Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
08/03/2025, 04:14
Static task
static1
Behavioral task
behavioral1
Sample
34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe
Resource
win10ltsc2021-20250217-en
General
-
Target
34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe
-
Size
69KB
-
MD5
25a54e24e9126fba91ccb92143136e9f
-
SHA1
27e0e9a39d77a59374b79d31e150ad50a5c622c9
-
SHA256
34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc
-
SHA512
156c48c86ddb192b0a8749020890c8a5b6890002bcfedd656b2ae9ea47081a51f0509fbe6f736151de5cab348d6d8d6f871ebe283cdbe20f40cb243fba3ca9cd
-
SSDEEP
1536:BkGB8nHbKUvryElSpi8jCZGcqDKlKnr8dM4CWYi:BFBMHRvrAjCZmKcnr89CW
Malware Config
Extracted
C:\Users\Admin\Desktop\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Phobos family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 4040 bcdedit.exe 1112 bcdedit.exe 5636 bcdedit.exe 3160 bcdedit.exe -
Renames multiple (655) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1684 netsh.exe 2084 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3524754987-2550789650-2995585052-1000\Control Panel\International\Geo\Nation 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 3 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc = "C:\\Users\\Admin\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3524754987-2550789650-2995585052-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc = "C:\\Users\\Admin\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files (x86)\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Public\Videos\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Public\Documents\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Public\Music\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3524754987-2550789650-2995585052-1000\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Music\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Public\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3524754987-2550789650-2995585052-1000\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Admin\Links\desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened (read-only) \??\F: mshta.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\AXIS.ELM.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Windows Media Player\WMPMediaSharing.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\ui-strings.js.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\root\Office16\OSFPROXY.DLL.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinStatusBar.v8.1.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\AppStore_icon.svg.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\S_ThumbDownOutline_22_N1.svg.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Java\jre-1.8\bin\bci.dll.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.strings.psd1 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadds.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_shared_single_filetype.svg 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql90.xsl.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-disabled_32.svg 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\warning.png 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\ui-strings.js.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-sl\ui-strings.js.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\db2v0801.xsl 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\ui-strings.js 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search.png 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Windows Media Player\WMPNSSUI.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\Microsoft.PowerShell.PackageManagement.resources.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\Microsoft.PowerShell.PSReadline.Resources.dll.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.manifest.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\ui-strings.js 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Microsoft.VCLibs.x86.14.00.appx.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\TabTip32.exe.mui 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\bs.pak.DATA.id[AE013333-2250].[[email protected]].adage 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 860 vssadmin.exe 1672 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3524754987-2550789650-2995585052-1000_Classes\Local Settings 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2612 WMIC.exe 2612 WMIC.exe 2612 WMIC.exe 2612 WMIC.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 224 vssvc.exe Token: SeRestorePrivilege 224 vssvc.exe Token: SeAuditPrivilege 224 vssvc.exe Token: SeIncreaseQuotaPrivilege 2612 WMIC.exe Token: SeSecurityPrivilege 2612 WMIC.exe Token: SeTakeOwnershipPrivilege 2612 WMIC.exe Token: SeLoadDriverPrivilege 2612 WMIC.exe Token: SeSystemProfilePrivilege 2612 WMIC.exe Token: SeSystemtimePrivilege 2612 WMIC.exe Token: SeProfSingleProcessPrivilege 2612 WMIC.exe Token: SeIncBasePriorityPrivilege 2612 WMIC.exe Token: SeCreatePagefilePrivilege 2612 WMIC.exe Token: SeBackupPrivilege 2612 WMIC.exe Token: SeRestorePrivilege 2612 WMIC.exe Token: SeShutdownPrivilege 2612 WMIC.exe Token: SeDebugPrivilege 2612 WMIC.exe Token: SeSystemEnvironmentPrivilege 2612 WMIC.exe Token: SeRemoteShutdownPrivilege 2612 WMIC.exe Token: SeUndockPrivilege 2612 WMIC.exe Token: SeManageVolumePrivilege 2612 WMIC.exe Token: 33 2612 WMIC.exe Token: 34 2612 WMIC.exe Token: 35 2612 WMIC.exe Token: 36 2612 WMIC.exe Token: SeIncreaseQuotaPrivilege 2612 WMIC.exe Token: SeSecurityPrivilege 2612 WMIC.exe Token: SeTakeOwnershipPrivilege 2612 WMIC.exe Token: SeLoadDriverPrivilege 2612 WMIC.exe Token: SeSystemProfilePrivilege 2612 WMIC.exe Token: SeSystemtimePrivilege 2612 WMIC.exe Token: SeProfSingleProcessPrivilege 