Analysis
-
max time kernel
151s -
max time network
66s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 06:43
Static task
static1
Behavioral task
behavioral1
Sample
5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe
Resource
win7
Behavioral task
behavioral2
Sample
5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe
Resource
win10
General
-
Target
5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe
-
Size
92KB
-
MD5
34ebd3b1a27c7176df3ff3f49ee38296
-
SHA1
951717445194f0db14f2ebce677c1528a871795f
-
SHA256
5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5
-
SHA512
2ffdc08255570544323fd198672fa7e3d4d709c20deb8408c287bc9e22697746361c4d443795c295dccd4f68684ac09688c48181df5f815be78dde2f90b4952a
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
Zagrec@protonmail.com
bitrequest@tutanota.com
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Zagrec@protonmail.com
bitrequest@tutanota.com
Signatures
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
NOTEPAD.EXEpid process 1848 NOTEPAD.EXE -
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Drops startup file 5 IoCs
Processes:
5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1636 vssadmin.exe 1608 vssadmin.exe -
Drops file in System32 directory 2 IoCs
Processes:
5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exedescription ioc process File created C:\Windows\System32\5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Windows\System32\Info.hta 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe -
Drops file in Program Files directory 27817 IoCs
Processes:
5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exedescription ioc process File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_ES.LEX 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.HK.XML.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\NAVBAR11.POC.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.ELM 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Java\jre7\bin\javafx-iio.dll.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0285698.WMF.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\OMSSMS.CFG.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8B.GIF 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00192_.WMF.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDRESTL.ICO.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Java\jre7\lib\deploy\messages.properties.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\Office14\MEDIA\CAMERA.WAV.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153508.WMF.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00704_.WMF.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01268_.GIF 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Verve.xml.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18252_.WMF.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\Office14\1033\WINWORD.DEV_K_COL.HXK.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR36F.GIF 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\RSSFeeds.js 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent.png 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14828_.GIF.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\8.png 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\J0115876.GIF.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\VSTAProject.dll 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_EN.LEX 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00402_.WMF 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\Templates\1033\EquityMergeFax.Dotx.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200163.WMF 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341738.JPG.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_07.MID.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.IE.XML 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGBORDER.XML.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\7-Zip\Lang\hy.txt.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent.png 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG.id-2749A489.[Zagrec@protonmail.com].HAT 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe -
Drops desktop.ini file(s) 77 IoCs
Processes:
5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1MJ70CPH\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OLSU73OI\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Public\Music\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Public\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Public\Documents\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files (x86)\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V8SX06NR\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Music\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe = "C:\\Windows\\System32\\5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe" 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe -
Suspicious behavior: EnumeratesProcesses 290 IoCs
Processes:
5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exepid process 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.execmd.execmd.exedescription pid process target process PID 1100 wrote to memory of 1256 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe cmd.exe PID 1100 wrote to memory of 1256 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe cmd.exe PID 1100 wrote to memory of 1256 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe cmd.exe PID 1100 wrote to memory of 1256 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe cmd.exe PID 1256 wrote to memory of 360 1256 cmd.exe mode.com PID 1256 wrote to memory of 360 1256 cmd.exe mode.com PID 1256 wrote to memory of 360 1256 cmd.exe mode.com PID 1256 wrote to memory of 1636 1256 cmd.exe vssadmin.exe PID 1256 wrote to memory of 1636 1256 cmd.exe vssadmin.exe PID 1256 wrote to memory of 1636 1256 cmd.exe vssadmin.exe PID 1100 wrote to memory of 1568 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe cmd.exe PID 1100 wrote to memory of 1568 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe cmd.exe PID 1100 wrote to memory of 1568 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe cmd.exe PID 1100 wrote to memory of 1568 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe cmd.exe PID 1568 wrote to memory of 1536 1568 cmd.exe mode.com PID 1568 wrote to memory of 1536 1568 cmd.exe mode.com PID 1568 wrote to memory of 1536 1568 cmd.exe mode.com PID 1568 wrote to memory of 1608 1568 cmd.exe vssadmin.exe PID 1568 wrote to memory of 1608 1568 cmd.exe vssadmin.exe PID 1568 wrote to memory of 1608 1568 cmd.exe vssadmin.exe PID 1100 wrote to memory of 1868 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe mshta.exe PID 1100 wrote to memory of 1868 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe mshta.exe PID 1100 wrote to memory of 1868 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe mshta.exe PID 1100 wrote to memory of 1868 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe mshta.exe PID 1100 wrote to memory of 1968 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe mshta.exe PID 1100 wrote to memory of 1968 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe mshta.exe PID 1100 wrote to memory of 1968 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe mshta.exe PID 1100 wrote to memory of 1968 1100 5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe mshta.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1516 vssvc.exe Token: SeRestorePrivilege 1516 vssvc.exe Token: SeAuditPrivilege 1516 vssvc.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe"C:\Users\Admin\AppData\Local\Temp\5d50101ed7891a85cdf98d9c8d5014223d5fad04d3eae6170afa2b1b00581bd5.exe"1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops desktop.ini file(s)
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\FILES ENCRYPTED.txt1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\FILES ENCRYPTED.txt
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
memory/360-1-0x0000000000000000-mapping.dmp
-
memory/1256-0-0x0000000000000000-mapping.dmp
-
memory/1536-4-0x0000000000000000-mapping.dmp
-
memory/1568-3-0x0000000000000000-mapping.dmp
-
memory/1608-5-0x0000000000000000-mapping.dmp
-
memory/1636-2-0x0000000000000000-mapping.dmp
-
memory/1868-6-0x0000000000000000-mapping.dmp
-
memory/1968-7-0x0000000000000000-mapping.dmp
-
memory/1968-16-0x0000000006190000-0x00000000061B3000-memory.dmpFilesize
140KB
-
memory/1968-17-0x0000000004150000-0x000000000415B000-memory.dmpFilesize
44KB