Analysis
-
max time kernel
151s -
max time network
36s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
24-06-2020 14:57
Static task
static1
Behavioral task
behavioral1
Sample
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe
Resource
win10
General
-
Target
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe
-
Size
160KB
-
MD5
a9a6801356bda621d857929a25919e67
-
SHA1
c71c6a6dc811aab2d597a758bd09b2177f317497
-
SHA256
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919
-
SHA512
19540587b5c24976eec13465bb198f366379a022a1e0db5cee46da38c84de2ad0fac358a05b90bfd0772c9a648470cb7857782f59a25ba7faa39da2145c25624
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
Signatures
-
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.execmd.execmd.exedescription pid process target process PID 828 wrote to memory of 1504 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 828 wrote to memory of 1504 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 828 wrote to memory of 1504 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 828 wrote to memory of 1504 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 828 wrote to memory of 1504 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 828 wrote to memory of 1504 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 828 wrote to memory of 1504 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 828 wrote to memory of 1504 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 828 wrote to memory of 1504 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 1504 wrote to memory of 1328 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 1504 wrote to memory of 1328 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 1504 wrote to memory of 1328 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 1504 wrote to memory of 1328 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 1328 wrote to memory of 1152 1328 cmd.exe mode.com PID 1328 wrote to memory of 1152 1328 cmd.exe mode.com PID 1328 wrote to memory of 1152 1328 cmd.exe mode.com PID 1328 wrote to memory of 560 1328 cmd.exe vssadmin.exe PID 1328 wrote to memory of 560 1328 cmd.exe vssadmin.exe PID 1328 wrote to memory of 560 1328 cmd.exe vssadmin.exe PID 1504 wrote to memory of 1492 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 1504 wrote to memory of 1492 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 1504 wrote to memory of 1492 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 1504 wrote to memory of 1492 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 1492 wrote to memory of 1408 1492 cmd.exe mode.com PID 1492 wrote to memory of 1408 1492 cmd.exe mode.com PID 1492 wrote to memory of 1408 1492 cmd.exe mode.com PID 1492 wrote to memory of 1428 1492 cmd.exe vssadmin.exe PID 1492 wrote to memory of 1428 1492 cmd.exe vssadmin.exe PID 1492 wrote to memory of 1428 1492 cmd.exe vssadmin.exe PID 1504 wrote to memory of 852 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe PID 1504 wrote to memory of 852 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe PID 1504 wrote to memory of 852 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe PID 1504 wrote to memory of 852 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe PID 1504 wrote to memory of 1564 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe PID 1504 wrote to memory of 1564 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe PID 1504 wrote to memory of 1564 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe PID 1504 wrote to memory of 1564 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe -
Drops file in System32 directory 2 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription ioc process File created C:\Windows\System32\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Windows\System32\Info.hta 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Drops file in Program Files directory 27777 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00095_.WMF.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\BIZCARD.XML.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\BUTTON.GIF.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107344.WMF 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02464_.WMF 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SPACE_01.MID 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_rainy.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jre7\lib\tzmappings.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03241_.WMF.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02263_.WMF.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\Templates\1033\ExecutiveLetter.dotx.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\chrome.VisualElementsManifest.xml.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0301044.WMF.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\Office14\1033\STSLISTI.DLL.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME09.CSS 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02077_.GIF.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18205_.WMF 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL016.XML.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7ES.LEX.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01080_.WMF.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02068_.WMF.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_sml.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\ACTIVITS.ICO.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jre7\bin\dcpr.dll 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\OMSMMS.CFG.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\OUTGOING.ICO 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\Office14\Library\Analysis\ATPVBAEN.XLAM.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105398.WMF 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Java\jre7\lib\zi\America\Havana.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageSlice.gif.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BDRTKFUL.POC 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BROCHURE.DPV.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Adds Run entry to start application 2 TTPs 3 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe = "C:\\Windows\\System32\\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe" 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exevssvc.exedescription pid process Token: SeDebugPrivilege 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe Token: SeBackupPrivilege 972 vssvc.exe Token: SeRestorePrivilege 972 vssvc.exe Token: SeAuditPrivilege 972 vssvc.exe -
Drops desktop.ini file(s) 77 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription ioc process File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Music\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\IQD6DIKV\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OT4YD26O\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\LUBVL9MG\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZDAW0I3Y\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\557LH6Z9\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Documents\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-910373003-3952921535-3480519689-1000\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Links\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5Q8AAMSB\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1IGGBW8Z\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XGJ27KX4\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 560 vssadmin.exe 1428 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 238 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exepid process 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 1504 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription pid process target process PID 828 set thread context of 1504 828 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Drops startup file 5 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-92117250.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe"C:\Users\Admin\AppData\Local\Temp\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe"C:/Users/Admin/AppData/Local/Temp/084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe"2⤵
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Drops file in Program Files directory
- Adds Run entry to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
memory/560-5-0x0000000000000000-mapping.dmp
-
memory/852-10-0x0000000000000000-mapping.dmp
-
memory/852-21-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB
-
memory/1152-4-0x0000000000000000-mapping.dmp
-
memory/1328-3-0x0000000000000000-mapping.dmp
-
memory/1408-8-0x0000000000000000-mapping.dmp
-
memory/1428-9-0x0000000000000000-mapping.dmp
-
memory/1492-7-0x0000000000000000-mapping.dmp
-
memory/1504-0-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1504-2-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1504-1-0x000000000040A9D0-mapping.dmp
-
memory/1564-11-0x0000000000000000-mapping.dmp