Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7 -
submitted
11-09-2020 08:07
Static task
static1
Behavioral task
behavioral1
Sample
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe
Resource
win7
Behavioral task
behavioral2
Sample
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe
Resource
win10v200722
General
-
Target
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe
-
Size
92KB
-
MD5
44ff6136293b783a38c252ee5025dc87
-
SHA1
1207eee8da1eadc46cbf8fd4a1ac1684989ff6d1
-
SHA256
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4
-
SHA512
b15cca683b3a5f66a4ad1ad1af2d765e6059ff09362101a8797281f3bebc341b121bfba1cdfc79f755207b093a49e069e5726e8a70453870d418c5e09beff80b
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
tcprx@cock.li
tcprx2@protonmail.ch
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
tcprx@cock.li
tcprx2@protonmail.ch
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe = "C:\\Windows\\System32\\0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe" 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe -
Drops desktop.ini file(s) 77 IoCs
Processes:
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Public\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1MJ70CPH\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GVV7BJHB\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files (x86)\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Public\Documents\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Public\Videos\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Links\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V8SX06NR\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Public\Music\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Music\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe -
Drops file in System32 directory 2 IoCs
Processes:
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exedescription ioc process File created C:\Windows\System32\0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Windows\System32\Info.hta 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Drops file in Program Files directory 27837 IoCs
Processes:
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD10219_.GIF.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200521.WMF 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.DLL.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Pushpin.eftx.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\VOLTAGE.WAV 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090777.WMF.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01858_.WMF.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151045.WMF.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSTORE_COL.HXC.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\REMOTES.ICO 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107490.WMF.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Waveform.xml 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Java\jre7\lib\zi\America\New_York.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Tunis 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Easter 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GRAPH.EXE.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SHOW_01.MID.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21309_.GIF 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\ECHO.INF 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Java\jre7\lib\meta-index.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mexico_City 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BS2BARB.POC 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Microsoft Office\Office14\1033\PSRCHKEY.DAT.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Office14\QUERIES\MSN MoneyCentral Investor Currency Rates.iqy.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)greenStateIcon.png 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0136865.WMF.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\UnblockTest.bat.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Microsoft Office\Document Themes 14\Waveform.thmx.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Java\jre7\lib\jfr.jar.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Perspective.xml 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\7-Zip\Lang\mn.txt.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178460.JPG 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21376_.GIF 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\J0115856.GIF.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00184_.WMF.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02793_.WMF.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Slipstream.eftx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.INF.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe File created C:\Program Files\Microsoft Office\Templates\1033\UrbanMergeLetter.Dotx.id-6E32685A.[tcprx@cock.li].tcprx 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1772 vssadmin.exe 672 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 252 IoCs
Processes:
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exepid process 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1680 vssvc.exe Token: SeRestorePrivilege 1680 vssvc.exe Token: SeAuditPrivilege 1680 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.execmd.execmd.exedescription pid process target process PID 1296 wrote to memory of 1064 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe cmd.exe PID 1296 wrote to memory of 1064 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe cmd.exe PID 1296 wrote to memory of 1064 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe cmd.exe PID 1296 wrote to memory of 1064 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe cmd.exe PID 1064 wrote to memory of 1788 1064 cmd.exe mode.com PID 1064 wrote to memory of 1788 1064 cmd.exe mode.com PID 1064 wrote to memory of 1788 1064 cmd.exe mode.com PID 1064 wrote to memory of 1772 1064 cmd.exe vssadmin.exe PID 1064 wrote to memory of 1772 1064 cmd.exe vssadmin.exe PID 1064 wrote to memory of 1772 1064 cmd.exe vssadmin.exe PID 1296 wrote to memory of 928 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe cmd.exe PID 1296 wrote to memory of 928 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe cmd.exe PID 1296 wrote to memory of 928 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe cmd.exe PID 1296 wrote to memory of 928 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe cmd.exe PID 928 wrote to memory of 1216 928 cmd.exe mode.com PID 928 wrote to memory of 1216 928 cmd.exe mode.com PID 928 wrote to memory of 1216 928 cmd.exe mode.com PID 928 wrote to memory of 672 928 cmd.exe vssadmin.exe PID 928 wrote to memory of 672 928 cmd.exe vssadmin.exe PID 928 wrote to memory of 672 928 cmd.exe vssadmin.exe PID 1296 wrote to memory of 1660 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe mshta.exe PID 1296 wrote to memory of 1660 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe mshta.exe PID 1296 wrote to memory of 1660 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe mshta.exe PID 1296 wrote to memory of 1660 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe mshta.exe PID 1296 wrote to memory of 564 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe mshta.exe PID 1296 wrote to memory of 564 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe mshta.exe PID 1296 wrote to memory of 564 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe mshta.exe PID 1296 wrote to memory of 564 1296 0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe"C:\Users\Admin\AppData\Local\Temp\0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
memory/564-7-0x0000000000000000-mapping.dmp
-
memory/672-5-0x0000000000000000-mapping.dmp
-
memory/928-3-0x0000000000000000-mapping.dmp
-
memory/1064-0-0x0000000000000000-mapping.dmp
-
memory/1216-4-0x0000000000000000-mapping.dmp
-
memory/1492-10-0x000007FEF7090000-0x000007FEF730A000-memory.dmpFilesize
2.5MB
-
memory/1660-6-0x0000000000000000-mapping.dmp
-
memory/1772-2-0x0000000000000000-mapping.dmp
-
memory/1788-1-0x0000000000000000-mapping.dmp