIC.exe Token: SeRemoteShutdownPrivilege 3060 WMIC.exe Token: SeUndockPrivilege 3060 WMIC.exe Token: SeManageVolumePrivilege 3060 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2772 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 32 PID 2180 wrote to memory of 2772 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 32 PID 2180 wrote to memory of 2772 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 32 PID 2180 wrote to memory of 2772 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 32 PID 2180 wrote to memory of 2760 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 33 PID 2180 wrote to memory of 2760 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 33 PID 2180 wrote to memory of 2760 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 33 PID 2180 wrote to memory of 2760 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 33 PID 2772 wrote to memory of 2328 2772 cmd.exe 36 PID 2772 wrote to memory of 2328 2772 cmd.exe 36 PID 2772 wrote to memory of 2328 2772 cmd.exe 36 PID 2760 wrote to memory of 2784 2760 cmd.exe 37 PID 2760 wrote to memory of 2784 2760 cmd.exe 37 PID 2760 wrote to memory of 2784 2760 cmd.exe 37 PID 2760 wrote to memory of 2816 2760 cmd.exe 39 PID 2760 wrote to memory of 2816 2760 cmd.exe 39 PID 2760 wrote to memory of 2816 2760 cmd.exe 39 PID 2772 wrote to memory of 3056 2772 cmd.exe 41 PID 2772 wrote to memory of 3056 2772 cmd.exe 41 PID 2772 wrote to memory of 3056 2772 cmd.exe 41 PID 2772 wrote to memory of 1632 2772 cmd.exe 43 PID 2772 wrote to memory of 1632 2772 cmd.exe 43 PID 2772 wrote to memory of 1632 2772 cmd.exe 43 PID 2772 wrote to memory of 1992 2772 cmd.exe 44 PID 2772 wrote to memory of 1992 2772 cmd.exe 44 PID 2772 wrote to memory of 1992 2772 cmd.exe 44 PID 2772 wrote to memory of 2568 2772 cmd.exe 45 PID 2772 wrote to memory of 2568 2772 cmd.exe 45 PID 2772 wrote to memory of 2568 2772 cmd.exe 45 PID 2180 wrote to memory of 2616 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 49 PID 2180 wrote to memory of 2616 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 49 PID 2180 wrote to memory of 2616 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 49 PID 2180 wrote to memory of 2616 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 49 PID 2180 wrote to memory of 1680 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 50 PID 2180 wrote to memory of 1680 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 50 PID 2180 wrote to memory of 1680 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 50 PID 2180 wrote to memory of 1680 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 50 PID 2180 wrote to memory of 3028 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 51 PID 2180 wrote to memory of 3028 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 51 PID 2180 wrote to memory of 3028 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 51 PID 2180 wrote to memory of 3028 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 51 PID 2180 wrote to memory of 568 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 52 PID 2180 wrote to memory of 568 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 52 PID 2180 wrote to memory of 568 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 52 PID 2180 wrote to memory of 568 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 52 PID 2180 wrote to memory of 792 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 53 PID 2180 wrote to memory of 792 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 53 PID 2180 wrote to memory of 792 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 53 PID 2180 wrote to memory of 792 2180 6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe 53 PID 792 wrote to memory of 2956 792 cmd.exe 56 PID 792 wrote to memory of 2956 792 cmd.exe 56 PID 792 wrote to memory of 2956 792 cmd.exe 56 PID 792 wrote to memory of 3060 792 cmd.exe 57 PID 792 wrote to memory of 3060 792 cmd.exe 57 PID 792 wrote to memory of 3060 792 cmd.exe 57 PID 792 wrote to memory of 2556 792 cmd.exe 58 PID 792 wrote to memory of 2556 792 cmd.exe 58 PID 792 wrote to memory of 2556 792 cmd.exe 58 PID 792 wrote to memory of 2088 792 cmd.exe 59 PID 792 wrote to memory of 2088 792 cmd.exe 59 PID 792 wrote to memory of 2088 792 cmd.exe 59 PID 792 wrote to memory of 1828 792 cmd.exe 60 PID 792 wrote to memory of 1828 792 cmd.exe 60 PID 792 wrote to memory of 1828 792 cmd.exe 60 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe"C:\Users\Admin\AppData\Local\Temp\6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe"C:\Users\Admin\AppData\Local\Temp\6e9c9b72d1bdb993184c7aa05d961e706a57b3becf151ca4f883a80a07fdd955-Copy.exe"2⤵PID:1704
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2328
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1632
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1992
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2568
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2784
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2816
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2616
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1680
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:3028
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:568
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2956
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2556
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2088
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1828
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1932
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:3328
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD52a0582b2e8d8c85433447aa7fddf504a
SHA1c3ae3fadc444453a0df1f175df1695e1f9391c77
SHA256f810937f23de43ea27272e9a02d7d21116ae7dc4a3a54fa08e5941a8940f0aba
SHA512570f1b0e2425cfa9bd60b69621fc20239036f03a4d8a2295db0b5c43e5fe19a0c1d4ec68ff7d482171b876fec128f126cc8ee44c91a5cab30856996357d15006