Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10_x64 -
resource
win10 -
submitted
24-06-2020 14:57
Static task
static1
Behavioral task
behavioral1
Sample
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe
Resource
win10
General
-
Target
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe
-
Size
160KB
-
MD5
a9a6801356bda621d857929a25919e67
-
SHA1
c71c6a6dc811aab2d597a758bd09b2177f317497
-
SHA256
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919
-
SHA512
19540587b5c24976eec13465bb198f366379a022a1e0db5cee46da38c84de2ad0fac358a05b90bfd0772c9a648470cb7857782f59a25ba7faa39da2145c25624
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
Signatures
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.execmd.execmd.exedescription pid process target process PID 3612 wrote to memory of 2576 3612 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 3612 wrote to memory of 2576 3612 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 3612 wrote to memory of 2576 3612 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 3612 wrote to memory of 2576 3612 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 3612 wrote to memory of 2576 3612 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 3612 wrote to memory of 2576 3612 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 3612 wrote to memory of 2576 3612 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 3612 wrote to memory of 2576 3612 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe PID 2576 wrote to memory of 3820 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 2576 wrote to memory of 3820 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 3820 wrote to memory of 3456 3820 cmd.exe mode.com PID 3820 wrote to memory of 3456 3820 cmd.exe mode.com PID 3820 wrote to memory of 3412 3820 cmd.exe vssadmin.exe PID 3820 wrote to memory of 3412 3820 cmd.exe vssadmin.exe PID 2576 wrote to memory of 2664 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 2576 wrote to memory of 2664 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe cmd.exe PID 2576 wrote to memory of 1992 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe PID 2576 wrote to memory of 1992 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe PID 2664 wrote to memory of 1832 2664 cmd.exe mode.com PID 2664 wrote to memory of 1832 2664 cmd.exe mode.com PID 2576 wrote to memory of 256 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe PID 2576 wrote to memory of 256 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe mshta.exe PID 2664 wrote to memory of 276 2664 cmd.exe vssadmin.exe PID 2664 wrote to memory of 276 2664 cmd.exe vssadmin.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 3412 vssadmin.exe 276 vssadmin.exe -
Drops desktop.ini file(s) 70 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Music\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2066881839-3229799743-3576549721-1000\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Documents\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Music\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Videos\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Links\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exevssvc.exedescription pid process Token: SeDebugPrivilege 3612 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe Token: SeBackupPrivilege 3728 vssvc.exe Token: SeRestorePrivilege 3728 vssvc.exe Token: SeAuditPrivilege 3728 vssvc.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops file in Program Files directory 35207 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\CANYON.INF.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\8201_48x48x32.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\ui-strings.js 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\angel.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadcer.dll 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\appstore.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-64_altform-unplated.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-24.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Spiral.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\TraceFormat.fon.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\HeroHelp\Scenario2RTL.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\logo.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-250.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_comment_18.svg 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-200.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-20.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons_2x.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\ui-strings.js.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ad_16x11.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\pm_16x11.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OneConnectMedTile.scale-200.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-32.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\hyph_en_US.dic.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Confirmation2x.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo2.targetsize-36.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\LobbyTiles\Freecell_bp_809.jpg 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\main.css.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-400.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\selection-actions2x.png.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluNoInternetConnection_120x80.svg.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\selector.js.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Windows Defender\ProtectionManagement.dll 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\images\OfficeHubLogo_310x150.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\6445_48x48x32.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\ui-strings.js.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe -
Drops file in System32 directory 2 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription ioc process File created C:\Windows\System32\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Windows\System32\Info.hta 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Adds Run entry to start application 2 TTPs 3 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe = "C:\\Windows\\System32\\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe" 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Suspicious behavior: EnumeratesProcesses 461 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exepid process 3612 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 2576 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription pid process target process PID 3612 set thread context of 2576 3612 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe -
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Drops startup file 5 IoCs
Processes:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-C85C46ED.[[email protected]].pgp 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe"C:\Users\Admin\AppData\Local\Temp\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe"C:/Users/Admin/AppData/Local/Temp/084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe"2⤵
- Suspicious use of WriteProcessMemory
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in System32 directory
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919.exe.log
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
memory/256-24-0x0000000000000000-mapping.dmp
-
memory/276-25-0x0000000000000000-mapping.dmp
-
memory/1832-23-0x0000000000000000-mapping.dmp
-
memory/1992-22-0x0000000000000000-mapping.dmp
-
memory/2576-0-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2576-2-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2576-1-0x000000000040A9D0-mapping.dmp
-
memory/2664-21-0x0000000000000000-mapping.dmp
-
memory/3412-5-0x0000000000000000-mapping.dmp
-
memory/3456-4-0x0000000000000000-mapping.dmp
-
memory/3820-3-0x0000000000000000-mapping.dmp