2612 WMIC.exe Token: SeIncBasePriorityPrivilege 2612 WMIC.exe Token: SeCreatePagefilePrivilege 2612 WMIC.exe Token: SeBackupPrivilege 2612 WMIC.exe Token: SeRestorePrivilege 2612 WMIC.exe Token: SeShutdownPrivilege 2612 WMIC.exe Token: SeDebugPrivilege 2612 WMIC.exe Token: SeSystemEnvironmentPrivilege 2612 WMIC.exe Token: SeRemoteShutdownPrivilege 2612 WMIC.exe Token: SeUndockPrivilege 2612 WMIC.exe Token: SeManageVolumePrivilege 2612 WMIC.exe Token: 33 2612 WMIC.exe Token: 34 2612 WMIC.exe Token: 35 2612 WMIC.exe Token: 36 2612 WMIC.exe Token: SeIncreaseQuotaPrivilege 5156 WMIC.exe Token: SeSecurityPrivilege 5156 WMIC.exe Token: SeTakeOwnershipPrivilege 5156 WMIC.exe Token: SeLoadDriverPrivilege 5156 WMIC.exe Token: SeSystemProfilePrivilege 5156 WMIC.exe Token: SeSystemtimePrivilege 5156 WMIC.exe Token: SeProfSingleProcessPrivilege 5156 WMIC.exe Token: SeIncBasePriorityPrivilege 5156 WMIC.exe Token: SeCreatePagefilePrivilege 5156 WMIC.exe Token: SeBackupPrivilege 5156 WMIC.exe Token: SeRestorePrivilege 5156 WMIC.exe Token: SeShutdownPrivilege 5156 WMIC.exe Token: SeDebugPrivilege 5156 WMIC.exe Token: SeSystemEnvironmentPrivilege 5156 WMIC.exe Token: SeRemoteShutdownPrivilege 5156 WMIC.exe Token: SeUndockPrivilege 5156 WMIC.exe Token: SeManageVolumePrivilege 5156 WMIC.exe Token: 33 5156 WMIC.exe Token: 34 5156 WMIC.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 632 wrote to memory of 4780 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 89 PID 632 wrote to memory of 4780 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 89 PID 632 wrote to memory of 4488 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 90 PID 632 wrote to memory of 4488 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 90 PID 4488 wrote to memory of 2084 4488 cmd.exe 93 PID 4488 wrote to memory of 2084 4488 cmd.exe 93 PID 4780 wrote to memory of 860 4780 cmd.exe 94 PID 4780 wrote to memory of 860 4780 cmd.exe 94 PID 4780 wrote to memory of 2612 4780 cmd.exe 97 PID 4780 wrote to memory of 2612 4780 cmd.exe 97 PID 4488 wrote to memory of 1684 4488 cmd.exe 99 PID 4488 wrote to memory of 1684 4488 cmd.exe 99 PID 4780 wrote to memory of 4040 4780 cmd.exe 98 PID 4780 wrote to memory of 4040 4780 cmd.exe 98 PID 4780 wrote to memory of 1112 4780 cmd.exe 100 PID 4780 wrote to memory of 1112 4780 cmd.exe 100 PID 632 wrote to memory of 5664 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 105 PID 632 wrote to memory of 5664 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 105 PID 632 wrote to memory of 5664 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 105 PID 632 wrote to memory of 3028 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 107 PID 632 wrote to memory of 3028 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 107 PID 632 wrote to memory of 3028 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 107 PID 632 wrote to memory of 5924 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 108 PID 632 wrote to memory of 5924 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 108 PID 632 wrote to memory of 5924 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 108 PID 632 wrote to memory of 2640 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 109 PID 632 wrote to memory of 2640 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 109 PID 632 wrote to memory of 2640 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 109 PID 632 wrote to memory of 5728 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 110 PID 632 wrote to memory of 5728 632 34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe 110 PID 5728 wrote to memory of 1672 5728 cmd.exe 112 PID 5728 wrote to memory of 1672 5728 cmd.exe 112 PID 5728 wrote to memory of 5156 5728 cmd.exe 113 PID 5728 wrote to memory of 5156 5728 cmd.exe 113 PID 5728 wrote to memory of 5636 5728 cmd.exe 114 PID 5728 wrote to memory of 5636 5728 cmd.exe 114 PID 5728 wrote to memory of 3160 5728 cmd.exe 115 PID 5728 wrote to memory of 3160 5728 cmd.exe 115 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"C:\Users\Admin\AppData\Local\Temp\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"C:\Users\Admin\AppData\Local\Temp\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"2⤵PID:380
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:860
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:4040
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1112
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2084
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1684
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:5664
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:3028
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:5924
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2640
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1672
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5156
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:5636
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:3160
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:224
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[AE013333-2250].[[email protected]].adage
Filesize2.7MB
MD52d418a3b8277df383f0e6456ac3ed540
SHA17570013f9566f764be58a39b6a312b10e7fadd9b
SHA256079b85009dc5490859e6f9bf52c2ba704d4362f17f2fe35673e8b56e029da3a2
SHA51291a39bdd7d58abac330dbbbaa8226854510b069353acb3ec104d5cada7d4270c5e4f703d2912ea8980b0fcdfa2b19601935a7fe1d9c4978d6b0f1b096a384e0a
-
Filesize
5KB
MD5cf0731e503082384e1f7088b5e8fc48b
SHA1f1e4bb8978ace1e2af679e39647d0a62fbdd1a8c
SHA2564feb659f6f5b1c85aa473d91f84c1d442ed4575a5757843ffb6f7da772f735ba
SHA5125fcaf3760b04ca358df7fd51509aeb2dc41db79563aef5af48164c83881a50a48f9b151a3332464fb9be9f46cf85492454d103413b9f004f2c61127edccd3915