Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
11-09-2020 08:09
Static task
static1
Behavioral task
behavioral1
Sample
5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe
Resource
win10v200722
General
-
Target
5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe
-
Size
92KB
-
MD5
a75cacc856827260166c52093a40f49b
-
SHA1
f357f2a0bbd1ac95d9f6c4c1396e4ab718441a99
-
SHA256
5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4
-
SHA512
2d3c528fdb2a091f36a2604c90951797dc95ffc6acb9405f53db72a5b36ef377c8bff6293bfce4120b7581d21ea975c8b27ba6ff13b24591e4a95306361d15f5
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
btckeys@aol.com
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
btckeys@aol.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe = "C:\\Windows\\System32\\5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe" 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe -
Drops desktop.ini file(s) 70 IoCs
Processes:
5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Public\Music\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Public\Videos\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2168186643-810464528-1121082739-1000\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Public\Documents\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Music\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Public\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe -
Drops file in System32 directory 2 IoCs
Processes:
5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exedescription ioc process File created C:\Windows\System32\5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Windows\System32\Info.hta 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 35202 IoCs
Processes:
5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\LargeTile.scale-100.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.dualsim1.wink.scale-200.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\en-us\officons.ttf 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_11d.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ALRTINTL.DLL 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Office\Rotate.scale-100.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadcer.dll 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\191.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_invite_24.svg.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.Amo.dll.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\shape_cylinder.3mf 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\bg5_thumb.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\MapsWideTile.scale-100.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\ui-strings.js 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\mask\13d.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailSmallTile.scale-125.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\main.css.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_filter_18.svg.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.GRAPH.16.1033.hxn 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msmdsrv.rll.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README_en_GB.txt 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\ui-strings.js.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VVIEWDWG.DLL.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\VBE6EXT.OLB.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\ui-strings.js.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-100_contrast-black.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line.cur.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-400.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6478_32x32x32.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Bark.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\ui-strings.js.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\dt_socket.dll.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore\Resources\Assets\RT_Icons_Cert_16.png 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\Audio\incoming_contacts.wav 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.id-F37BBF5F.[btckeys@aol.com].2020 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2616 vssadmin.exe 1352 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 568 IoCs
Processes:
5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exepid process 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3888 vssvc.exe Token: SeRestorePrivilege 3888 vssvc.exe Token: SeAuditPrivilege 3888 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.execmd.execmd.exedescription pid process target process PID 3076 wrote to memory of 1328 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe cmd.exe PID 3076 wrote to memory of 1328 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe cmd.exe PID 1328 wrote to memory of 2336 1328 cmd.exe mode.com PID 1328 wrote to memory of 2336 1328 cmd.exe mode.com PID 1328 wrote to memory of 2616 1328 cmd.exe vssadmin.exe PID 1328 wrote to memory of 2616 1328 cmd.exe vssadmin.exe PID 3076 wrote to memory of 4060 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe cmd.exe PID 3076 wrote to memory of 4060 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe cmd.exe PID 4060 wrote to memory of 3796 4060 cmd.exe mode.com PID 4060 wrote to memory of 3796 4060 cmd.exe mode.com PID 4060 wrote to memory of 1352 4060 cmd.exe vssadmin.exe PID 4060 wrote to memory of 1352 4060 cmd.exe vssadmin.exe PID 3076 wrote to memory of 276 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe mshta.exe PID 3076 wrote to memory of 276 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe mshta.exe PID 3076 wrote to memory of 2636 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe mshta.exe PID 3076 wrote to memory of 2636 3076 5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe"C:\Users\Admin\AppData\Local\Temp\5837daaf4f7cf7280ec0a749e161015c1de39b35fa26710ce7bb22e352725ed4.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
memory/276-6-0x0000000000000000-mapping.dmp
-
memory/1328-0-0x0000000000000000-mapping.dmp
-
memory/1352-5-0x0000000000000000-mapping.dmp
-
memory/2336-1-0x0000000000000000-mapping.dmp
-
memory/2616-2-0x0000000000000000-mapping.dmp
-
memory/2636-7-0x0000000000000000-mapping.dmp
-
memory/3796-4-0x0000000000000000-mapping.dmp
-
memory/4060-3-0x0000000000000000-mapping.dmp