Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10_x64 -
resource
win10 -
submitted
11-09-2020 08:09
Static task
static1
Behavioral task
behavioral1
Sample
d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe
Resource
win10
General
-
Target
d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe
-
Size
92KB
-
MD5
c652fadd314392b61976fc226e6f6d38
-
SHA1
38856dcaa805178155f0314a7e0430c66cb094bb
-
SHA256
d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d
-
SHA512
dd02b5f9d5197ef6e5fa22a0ee67e24e19b5bb8824535786c6165b2e8eed6d558687ee6f63bbbf5ff2c55ff827fa22310b2f2118abb88eb0df603289526f6f19
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
trizvani@aol.com
trizvani@tutanota.com
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
trizvani@aol.com
trizvani@tutanota.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe = "C:\\Windows\\System32\\d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe" d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe -
Drops desktop.ini file(s) 70 IoCs
Processes:
d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Links\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Public\Videos\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Public\Documents\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Public\Downloads\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Documents\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Searches\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Public\Libraries\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Videos\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Public\Desktop\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Public\Pictures\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Public\Music\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe -
Drops file in System32 directory 2 IoCs
Processes:
d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exedescription ioc process File created C:\Windows\System32\d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Windows\System32\Info.hta d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe -
Drops file in Program Files directory 35136 IoCs
Processes:
d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\access-bridge-64.jar d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_MouseNose.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7316_48x48x32.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\cd_60x42.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\ui-strings.js d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons2x.png.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\Images\image_placeholder.scale-200.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\SmallTile.scale-100.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\ms.pak d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\db2v0801.xsl.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupWideTile.scale-100.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-48_altform-unplated.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\ui-strings.js d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Info.plist.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql90.xsl d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-72_altform-unplated_contrast-white.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\complete.contrast-black.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\4694_24x24x32.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_pt_135x40.svg.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover.png.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-ma\ui-strings.js.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\WideLogo.scale-100.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\selector.js d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_distributed.gif.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\ui-strings.js.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_2x.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\es-es\ui-strings.js.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-options.xml d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\java.security d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSplashScreen.scale-200.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\MedTile.scale-125.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-heap-l1-1-0.dll.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Xlate_Complete.xsn.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-200_contrast-black.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\SDXHelper.exe.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreBadgeLogo.scale-100.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations.png d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js.id-122E2D9E.[trizvani@aol.com].harma d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2120 vssadmin.exe 3228 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 562 IoCs
Processes:
d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exepid process 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2140 vssvc.exe Token: SeRestorePrivilege 2140 vssvc.exe Token: SeAuditPrivilege 2140 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.execmd.execmd.exedescription pid process target process PID 1732 wrote to memory of 420 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe cmd.exe PID 1732 wrote to memory of 420 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe cmd.exe PID 420 wrote to memory of 1856 420 cmd.exe mode.com PID 420 wrote to memory of 1856 420 cmd.exe mode.com PID 420 wrote to memory of 2120 420 cmd.exe vssadmin.exe PID 420 wrote to memory of 2120 420 cmd.exe vssadmin.exe PID 1732 wrote to memory of 2564 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe cmd.exe PID 1732 wrote to memory of 2564 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe cmd.exe PID 2564 wrote to memory of 1928 2564 cmd.exe mode.com PID 2564 wrote to memory of 1928 2564 cmd.exe mode.com PID 2564 wrote to memory of 3228 2564 cmd.exe vssadmin.exe PID 2564 wrote to memory of 3228 2564 cmd.exe vssadmin.exe PID 1732 wrote to memory of 2056 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe mshta.exe PID 1732 wrote to memory of 2056 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe mshta.exe PID 1732 wrote to memory of 3016 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe mshta.exe PID 1732 wrote to memory of 3016 1732 d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe"C:\Users\Admin\AppData\Local\Temp\d4b6920e28ddba697f8e2e33f6479d16c9b92fefdc36894e3c594e3f71095e4d.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
memory/420-0-0x0000000000000000-mapping.dmp
-
memory/1856-1-0x0000000000000000-mapping.dmp
-
memory/1928-4-0x0000000000000000-mapping.dmp
-
memory/2056-7-0x0000000000000000-mapping.dmp
-
memory/2120-2-0x0000000000000000-mapping.dmp
-
memory/2564-3-0x0000000000000000-mapping.dmp
-
memory/3016-8-0x0000000000000000-mapping.dmp
-
memory/3228-5-0x0000000000000000-mapping.dmp