Analysis
-
max time kernel
303s -
max time network
39s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-05-2020 12:40
Static task
static1
Behavioral task
behavioral1
Sample
a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe
Resource
win7v200430
General
-
Target
a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe
-
Size
92KB
-
MD5
8ebbfe0396d3442d9a5c61c9e81e95d3
-
SHA1
7c649065f043dd8e4cc15823f77342561da18258
-
SHA256
a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30
-
SHA512
bbaf715a313d72f832e4a87268306c9a42a5e82065d1bab0282d94ceee93764c9fb419bc74f335baa014591db07b708813f3b19b738137b49c6a6550d89449ce
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1000 vssvc.exe Token: SeRestorePrivilege 1000 vssvc.exe Token: SeAuditPrivilege 1000 vssvc.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Drops file in System32 directory 2 IoCs
Processes:
a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exedescription ioc process File created C:\Windows\System32\a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Windows\System32\Info.hta a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe -
Suspicious behavior: EnumeratesProcesses 580 IoCs
Processes:
a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exepid process 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
mshta.exeNOTEPAD.EXEpid process 2008 mshta.exe 2032 NOTEPAD.EXE -
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Drops desktop.ini file(s) 77 IoCs
Processes:
a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-910373003-3952921535-3480519689-1000\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5Q8AAMSB\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZDAW0I3Y\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1IGGBW8Z\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\Documents\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\Searches\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Public\Downloads\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\LUBVL9MG\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Public\Desktop\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Public\Pictures\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\Videos\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XGJ27KX4\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Public\Documents\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Public\Videos\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\557LH6Z9\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files (x86)\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OT4YD26O\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\Music\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Public\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exedescription pid process target process PID 1612 wrote to memory of 1376 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe cmd.exe PID 1612 wrote to memory of 1376 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe cmd.exe PID 1612 wrote to memory of 1376 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe cmd.exe PID 1612 wrote to memory of 1376 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe cmd.exe PID 1612 wrote to memory of 1104 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe cmd.exe PID 1612 wrote to memory of 1104 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe cmd.exe PID 1612 wrote to memory of 1104 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe cmd.exe PID 1612 wrote to memory of 1104 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe cmd.exe PID 1612 wrote to memory of 1584 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe mshta.exe PID 1612 wrote to memory of 1584 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe mshta.exe PID 1612 wrote to memory of 1584 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe mshta.exe PID 1612 wrote to memory of 1584 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe mshta.exe PID 1612 wrote to memory of 2008 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe mshta.exe PID 1612 wrote to memory of 2008 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe mshta.exe PID 1612 wrote to memory of 2008 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe mshta.exe PID 1612 wrote to memory of 2008 1612 a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe mshta.exe -
Drops startup file 5 IoCs
Processes:
a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe -
Drops file in Program Files directory 27803 IoCs
Processes:
a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105396.WMF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Windows Journal\en-US\Journal.exe.mui a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Microsoft Office\Office14\FORMS\1033\POSTITS.ICO.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Microsoft Office\Office14\MEDIA\CHIMES.WAV.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198372.WMF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14883_.GIF a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0313965.JPG.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01468_.WMF a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15185_.GIF a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105504.WMF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143752.GIF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\AdjacencyResume.dotx.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341499.JPG a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\default.jfc.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PPSLAX.DLL a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Waveform.thmx.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7ES.DLL.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PROTTPLV.PPT a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Apothecary.eftx a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107458.WMF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_ON.GIF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Places\BUZZ.WAV.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14790_.GIF a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\XLSLICER.DLL.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sk.dll.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01294_.GIF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Microsoft Office\Office14\MSTORE.EXE.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152702.WMF a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0299611.WMF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SCNPST64.DLL.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0228959.WMF a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0234001.WMF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00373_.WMF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL109.XML.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlceer35EN.dll a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21376_.GIF.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck.css.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.id-3B1BC4EC.[[email protected]].NET a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe -
Adds Run entry to start application 2 TTPs 3 IoCs
Processes:
a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe = "C:\\Windows\\System32\\a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe" a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1492 vssadmin.exe 864 vssadmin.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe"C:\Users\Admin\AppData\Local\Temp\a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
- Drops startup file
- Drops file in Program Files directory
- Adds Run entry to start application
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\FILES ENCRYPTED.txt1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
C:\Users\Public\Desktop\FILES ENCRYPTED.txt
-
memory/1584-10-0x0000000005600000-0x0000000005623000-memory.dmpFilesize
140KB
-
memory/1584-11-0x0000000005A00000-0x0000000005A0B000-memory.dmpFilesize
44KB